Deserialization Of Untrusted Data

🗓️ 09 Nov 2023 05:14:09Reported by Veracode Vulnerability DatabaseType

Vulnerability in deserialization of untrusted data in uimaj-tools

Reporter	Title	Published	Views	Family All 17
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Apache UIMA Java SDK arbitrary code execution vulnerability ( CVE-2023-39913)	5 Feb 202420:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Datacap	12 Jan 202617:46	–	ibm
IBM Security Bulletins	Security Bulletin: Apache uimaj-core.jar security vulnerability CVE-2022-32287 and CVE-2023-39913 in FileNet Content Manager (FNCM) component Content Search Services (CSS) / Enterprise Content Management Text Search (ECMTS)	17 Dec 202516:41	–	ibm
CNNVD	Apache UIMA 代码问题漏洞	8 Nov 202300:00	–	cnnvd
CNVD	Apache UIMA Deserialization Vulnerability	13 Nov 202300:00	–	cnvd
CVE	CVE-2023-39913	8 Nov 202308:04	–	cve
Cvelist	CVE-2023-39913 Apache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formats	8 Nov 202308:04	–	cvelist
EUVD	EUVD-2023-2891	3 Oct 202520:07	–	euvd
Github Security Blog	Apache UIMA Java SDK Deserialization of Untrusted Data, Improper Input Validation vulnerability	8 Nov 202309:30	–	github
NVD	CVE-2023-39913	8 Nov 202308:15	–	nvd

Vulners

Node

apache uimaj-toolsRange2.3.1–3.4.1java

Source	Link
github	www.github.com/apache/uima-uimaj/commit/6a8ab16a604401c9e8ec5c5c94e94515371d324b
lists	www.lists.apache.org/thread/lw30f4qlq3mhkhpljj16qw4fot3rg7v4
github	www.github.com/advisories/GHSA-5r8j-qmcm-7g7q
openwall	www.openwall.com/lists/oss-security/2023/11/08/1
openwall	www.openwall.com/lists/oss-security/2023/11/08/1

13 Feb 2025 19:33Current

8.1High risk

Vulners AI Score8.1

CVSS 3.18.8

EPSS0.00415

SSVC