Deserialization of Untrusted Data in Apache Johnzon - CVE-2023-33008

Vulnerability identifier: #VU80782

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-33008

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted JSON input that uses large numbers (numbers such as 1e20000000) to the application and perform a denial of service attack.

Apache Johnzon
DataPower Operations Dashboard
Robotic Process Automation for Cloud Pak
AMQ Broker
IBM App Connect Enterprise
Red Hat support for Spring Boot
Red Hat Camel for Spring Boot
InfoSphere Master Data Management
IBM Cloud Transformation Advisor
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Robotic Process Automation

Install updates from vendor's website.

Apache Johnzon - update to 1.2.21
AMQ Broker - update to 7.11.2
DataPower Operations Dashboard - update to 1.0.20.0
Red Hat support for Spring Boot - update to 2.7.17
IBM Cloud Transformation Advisor - update to 3.6.2
Red Hat Camel for Spring Boot - update to 4.0.0
IBM Business Automation Workflow - addressed in versions 21.0.3-IF034, 23.0.2-IF006, 24.0.0-IF001
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF035, 21.0.3.29, 23.0.2.1, 24.0.0-IF001
IBM Robotic Process Automation - addressed in versions 21.0.7.9, 23.0.10
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.9, 23.0.10

• https://lists.apache.org/thread/qbg14djo95gfpk7o560lr8wcrzfyw43l

• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Deserialization of untrusted data in IBM App Connect Enterprise
• Deserialization of untrusted data in IBM Robotic Process Automation
• Multiple vulnerabilities in Red Hat Integration Camel for Spring Boot 4.0
• Multiple vulnerabilities in Red Hat AMQ Broker
• Multiple vulnerabilities in Red Hat support for Spring Boot
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Deserialization of untrusted data in IBM Business Automation Workflow
• Deserialization of untrusted data in IBM DataPower Operations Dashboard
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• IBM InfoSphere Master Data Management update for Apache Johnzon