GHSA-rhrv-645h-fjfh

Source

https://github.com/advisories/GHSA-rhrv-645h-fjfh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-rhrv-645h-fjfh/GHSA-rhrv-645h-fjfh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rhrv-645h-fjfh

Aliases

CVE-2023-39410
PYSEC-2023-188

Related

CGA-8q34-h6rx-rrwj

Published

2023-09-29T18:30:22Z

Modified

2024-06-25T02:34:10.322533Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Apache Avro Java SDK vulnerable to Improper Input Validation

Details

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.

Database specific

{
    "nvd_published_at": "2023-09-29T17:15:46Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-502"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-29T22:06:14Z"
}

References

Affected packages

Maven / org.apache.avro:avro

Package

Name: org.apache.avro:avro; View open source insights on deps.dev
Purl: pkg:maven/org.apache.avro/avro

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.3

Affected versions

1.*

1.4.0

1.4.1

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.6.0

1.6.1

1.6.2

1.6.3

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.8.0

1.8.1

1.8.2

1.9.0

1.9.1

1.9.2

1.10.0

1.10.1

1.10.2

1.11.0

1.11.1

1.11.2

PyPI / avro