Deserialization of Untrusted Data in Apache Avro - CVE-2023-39410

Vulnerability identifier: #VU83219

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-39410

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to reader can consume memory beyond the allowed constraints and thus lead to out of memory on the system, when deserializing untrusted or corrupted data. A remote attacker can pass specially crafted data to the application and perform a denial of service attack.

Apache Avro
IBM InfoSphere Information Server
Oracle GoldenGate Big Data and Application Adapters
IBM Operations Analytics Predictive Insights
Netcool Operations Insight
Red Hat Integration Camel Extensions for Quarkus
Red Hat build of Quarkus
Oracle Financial Services Model Management and Governance
Jira Software Data Center
Bamboo Server
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
IBM Cloud Pak for Business Automation
Oracle Banking APIs
IBM Cloud Application Performance Management (APM)
IBM Observability with Instana
Operations Analytics - Log Analysis
Oracle Business Intelligence Enterprise Edition
IBM Application Suite - IBM Asset Data Dictionary Component
Cognos Dashboards on Cloud Pak for Data
IBM Cloud Pak for Multicloud Management
IBM Disconnected Log Collector
JBoss Enterprise Application Platform
Fuse
Splunk Enterprise
Jira Software Server
Event Streams
IBM Security Guardium
Oracle Business Process Management Suite
Oracle Banking Corporate Lending Process Management
Oracle Banking Origination
Stream Analytics
IBM Data Risk Manager
openEuler
eap7-jboss-annotations (Red Hat package)
eap7-jboss-jsp (Red Hat package)
eap7-yasson (Red Hat package)
eap7-wildfly-transaction-client (Red Hat package)
eap7-log4j-jboss-logmanager (Red Hat package)
eap7-h2database (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-avro (Red Hat package)
avro
eap7-bouncycastle (Red Hat package)
eap7-jboss-marshalling (Red Hat package)
eap7-xml-security (Red Hat package)
eap7-undertow (Red Hat package)
eap7-wss4j (Red Hat package)
eap7-jandex (Red Hat package)
eap7-xalan-j2 (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-apache-sshd (Red Hat package)
eap7-activemq-artemis (Red Hat package)
eap7-weld-core (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jboss-xnio-base (Red Hat package)
eap7-jgroups (Red Hat package)
eap7-hibernate (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)
eap7-guava-libraries (Red Hat package)
watsonx.data
IBM Cognos Analytics

Install updates from vendor's website.

