PT-2023-8847 · Atlassian+1 · Bamboo Server+4

Adam Korczynski · Publicado 2023-09-29 · Atualizado 2024-08-02 · CVE-2023-39410

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Avro Java SDK versions up to and including 1.11.2 Confluence Data Center versions from 7.17.0 to 8.7.1 Confluence Data Center versions from 8.7.0 to 8.7.1 Confluence Server versions from 7.17.0 to 8.5.4 LTS Bamboo Data Center and Server versions 9.2.1, 9.3.0, and 9.4.0

Description When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK. An unauthenticated attacker can expose assets in the environment susceptible to exploitation, with no impact to confidentiality, no impact to integrity, high impact to availability, and requires no user interaction.

Recommendations For Apache Avro Java SDK versions up to and including 1.11.2, update to apache-avro version 1.11.3. For Confluence Data Center versions from 7.17.0 to 8.7.1, upgrade to the latest version, or to one of the specified supported fixed versions: 8.8.0, 8.7.2, 8.6.2, 8.5.4 LTS, 8.5.5 LTS, 8.5.6 LTS, 7.19.17 LTS, 7.19.18 LTS, 7.19.19 LTS. For Confluence Server versions from 7.17.0 to 8.5.4 LTS, upgrade to the latest 8.5.x LTS version, or to one of the specified supported fixed versions: 8.5.5 LTS, 8.5.6 LTS, 7.19.17 LTS, 7.19.18 LTS, 7.19.19 LTS. For Bamboo Data Center and Server versions 9.2.1, 9.3.0, and 9.4.0, upgrade to the latest version, or to one of the specified supported fixed versions: 9.2.8, 9.3.6, 9.4.2.

Correção

DoS

Deserialization of Untrusted Data

RCE

Enumeração de Fraquezas

CWE-502

CWE-20

Identificadores relacionados

BDU:2024-02310

CVE-2023-39410

GHSA-RHRV-645H-FJFH

OESA-2024-1809

OESA-2024-1915

OESA-2024-1916

OESA-2024-1917

OESA-2024-1918

PYSEC-2023-188

RHSA-2023:7637

RHSA-2023:7638

RHSA-2023:7639

RHSA-2024:10207

RHSA-2024:10208

Produtos afetados

Apache Avro Java Sdk

Bamboo

Bamboo Server

Confluence

Jira

Referências · 34

• https://github.com/apache/avro · Nota
• https://github.com/apache/avro/commit/a12a7e44ddbe060c3dc731863cad5c15f9267828 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2023-188.yaml · Nota
• https://osv.dev/vulnerability/OESA-2024-1809 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2023-39410 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-39410 · Nota de Segurança
• https://security.netapp.com/advisory/ntap-20240621-0006 · Nota
• https://lists.apache.org/thread/q142wj99cwdd0jo5lvdoxzoymlqyjdds · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1707825685488718312 · Publicação no Twitter
• https://twitter.com/oss_security/status/1707811538382499976 · Publicação no Twitter
• http://openwall.com/lists/oss-security/2023/09/29/6 · Nota
• https://openeuler.org/en/security/security-bulletins/detail?id=openEuler-SA-2024-1915 · Nota
• https://issues.apache.org/jira/browse/AVRO-3819 · Nota
• https://openeuler.org/en/security/security-bulletins/detail?id=openEuler-SA-2024-1916 · Nota
• https://jira.atlassian.com/browse/CONFSERVER-94108 · Nota