Skip to content
OpenAdvisories
High · 7.5 CVE-2023-39410 EUVD-2023-0049GHSA-rhrv-645h-fjfhPYSEC-2023-188

Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK

Published Sep 29, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Avro Java SDK Package: avro Package: celeborn-0.6 Package: druid Package: org.apache.avro:avro Package: tez Package: wavefront-proxy Ecosystem: Maven Ecosystem: PyPI Ecosystem: Wolfi

Description

When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Avro Java SDK < 1.11.3 1.11.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-apache-cxf +3 3.1.16-3.SP1_redhat_00001.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-avro 1.7.6-2.redhat_00003.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-bouncycastle +3 1.68.0-1.redhat_00005.1.ep7.el7 RHSA-2024:10208
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-h2database 1.4.197-2.redhat_00005.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind 2.8.11.6-1.SP1_redhat_00001.1.ep7.el7 RHSA-2024:10208
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-annotations-api_1.3_spec 2.0.1-4.Final_redhat_00001.1.el7eap RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-marshalling +1 2.0.15-1.Final_redhat_00001.1.el7eap RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-server-migration +21 1.7.2-12.Final_redhat_00013.1.el7eap RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-xnio-base 3.5.10-1.Final_redhat_00001.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-log4j-jboss-logmanager 1.2.2-2.Final_redhat_00002.1.el7eap RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.8-2.GA_redhat_00002.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-javadocs +2 7.3.11-4.GA_redhat_00002.1.el7eap RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wss4j +6 2.3.3-2.redhat_00001.1.el7eap RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-xalan-j2 2.7.1-26.redhat_00015.1.ep7.el7 RHSA-2024:10208, RHSA-2024:10207
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-xml-security 2.2.3-2.redhat_00001.1.el7eap RHSA-2024:10207
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.16.0-17.redhat_00051.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-apache-sshd 2.9.3-1.redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-avro 1.11.3-1.redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-guava +1 32.1.1-2.jre_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-hal-console 3.3.20-1.Final_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.32-1.Final_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-infinispan +9 11.0.18-1.Final_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-jandex 2.4.4-1.Final_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-jboss-jsp-api_2.3_spec 2.0.1-1.Final_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-jboss-marshalling +1 2.0.14-1.SP1_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-33.Final_redhat_00032.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.8.11-1.SP1_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-jbossws-cxf 5.4.9-1.Final_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-jgroups 4.2.23-1.Final_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-undertow 2.2.28-1.SP1_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-weld-ejb +6 3.1.10-2.Final_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.14-5.GA_redhat_00002.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.14-5.GA_redhat_00002.1.el8eap RHSA-2023:7639, RHSA-2023:7638
Red Hat JBoss EAP 7 eap7-wildfly-transaction-client 1.1.16-1.Final_redhat_00001.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637
Red Hat JBoss EAP 7 eap7-yasson 1.0.11-4.redhat_00002.1.el7eap RHSA-2023:7639, RHSA-2023:7638, RHSA-2023:7637

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling celeborn-0.6 0.6.3-r7 —
Wolfi rolling druid 34.0.0-r6 —
Wolfi rolling tez 0.10.4-r8 —
Wolfi rolling wavefront-proxy 13.3-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.avro:avro < 1.11.3 1.11.3 GHSA-rhrv-645h-fjfh
PyPI avro < 1.11.3 1.11.3 PYSEC-2023-188

Advisories 18

References