7.5

CVE-2023-39410

EPSS 0.06%
Veröffentlicht 29.09.2023 17:15:46
Zuletzt bearbeitet 13.02.2025 17:16:52
Quelle security@apache.org
CVE-Watchlists
Login
Unerledigt
Login

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2.  Users should update to apache-avro version 1.11.3 which addresses this issue.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Avro SwPlatform- Version < 1.11.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.06%	0.189

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://security.netapp.com/advisory/ntap-20240621-0006/

https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds

Vendor Advisory

Mailing List

https://www.openwall.com/lists/oss-security/2023/09/29/6

Third Party Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2023-39410

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-39410

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-39410

EUVD