Skip to content
Fencer Intel
high 7.5

CVE-2023-39410 json

Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

published 3y ago modified 2mo ago also GHSA-rhrv-645h-fjfh , PYSEC-2023-188 , EUVD-2023-0049

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.

Patch / fix

  • maven org.apache.avro:avro 1.11.3
  • pypi avro 1.11.3
  • Apache Software Foundation Apache Avro Java SDK 1.11.3
  • apache avro 1.11.3
  • eap7-avro jboss enterprise application platform 7.4 1.11.3-1.redhat_00001.1.el7eap
  • eap7-guava jboss enterprise application platform 7.4 32.1.1-2.jre_redhat_00001.1.el7eap
  • eap7-jandex jboss enterprise application platform 7.4 2.4.4-1.Final_redhat_00001.1.el7eap
  • eap7-yasson jboss enterprise application platform 7.4 1.0.11-4.redhat_00002.1.el7eap
  • eap7-jgroups jboss enterprise application platform 7.4 4.2.23-1.Final_redhat_00001.1.el7eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.14-5.GA_redhat_00002.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.28-1.SP1_redhat_00001.1.el7eap
  • eap7-weld-ejb jboss enterprise application platform 7.4 3.1.10-2.Final_redhat_00001.1.el7eap

red hat advisories RHSA-2024:10208RHSA-2024:10207RHSA-2023:7637RHSA-2023:7638RHSA-2023:7639

Is CVE-2023-39410 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-39410 updated cvss 7.5

apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

  • Red Hat build of Apache Camel for Spring Boot 3 avro
    affected: no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 2 avro
    affected: no fix available
  • Red Hat build of Debezium 2 avro
    affected: no fix planned “Will not fix”
  • Red Hat Integration Camel Quarkus 2 avro
    affected: no fix available
  • Red Hat JBoss Data Grid 7 avro Red Hat JBoss Data Virtualization 6 avro Red Hat JBoss Enterprise Application Platform 6 keycloak-adapter-sso7_5-eap6 keycloak-adapter-sso7_5-eap6 Red Hat JBoss Fuse Service Works 6 avro
    affected: no fix planned “Out of support scope”
  • Red Hat Single Sign-On 7 avro
    affected: no fix available
  • Red Hat streams for Apache Kafka avro
    affected: no fix planned “Out of support scope”
  • Red Hat build of Apache Camel 4 for Quarkus 3
    fixed: vendor fix RHSA-2023:7617
show 11 more
  • Red Hat build of Quarkus 2.13.9
    fixed: vendor fix RHSA-2023:7700
  • Red Hat build of Quarkus 3.2.9.Final avro 1.11.3.redhat-00002
    fixed: vendor fix RHSA-2023:7612
  • Red Hat Fuse 7.12.1
    fixed: vendor fix RHSA-2023:7247
  • Red Hat Fuse 7.13.0
    fixed: vendor fix RHSA-2024:3354
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-avro 1.11.3-1.redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2023:7637
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-avro 1.11.3-1.redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2023:7638
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-avro 1.11.3-1.redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2023:7639
  • Red Hat JBoss Enterprise Application Platform avro 1.11.3.redhat-00001
    fixed: vendor fix RHSA-2023:7641
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-avro 1.7.6-2.redhat_00003.1.ep7.el7, eap7-xalan-j2 2.7.1-26.redhat_00015.1.ep7.el7, eap7-wildfly 7.1.8-2.GA_redhat_00002.1.ep7.el7, eap7-h2database 1.4.197-2.redhat_00005.1.ep7.el7, eap7-bouncycastle 1.68.0-1.redhat_00005.1.ep7.el7, eap7-apache-cxf 3.1.16-3.SP1_redhat_00001.1.ep7.el7, +11 more
    fixed: vendor fix RHSA-2024:10208
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-avro 1.7.6-8.redhat_00003.1.el7eap, eap7-wss4j 2.3.3-2.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-38.redhat_00015.1.el7eap, eap7-wildfly 7.3.11-4.GA_redhat_00002.1.el7eap, eap7-h2database 1.4.197-3.redhat_00004.1.el7eap, eap7-wss4j-policy 2.3.3-2.redhat_00001.1.el7eap, +41 more
    fixed: vendor fix RHSA-2024:10207
  • Red Hat A-MQ Clients 2 avro Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat build of Quarkus 3.2.9.Final jna 5.8.0, lit 2.7.4, bson 4.9.1, db2 1.18.3, h2 2.2.220, jdom 1.1.3, +1040 more Red Hat Data Grid 8 avro Red Hat Enterprise Linux 8 log4j, log4j-jcl, log4j-web, log4j-slf4j Red Hat Enterprise Linux 9 log4j, log4j-jcl, log4j-slf4j
    +7 more products
    Red Hat Integration Camel K 1 avro Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-yasson 1.0.11-4.redhat_00002.1.el7eap, eap7-guava 32.1.1-2.jre_redhat_00001.1.el7eap, eap7-apache-sshd 2.9.3-1.redhat_00001.1.el7eap, eap7-wildfly 7.4.14-5.GA_redhat_00002.1.el7eap, eap7-jandex 2.4.4-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.2.28-1.SP1_redhat_00001.1.el7eap, +54 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-yasson 1.0.11-4.redhat_00002.1.el8eap, eap7-guava 32.1.1-2.jre_redhat_00001.1.el8eap, eap7-apache-sshd 2.9.3-1.redhat_00001.1.el8eap, eap7-wildfly 7.4.14-5.GA_redhat_00002.1.el8eap, eap7-jandex 2.4.4-1.Final_redhat_00001.1.el8eap, eap7-undertow 2.2.28-1.SP1_redhat_00001.1.el8eap, +55 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-yasson 1.0.11-4.redhat_00002.1.el9eap, eap7-guava 32.1.1-2.jre_redhat_00001.1.el9eap, eap7-apache-sshd 2.9.3-1.redhat_00001.1.el9eap, eap7-wildfly 7.4.14-5.GA_redhat_00002.1.el9eap, eap7-jandex 2.4.4-1.Final_redhat_00001.1.el9eap, eap7-undertow 2.2.28-1.SP1_redhat_00001.1.el9eap, +53 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1555 more Red Hat JBoss Enterprise Application Platform 8 avro Red Hat JBoss Enterprise Application Platform Expansion Pack avro
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2y ago

Exploit prediction

2.93% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-15).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.avro:avro
<1.11.3
1.11.3
pypi avro
<1.11.3
1.11.3

Affected products

  • Apache Software Foundation Apache Avro Java SDK
  • apache avro

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.