Out-of-bounds write in jackson-dataformats-text - CVE-2023-3894
Published: January 12, 2024
Vulnerability identifier: #VU85324
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-3894
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability occurs when parser is running on user supplied input. A remote attacker can supply content that causes the parser to crash by StackOverflow causing a denial of service.
Affected software
jackson-dataformats-text
IBM Cloud Pak for Multicloud Management
IBM Cloud Pak System
Content Manager Enterprise Edition
IBM Cloud Pak for Multicloud Management
IBM Cloud Pak System
Content Manager Enterprise Edition
How to mitigate CVE-2023-3894
Install updates from vendor's website.
jackson-dataformats-text - update to 2.15.0
IBM Cloud Pak for Multicloud Management - update to 2.3.8
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
Content Manager Enterprise Edition - update to 8.7.0.2
IBM Cloud Pak for Multicloud Management - update to 2.3.8
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
Content Manager Enterprise Edition - update to 8.7.0.2