Apache Avro - update to 1.11.3
IBM Operations Analytics Predictive Insights - update to 1.3.6.8
Operations Analytics - Log Analysis - update to 1.3.8.0.1
Netcool Operations Insight - update to 1.6.15
IBM Cloud Pak for Multicloud Management - update to 2.3.8
Red Hat Integration Camel Extensions for Quarkus - update to 2.13.9
Red Hat build of Quarkus - addressed in versions 2.13.9, 3.2.9
JBoss Enterprise Application Platform - addressed in versions 7.1.8, 7.3.11, 7.4.14
Fuse - addressed in versions 7.12.1, 7.13.0
Splunk Enterprise - addressed in versions 9.0.9, 9.1.4, 9.2.1
Jira Software Server - addressed in versions 9.4.18, 9.12.1
Jira Software Data Center - addressed in versions 9.4.18, 9.12.1
Bamboo Server - addressed in versions 9.2.8, 9.3.6, 9.4.2
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 2
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
eap7-jboss-annotations (Red Hat package) - update to api_1.3_spec-2.0.1-4.Final_redhat_00001.1.el7eap
eap7-jboss-jsp (Red Hat package) - addressed in versions api_2.3_spec-2.0.1-1.Final_redhat_00001.1.el7eap, api_2.3_spec-2.0.1-1.Final_redhat_00001.1.el8eap, api_2.3_spec-2.0.1-1.Final_redhat_00001.1.el9eap
eap7-yasson (Red Hat package) - addressed in versions 1.0.11-4.redhat_00002.1.el7eap, 1.0.11-4.redhat_00002.1.el8eap, 1.0.11-4.redhat_00002.1.el9eap
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.15
eap7-wildfly-transaction-client (Red Hat package) - addressed in versions 1.1.16-1.Final_redhat_00001.1.el7eap, 1.1.16-1.Final_redhat_00001.1.el8eap, 1.1.16-1.Final_redhat_00001.1.el9eap
eap7-log4j-jboss-logmanager (Red Hat package) - update to 1.2.2-2.Final_redhat_00002.1.el7eap
eap7-h2database (Red Hat package) - addressed in versions 1.4.197-2.redhat_00005.1.ep7.el7, 1.4.197-3.redhat_00004.1.el7eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.7.2-12.Final_redhat_00013.1.el7eap, 1.10.0-33.Final_redhat_00032.1.el7eap, 1.10.0-33.Final_redhat_00032.1.el8eap, 1.10.0-33.Final_redhat_00032.1.el9eap
eap7-avro (Red Hat package) - addressed in versions 1.7.6-2.redhat_00003.1.ep7.el7, 1.7.6-8.redhat_00003.1.el7eap, 1.11.3-1.redhat_00001.1.el7eap, 1.11.3-1.redhat_00001.1.el8eap, 1.11.3-1.redhat_00001.1.el9eap
IBM Disconnected Log Collector - update to 1.8.5
avro - update to 1.10.2-5
eap7-bouncycastle (Red Hat package) - update to 1.68.0-1.redhat_00005.1.ep7.el7
IBM Data Risk Manager - update to 2.0.6.20
eap7-jboss-marshalling (Red Hat package) - addressed in versions 2.0.14-1.SP1_redhat_00001.1.el7eap, 2.0.14-1.SP1_redhat_00001.1.el8eap, 2.0.14-1.SP1_redhat_00001.1.el9eap, 2.0.15-1.Final_redhat_00001.1.el7eap, 2.0.15-1.Final_redhat_00001.1.ep7.el7
watsonx.data - update to 2.1
eap7-xml-security (Red Hat package) - update to 2.2.3-2.redhat_00001.1.el7eap
eap7-undertow (Red Hat package) - addressed in versions 2.2.28-1.SP1_redhat_00001.1.el7eap, 2.2.28-1.SP1_redhat_00001.1.el8eap, 2.2.28-1.SP1_redhat_00001.1.el9eap
eap7-wss4j (Red Hat package) - update to 2.3.3-2.redhat_00001.1.el7eap
eap7-jandex (Red Hat package) - addressed in versions 2.4.4-1.Final_redhat_00001.1.el7eap, 2.4.4-1.Final_redhat_00001.1.el8eap, 2.4.4-1.Final_redhat_00001.1.el9eap
eap7-xalan-j2 (Red Hat package) - addressed in versions 2.7.1-26.redhat_00015.1.ep7.el7, 2.7.1-38.redhat_00015.1.el7eap
eap7-jackson-databind (Red Hat package) - update to 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7
eap7-apache-sshd (Red Hat package) - addressed in versions 2.9.3-1.redhat_00001.1.el7eap, 2.9.3-1.redhat_00001.1.el8eap, 2.9.3-1.redhat_00001.1.el9eap
eap7-activemq-artemis (Red Hat package) - addressed in versions 2.16.0-17.redhat_00051.1.el7eap, 2.16.0-17.redhat_00051.1.el8eap, 2.16.0-17.redhat_00051.1.el9eap
eap7-weld-core (Red Hat package) - addressed in versions 3.1.10-2.Final_redhat_00001.1.el7eap, 3.1.10-2.Final_redhat_00001.1.el8eap, 3.1.10-2.Final_redhat_00001.1.el9eap
eap7-apache-cxf (Red Hat package) - addressed in versions 3.1.16-3.SP1_redhat_00001.1.ep7.el7, 3.4.10-1.SP1_redhat_00001.1.el7eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.20-1.Final_redhat_00001.1.el7eap, 3.3.20-1.Final_redhat_00001.1.el8eap, 3.3.20-1.Final_redhat_00001.1.el9eap
eap7-jboss-xnio-base (Red Hat package) - addressed in versions 3.5.10-1.Final_redhat_00001.1.ep7.el7, 3.7.13-1.Final_redhat_00001.1.el7eap, 3.8.11-1.SP1_redhat_00001.1.el7eap, 3.8.11-1.SP1_redhat_00001.1.el8eap, 3.8.11-1.SP1_redhat_00001.1.el9eap
eap7-jgroups (Red Hat package) - addressed in versions 4.2.23-1.Final_redhat_00001.1.el7eap, 4.2.23-1.Final_redhat_00001.1.el8eap, 4.2.23-1.Final_redhat_00001.1.el9eap
Cognos Dashboards on Cloud Pak for Data - update to 5.1.1
eap7-hibernate (Red Hat package) - addressed in versions 5.3.32-1.Final_redhat_00001.1.el7eap, 5.3.32-1.Final_redhat_00001.1.el8eap, 5.3.32-1.Final_redhat_00001.1.el9eap
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.9-1.Final_redhat_00001.1.el7eap, 5.4.9-1.Final_redhat_00001.1.el8eap, 5.4.9-1.Final_redhat_00001.1.el9eap
eap7-wildfly (Red Hat package) - addressed in versions 7.1.8-2.GA_redhat_00002.1.ep7.el7, 7.3.11-4.GA_redhat_00002.1.el7eap, 7.4.14-5.GA_redhat_00002.1.el7eap, 7.4.14-5.GA_redhat_00002.1.el8eap, 7.4.14-5.GA_redhat_00002.1.el9eap
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
eap7-infinispan (Red Hat package) - addressed in versions 11.0.18-1.Final_redhat_00001.1.el7eap, 11.0.18-1.Final_redhat_00001.1.el8eap, 11.0.18-1.Final_redhat_00001.1.el9eap
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2
Event Streams - update to 11.2.5
eap7-guava-libraries (Red Hat package) - addressed in versions 32.1.1-2.jre_redhat_00001.1.el7eap, 32.1.1-2.jre_redhat_00001.1.el8eap, 32.1.1-2.jre_redhat_00001.1.el9eap
IBM Observability with Instana - update to 275

