CVE-2023-34040

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-34040
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34040.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-34040
Aliases
Published
2023-08-24T12:59:20.620Z
Modified
2026-07-15T01:49:17.672442462Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Java Deserialization vulnerability in Spring-Kafka When Improperly Configured
Details

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.

Specifically, an application is vulnerable when all of the following are true:

  • The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record
  • The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true.
  • The user allows untrusted sources to publish to a Kafka topic

By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.8.x"
                },
                {
                    "fixed": "2.9.11"
                },
                {
                    "introduced": "2.9.x"
                },
                {
                    "fixed": "2.9.11"
                },
                {
                    "introduced": "3.0.x"
                },
                {
                    "fixed": "3.0.10"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-502"
    ],
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34040.json"
}
References

Affected packages

Git / github.com/spring-projects/spring-kafka

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-kafka
Events
Introduced
06c9b4228977f47ff66c42f492d68c5bf79849b3
Last affected
453c219d9aa93a1ca9c2c63c46bf1d3aa08ac621
Introduced
e02bffe065a2870077ea6bd19ef89c55345eaa36
Last affected
e52db82478d221c17365a38acfaec2be5d509277
Database specific 
{
    "cpe": "cpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.8.1"
        },
        {
            "last_affected": "2.9.10"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.9"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v2.*
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.9.0
v2.9.0-M1
v2.9.0-RC1
v2.9.1
v2.9.10
v2.9.2
v2.9.3
v2.9.4
v2.9.5
v2.9.6
v2.9.7
v2.9.8
v2.9.9
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-34040.json"