CVE-2025-59355

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-59355
A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.error(str + "decode failed", e). If the input parameter contains sensitive information such as Hive Metastore keys, plaintext passwords will be left in the log files when decoding fails, resulting in information leakage. Affected Scope Component: Sensitive fields in hive-site.xml (e.g., javax.jdo.option.ConnectionPassword) or other fields encoded in Base64. Version: Apache Linkis 1.0.0 – 1.7.0 Trigger Conditions The value of the configuration item is an invalid Base64 string. Log files are readable by users other than hive-site.xml administrators. Severity: Low The probability of Base64 decoding failure is low. The leakage is only triggered when logs at the Error level are exposed. Remediation Apache Linkis 1.8.0 and later versions have replaced the log with desensitized content. logger.error("URL decode failed: {}", e.getMessage()); // 不再输出 str Users are recommended to upgrade to version 1.8.0, which fixes the issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/4dcgmqdkk2p5y4k43ok5rgd4ylx8698h Mailing List
https://lists.apache.org/thread/75z7vhftw6w1mllndgpkfmcj0fzo4lbj Mailing List
http://www.openwall.com/lists/oss-security/2025/09/19/1 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*
History

27 Jan 2026, 21:11

Type Values Removed Values Added
References () https://lists.apache.org/thread/4dcgmqdkk2p5y4k43ok5rgd4ylx8698h - () https://lists.apache.org/thread/4dcgmqdkk2p5y4k43ok5rgd4ylx8698h - Mailing List
References () https://lists.apache.org/thread/75z7vhftw6w1mllndgpkfmcj0fzo4lbj - () https://lists.apache.org/thread/75z7vhftw6w1mllndgpkfmcj0fzo4lbj - Mailing List
References () http://www.openwall.com/lists/oss-security/2025/09/19/1 - () http://www.openwall.com/lists/oss-security/2025/09/19/1 - Mailing List, Third Party Advisory
CPE cpe:2.3:a:apache:linkis:*:*:*:*:*:*:*:*
First Time Apache
Apache linkis

20 Jan 2026, 16:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

19 Jan 2026, 10:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2025/09/19/1 -

19 Jan 2026, 09:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-19 09:16

Updated : 2026-01-27 21:11

NVD link : CVE-2025-59355

Mitre link : CVE-2025-59355

CVE.ORG link : CVE-2025-59355

JSON object : View

Products Affected

apache

  • linkis
CWE
CWE-532

Insertion of Sensitive Information into Log File