{"id":"CVE-2024-31861","aliases":["EUVD-2024-1163","GHSA-8pfj-w89w-m24x"],"status":"rejected","title":"Code injection in Apache Zeppelin Shell","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2024-04-11T08:19:58Z","modified":"2024-12-03T06:09:21Z","fixes":[{"ecosystem":"Maven","package":"org.apache.zeppelin:zeppelin-shell","fixed_in":["0.11.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.zeppelin:zeppelin-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.1"},{"fixed":"0.11.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.zeppelin:zeppelin-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.1"},{"fixed":"0.11.1"}]}],"versions":["0.10.1","0.11.0"]}],"products":[{"vendor":"apache software foundation","product":"apache zeppelin"}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31861","tags":["advisory"]},{"url":"https://github.com/apache/zeppelin/pull/4708","tags":["web"]},{"url":"https://lists.apache.org/thread/99clvqrht5l5r6kzjzwg2kj94boc9sfh","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/04/10/8","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8pfj-w89w-m24x"},{"url":"https://github.com/apache/zeppelin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-31861","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2024-04-11T08:19:58.929Z","modified":"2024-06-21T09:07:03.255Z","updated_at":"2026-11-02T14:34:14.308905Z"}],"euvd":[{"id":"EUVD-2024-1163","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2024-04-11T08:19:58Z","modified":"2024-06-21T09:07:03Z","updated_at":"2026-11-03T03:50:49.385087Z"}],"ghsa":[{"id":"GHSA-8pfj-w89w-m24x","title":"Code injection in Apache Zeppelin Shell","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.\n\nThe attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way.\nThis issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.\n\nUsers are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.\n\n","status":"published","published":"2024-04-11T09:30:56Z","modified":"2024-05-28T20:18:43Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:37:52.2286Z"}],"nvd":[{"id":"CVE-2024-31861","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2024-04-11T09:15:08.32Z","modified":"2024-06-21T10:15:11.757Z","updated_at":"2026-11-02T14:09:50.299382Z"}],"osv":[{"id":"GHSA-8pfj-w89w-m24x","title":"Code injection in Apache Zeppelin Shell","description":"Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.\n\nThe attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way.\nThis issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.\n\nUsers are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.\n\n","status":"published","published":"2024-04-11T09:30:56Z","modified":"2024-12-03T06:09:21.028891Z","cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:42.78452Z"}]}}