Spring-Kafka has Java Deserialization vulnerability When Improperly Configured

🗓️ 24 Aug 2023 15:31:10Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 71 Views

Spring-Kafka Deserialization Vulnerability in Apache Kafk

Reporter	Title	Published	Views	Family All 20
GithubExploit	Exploit for Deserialization of Untrusted Data in Vmware Spring_For_Apache_Kafka	28 Sep 202311:18	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Vmware Spring_For_Apache_Kafka	24 Apr 202403:54	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	30 Jan 202404:12	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.11 addresses multiple security vulnerabilities.	20 Dec 202316:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	17 Oct 202400:20	–	ibm
IBM Security Bulletins	Security Bulletin: VMware Tanzu Spring for Apache Kafka is vulnerable to CVE-2023-34040 used in IBM Maximo Application Suite - Monitor Component	26 Sep 202318:33	–	ibm
Circl	CVE-2023-34040	24 Aug 202316:14	–	circl
CNNVD	Spring Framework 代码问题漏洞	24 Aug 202300:00	–	cnnvd
CVE	CVE-2023-34040	24 Aug 202312:59	–	cve
Cvelist	CVE-2023-34040 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured	24 Aug 202312:59	–	cvelist

Vulners

Node

org.springframework.kafka spring-kafkaRange2.8.1–2.9.11maven

OR

org.springframework.kafka spring-kafkaRange3.0.0–3.0.10maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-34040
spring	www.spring.io/security/cve-2023-34040
github	www.github.com/spring-projects/spring-kafka/commit/25ac793a78725e2ca4a3a2888a1506a4bfcf0c9d
github	www.github.com/spring-projects/spring-kafka/commit/eb779679812f61a8553ced3d0e4069dca65560ed
github	www.github.com/advisories/GHSA-crqf-q9fp-hwjw

05 Nov 2024 17:40Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.3 - 7.8

EPSS0.21413

SSVC

spring-kafka deserialization vulnerability apache kafka configuration attack vector errorhandlingdeserializer container properties untrusted sources