CVE-2024-47881

OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the database extension, the "enableloadextension" property can be set for the SQLite integration, enabling an attacker to load (local or remote) extension DLLs and so run arbitrary code on the server. The attacker needs to have network access to the OpenRefine instance. Version 3.8.3 fixes this issue.

References

Affected packages

Debian:12 / openrefine

Package

Name: openrefine
Purl: pkg:deb/debian/openrefine?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.6.2-2

3.6.2-2+deb12u1

3.6.2-2+deb12u2

3.6.2-3

3.7.4-1

3.7.5-1

3.7.6-1

3.7.7-1

3.7.8-1

3.8.7-1

3.9.3-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / openrefine

Package

Name: openrefine
Purl: pkg:deb/debian/openrefine?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.8.7-1

Affected versions

3.*

3.6.2-2

3.6.2-3

3.7.4-1

3.7.5-1

3.7.6-1

3.7.7-1

3.7.8-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/openrefine/openrefine

Affected ranges

Type: GIT
Repo: https://github.com/openrefine/openrefine
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

853a1d91662e7dc278a9a94a38be58de04494056

Affected versions

1.*

1.1

2.*

2.6-alpha.2

2.6-alpha1

2.6-beta.1

2.6-rc.2

2.7

2.7-rc.1

2.7-rc.2

2.8

3.*

3.0

3.0-beta

3.0-rc.1

3.1

3.1-beta

3.2

3.2-beta

3.3

3.3-beta

3.3-rc1

3.4-beta

3.5-beta1

3.7-beta2

3.8-beta1

v2.*

v2.6-rc1