GHSA-5R8J-QMCM-7G7Q Apache UIMA Java SDK Deserialization of Untrusted Data, Improper Input Validation vulnerability

🗓️ 08 Nov 2023 09:30:25Reported by GoogleType

osv

osv🔗 osv.dev👁 25 Views

Apache UIMA Java SDK Deserialization, Input Validation Vulnerability, Upgrade to version 3.5.

Reporter	Title	Published	Views	Family All 18
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Apache UIMA Java SDK arbitrary code execution vulnerability ( CVE-2023-39913)	5 Feb 202420:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Datacap	16 Jul 202614:58	–	ibm
IBM Security Bulletins	Security Bulletin: Apache uimaj-core.jar security vulnerability CVE-2022-32287 and CVE-2023-39913 in FileNet Content Manager (FNCM) component Content Search Services (CSS) / Enterprise Content Management Text Search (ECMTS)	17 Dec 202516:41	–	ibm
CNNVD	Apache UIMA 代码问题漏洞	8 Nov 202300:00	–	cnnvd
CNVD	Apache UIMA Deserialization Vulnerability	13 Nov 202300:00	–	cnvd
CVE	CVE-2023-39913	8 Nov 202308:04	–	cve
Cvelist	CVE-2023-39913 Apache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formats	8 Nov 202308:04	–	cvelist
EUVD	EUVD-2023-2891	3 Oct 202520:07	–	euvd
Github Security Blog	Apache UIMA Java SDK Deserialization of Untrusted Data, Improper Input Validation vulnerability	8 Nov 202309:30	–	github
NVD	CVE-2023-39913	8 Nov 202308:15	–	nvd

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-39913
github	www.github.com/apache/uima-uimaj
github	www.github.com/apache/uima-uimaj/releases/tag/rel%2Fuimaj-3.5.0
lists	www.lists.apache.org/thread/lw30f4qlq3mhkhpljj16qw4fot3rg7v4
openwall	www.openwall.com/lists/oss-security/2023/11/08/1

13 Feb 2025 19:36Current

8.6High risk

Vulners AI Score8.6

CVSS 3.18.8

EPSS0.01471