• https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds
• https://www.openwall.com/lists/oss-security/2023/09/29/6

• Deserialization of untrusted data in IBM Event Streams
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Red Hat Fuse 7.12
• IBM InfoSphere Information Server update for Apache Avro Java SDK
• Multiple vulnerabilities in Red Hat build of Quarkus 3.2
• Multiple vulnerabilities in Red Hat Build of Apache Camel for Quarkus 3.2
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat build of Quarkus 2.13
• Multiple vulnerabilities in Red Hat Integration Camel Extensions for Quarkus
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in IBM Security Guardium
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• Multiple vulnerabilities in Oracle Business Process Management Suite
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools
• Multiple vulnerabilities in IBM Data Risk Manager
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Jira Software Data Center and Server update for Apache Avro
• Bamboo Data Center and Server update for Apache Avro
• Multiple vulnerabilities in IBM Operations Analytics Predictive Insights
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in Fuse 7.13
• Splunk Enterprise update for third-party components
• openEuler 22.03 LTS SP1 update for avro
• openEuler 20.03 LTS SP4 update for avro
• openEuler 22.03 LTS SP3 update for avro
• openEuler 22.03 LTS SP4 update for avro
• openEuler 24.03 LTS update for avro
• Deserialization of untrusted data in IBM Observability with Instana
• Deserialization of Untrusted Data in Oracle GoldenGate Big Data and Application Adapters
• Multiple vulnerabilities in Stream Analytics
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in IBM Asset Data Dictionary Component
• IBM watsonx.data update for Apache Avro Java SDK
• Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data
• Multiple vulnerabilities in Oracle Banking APIs
• Multiple vulnerabilities in Netcool Operations Insight