Bug 2242521 (CVE-2023-39410) - CVE-2023-39410 apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK
Summary: CVE-2023-39410 apache-avro: Apache Avro Java SDK: Memory when deserializing u...
Keywords:
Status: NEW
Alias: CVE-2023-39410
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2242520
TreeView+ depends on / blocked
 
Reported: 2023-10-06 17:32 UTC by Patrick Del Bello
Modified: 2024-05-03 18:49 UTC (History)
73 users (show)

Fixed In Version: apache-avro 1.11.3
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in apache-avro. When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints, leading to an out-of-memory error and a denial of service on the system.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:7247 0 None None None 2023-11-15 17:08:06 UTC
Red Hat Product Errata RHSA-2023:7612 0 None None None 2023-11-30 11:37:01 UTC
Red Hat Product Errata RHSA-2023:7617 0 None None None 2023-11-30 15:00:45 UTC
Red Hat Product Errata RHSA-2023:7637 0 None None None 2023-12-04 17:57:34 UTC
Red Hat Product Errata RHSA-2023:7638 0 None None None 2023-12-04 17:59:18 UTC
Red Hat Product Errata RHSA-2023:7639 0 None None None 2023-12-04 17:56:48 UTC
Red Hat Product Errata RHSA-2023:7641 0 None None None 2023-12-04 18:02:28 UTC
Red Hat Product Errata RHSA-2023:7700 0 None None None 2023-12-07 14:26:54 UTC
Red Hat Product Errata RHSA-2023:7705 0 None None None 2023-12-07 15:32:53 UTC

Description Patrick Del Bello 2023-10-06 17:32:54 UTC 
When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.

https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds
https://www.openwall.com/lists/oss-security/2023/09/29/6
Comment 7 errata-xmlrpc 2023-11-15 17:08:02 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.12.1

Via RHSA-2023:7247 https://access.redhat.com/errata/RHSA-2023:7247
Comment 9 errata-xmlrpc 2023-11-30 11:36:58 UTC 
This issue has been addressed in the following products:

  Red Hat build of Quarkus 3.2.9

Via RHSA-2023:7612 https://access.redhat.com/errata/RHSA-2023:7612
Comment 10 errata-xmlrpc 2023-11-30 15:00:41 UTC 
This issue has been addressed in the following products:

  Red Hat Integration

Via RHSA-2023:7617 https://access.redhat.com/errata/RHSA-2023:7617
Comment 11 errata-xmlrpc 2023-12-04 17:56:45 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2023:7639 https://access.redhat.com/errata/RHSA-2023:7639
Comment 12 errata-xmlrpc 2023-12-04 17:57:29 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2023:7637 https://access.redhat.com/errata/RHSA-2023:7637
Comment 13 errata-xmlrpc 2023-12-04 17:59:15 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2023:7638 https://access.redhat.com/errata/RHSA-2023:7638
Comment 14 errata-xmlrpc 2023-12-04 18:02:24 UTC 
This issue has been addressed in the following products:

  EAP 7.4.14

Via RHSA-2023:7641 https://access.redhat.com/errata/RHSA-2023:7641
Comment 15 errata-xmlrpc 2023-12-07 14:26:51 UTC 
This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.13.9

Via RHSA-2023:7700 https://access.redhat.com/errata/RHSA-2023:7700
Comment 16 errata-xmlrpc 2023-12-07 15:32:49 UTC 
This issue has been addressed in the following products:

  Red Hat Integration

Via RHSA-2023:7705 https://access.redhat.com/errata/RHSA-2023:7705
Note You need to log in before you can comment on or make changes to this bug.