Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to arbitrary code execution due to redisson-3.17.7 (CVE-2023-42809)

Summary redisson is used by DataStage on Cloud Pak for Data as part of the Redis Java client. Vulnerability Details CVEID:CVE-2023-42809 DESCRIPTION: Redisson could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By persuading a victim to...

Security Bulletin: IBM Cloud Pak for Network Automation 2.7.6 addresses multiple security vulnerabilities

Summary IBM Cloud Pak for Network Automation 2.7.6 addresses multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-42809 DESCRIPTION: Redisson could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization fla...

CVE-2023-42809

Deserialization of untrusted data vulnerability was found in Redisson, as some messages received from the Redis server contain Java objects that the client deserializes without further validation. This flaw allows attackers who manage to trick clients into communicating with a malicious server to...

org.redisson:redisson-spring-boot-starter (2.13.2), org.redisson:redisson-spring-data (2.13.2) +9 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.13.2)

org.redisson:redisson MAVEN version 2.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - org.redisson:redisson-spring-boot-starter 2.13.2 - org.redisson:redisson-spring-data 2.13.2 -...

org.redisson:redisson-spring-boot-starter (2.13.1), org.redisson:redisson-spring-data (2.13.1) +9 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.13.1)

org.redisson:redisson MAVEN version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - org.redisson:redisson-spring-boot-starter 2.13.1 - org.redisson:redisson-spring-data 2.13.1 -...

com.geccocrawler:gecco-redis (1.1.3), com.github.sadstool:redisson-aspect-lock (0.1.1) potentially affected by CVE-2023-42809 via org.redisson:redisson (2.2.16)

org.redisson:redisson MAVEN version 2.2.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - com.geccocrawler:gecco-redis 1.1.3 - com.github.sadstool:redisson-aspect-lock 0.1.1 Source cves: CVE-2023-42809 Sour...

cn.guomw.cloud:framework-cloud-starter-auth (>=1.0.0.release, <=1.1.0.1.btxc.release), cn.guomw.cloud:framework-cloud-starter-dlock (>=1.0.0.release, <=1.1.0.1.btxc.release) +5 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.10.0)

org.redisson:redisson MAVEN version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - cn.guomw.cloud:framework-cloud-starter-auth =1.0.0.release, =1.0.0.release, =1.0.0.release, =1.1.0.release -...

org.redisson:redisson-tomcat (2.12.4), org.redisson:redisson-tomcat-6 (2.12.4) +2 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.12.4)

org.redisson:redisson MAVEN version 2.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - org.redisson:redisson-tomcat 2.12.4 - org.redisson:redisson-tomcat-6 2.12.4 - org.redisson:redisson-tomcat-7 2.12.4 ...

org.redisson:redisson-spring-boot-starter (2.14.1), org.redisson:redisson-spring-data (2.14.1) +9 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.14.1)

org.redisson:redisson MAVEN version 2.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - org.redisson:redisson-spring-boot-starter 2.14.1 - org.redisson:redisson-spring-data 2.14.1 -...

com.yy:java-server-push-sdk (1.0.1), org.opencb.opencga:opencga-analysis (>=2.0.0-snaphost, <=4.0.0) +11 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.2.0)

org.redisson:redisson MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - com.yy:java-server-push-sdk 1.0.1 - org.opencb.opencga:opencga-analysis =2.0.0-snaphost, =3.2.0, =2.12.7,...

com.github.mrniko:redis-jcache (>=1.0.0, <=1.0.1), org.redisson:redisson-tomcat (2.7.1) +3 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.7.1)

org.redisson:redisson MAVEN version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - com.github.mrniko:redis-jcache =1.0.0, =1.0.1 - org.redisson:redisson-tomcat 2.7.1 - org.redisson:redisson-tomcat-6...

com.corundumstudio.socketio:netty-socketio (1.7.11) potentially affected by CVE-2023-42809 via org.redisson:redisson (2.2.17)

org.redisson:redisson MAVEN version 2.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - com.corundumstudio.socketio:netty-socketio 1.7.11 Source cves: CVE-2023-42809 Source advisory: OSV:GHSA-4HVC-QWR2-F8...

com.corundumstudio.socketio:netty-socketio (>=1.6.4, <=1.6.6) potentially affected by CVE-2023-42809 via org.redisson:redisson (1.0.2)

org.redisson:redisson MAVEN version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - com.corundumstudio.socketio:netty-socketio =1.6.4, =1.6.6 Source cves: CVE-2023-42809 Source advisory:...

org.redisson:redisson-tomcat (2.10.7), org.redisson:redisson-tomcat-6 (2.10.7) +2 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.10.7)

org.redisson:redisson MAVEN version 2.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - org.redisson:redisson-tomcat 2.10.7 - org.redisson:redisson-tomcat-6 2.10.7 - org.redisson:redisson-tomcat-7 2.10.7 ...

ai.grakn:grakn-dist (0.16.0), ai.grakn:grakn-engine (0.16.0) +1663 more potentially affected by CVE-2023-42809 via org.redisson:redisson (>=3.1.0, <=3.21.3)

org.redisson:redisson MAVEN version =3.1.0, =0.1.0, =1.0, =1.2.1, =0.2.0, =1.0.0, =2.2.13.release, =1.3.0, =1.0.0, =1.0.0, =2.0.0 - cn.anguslean:delay-quene4j 1.0.0 and more Source cves: CVE-2023-42809 Source advisory: GHSA-4HVC-QWR2-F8RV...

com.yy:java-server-push-sdk (1.0.0) potentially affected by CVE-2023-42809 via org.redisson:redisson (2.1.4)

org.redisson:redisson MAVEN version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - com.yy:java-server-push-sdk 1.0.0 Source cves: CVE-2023-42809 Source advisory: OSV:GHSA-4HVC-QWR2-F8RV...

org.redisson:redisson-tomcat (2.12.3), org.redisson:redisson-tomcat-6 (2.12.3) +2 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.12.3)

org.redisson:redisson MAVEN version 2.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - org.redisson:redisson-tomcat 2.12.3 - org.redisson:redisson-tomcat-6 2.12.3 - org.redisson:redisson-tomcat-7 2.12.3 ...

org.redisson:redisson-tomcat (2.9.2), org.redisson:redisson-tomcat-6 (2.9.2) +2 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.9.2)

org.redisson:redisson MAVEN version 2.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - org.redisson:redisson-tomcat 2.9.2 - org.redisson:redisson-tomcat-6 2.9.2 - org.redisson:redisson-tomcat-7 2.9.2 -...

org.redisson:redisson-tomcat (2.7.2), org.redisson:redisson-tomcat-6 (2.7.2) +2 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.7.2)

org.redisson:redisson MAVEN version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - org.redisson:redisson-tomcat 2.7.2 - org.redisson:redisson-tomcat-6 2.7.2 - org.redisson:redisson-tomcat-7 2.7.2 -...

org.redisson:redisson-tomcat (2.7.0), org.redisson:redisson-tomcat-6 (2.7.0) +2 more potentially affected by CVE-2023-42809 via org.redisson:redisson (2.7.0)

org.redisson:redisson MAVEN version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.redisson:redisson and may be impacted: - org.redisson:redisson-tomcat 2.7.0 - org.redisson:redisson-tomcat-6 2.7.0 - org.redisson:redisson-tomcat-7 2.7.0 -...