GHSA-CRQF-Q9FP-HWJW Spring-Kafka has Java Deserialization vulnerability When Improperly Configured

🗓️ 24 Aug 2023 15:31:10Reported by GoogleType

osv🔗 osv.dev👁 9 Views

Spring for Apache Kafka deserialization flaw enables header attack when checkDeserEx properties are true and no error handler.

Reporter	Title	Published	Views	Family All 22
GithubExploit	Exploit for Deserialization of Untrusted Data in Vmware Spring_For_Apache_Kafka	28 Sep 202311:18	–	githubexploit
GithubExploit	Exploit for Deserialization of Untrusted Data in Vmware Spring_For_Apache_Kafka	24 Apr 202403:54	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities	30 Jan 202404:12	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.11 addresses multiple security vulnerabilities.	20 Dec 202316:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities	17 Oct 202400:20	–	ibm
IBM Security Bulletins	Security Bulletin: VMware Tanzu Spring for Apache Kafka is vulnerable to CVE-2023-34040 used in IBM Maximo Application Suite - Monitor Component	26 Sep 202318:33	–	ibm
BDU FSTEC	The vulnerability of the Spring-based Apache Kafka software platform (spring-kafka) is related to deficiencies in the deserialization mechanism. This allows attackers to execute arbitrary code or trigger service failures.	7 Sep 202300:00	–	bdu_fstec
Circl	CVE-2023-34040	24 Aug 202316:14	–	circl
CNNVD	Spring Framework 代码问题漏洞	24 Aug 202300:00	–	cnnvd
CVE	CVE-2023-34040	24 Aug 202312:59	–	cve

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-34040
github	www.github.com/spring-projects/spring-kafka/commit/25ac793a78725e2ca4a3a2888a1506a4bfcf0c9d
github	www.github.com/spring-projects/spring-kafka/commit/eb779679812f61a8553ced3d0e4069dca65560ed
github	www.github.com/spring-projects/spring-kafka
spring	www.spring.io/security/cve-2023-34040

05 Nov 2024 18:06Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.8

EPSS0.0209