PT-2021-23359 · Apache · Apache Db Ddlutils

Bryan Pendleton · Published 2021-09-30 · Updated 2021-10-07 · CVE-2021-41616

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache DB DdlUtils version 1.0

Description The BinaryObjectsHelper class in Apache DB DdlUtils was insecure and used ObjectInputStream.readObject without validating the input data, making it unsafe to deserialize. This class was intended for migrating database data with SQL binary types between databases. The DdlUtils project is no longer actively developed. Changes have been made to address the insecurity, including removing the BinaryObjectsHelper class and the ddlutils-1.0 release from distribution.

Recommendations For Apache DB DdlUtils version 1.0, the following changes have been made to address the issue:

1. The BinaryObjectsHelper.java file has been deleted from the DdlUtils source repository.
2. The ddlutils-1.0 release has been removed from the Apache Release Distribution Infrastructure.
3. The DdlUtils website has been updated to indicate that DdlUtils is now available only as source code, not as a packaged release. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-41616

GHSA-9378-F4V7-JGM4

Affected Products

Apache Db Ddlutils

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-41616 · Security Note
• https://lists.apache.org/thread.html/r3d7a8303a820144f5e2d1fd0b067e18d419421b58346b53b58d3fa72%40%3Cannounce.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41616 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9378-f4v7-jgm4 · Vendor Advisory
• https://github.com/apache/ddlutils · Note
• https://t.me/cibsecurity/29699 · Telegram Post