CVE-2023-39410: Apache Avro Java SDK Memory Consumption Vulnerability
Summary
CVE-2023-39410: When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. Affects avro versions < 1.11.3. Fixed in 1.11.3. How to fix ↓
Also tracked for
- org.apache.avro:avro · Maven
The same CVE-2023-39410 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Avro is a data serialization system that provides rich data structures and a compact binary format. It is commonly used in Java applications for efficient data exchange. However, versions up to and including 1.11.2 of the Apache Avro Java SDK are vulnerable to a memory consumption issue when deserializing untrusted or corrupted data. This vulnerability can allow a malicious actor to consume excessive memory, potentially leading to an out-of-memory condition on the system.
Vulnerability Detail
The vulnerability arises from the improper handling of deserialized data. When untrusted or corrupted data is deserialized, a reader can consume memory beyond the allowed constraints. This can result in the system running out of memory, causing performance degradation or even a denial-of-service condition. The vulnerability affects Java applications utilizing Apache Avro Java SDK versions up to and including 1.11.2.
How To Fix
Minimum fixed version
1.11.3
This is the first release that contains the fix.
pip install --upgrade "avro==1.11.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Apache Avro Java SDK versions up to and including 1.11.2 are vulnerable to a memory consumption issue when deserializing untrusted or corrupted data. This can lead to out-of-memory conditions and potential denial-of-service. Users should update to Apache Avro Java SDK version 1.11.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for avro →
FAQ
Apache Avro is a data serialization system that provides rich data structures and a compact binary format. It is commonly used in Java applications for efficient data exchange.
Versions up to and including 1.11.2 of the Apache Avro Java SDK are affected by this vulnerability.
The vulnerability can lead to excessive memory consumption, potentially causing an out-of-memory condition on the system. This can result in performance degradation or denial-of-service.
To fix this vulnerability, update your Apache Avro Java SDK to version 1.11.3 or later.
No specific workaround is mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for avro.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
