PT-2023-27148 · Oracle+1 · Java+1

Huangzhicong · Published 2023-11-08 · Updated 2024-09-04 · CVE-2023-39913

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache UIMA Java SDK versions prior to 3.5.0

Description The issue is related to the deserialization of untrusted data and improper input validation in the Apache UIMA Java SDK. This affects several locations in the code, including the deserialization of Java-serialized CAS, CAS Editor Eclipse plugin, Vinci Analysis Engine service, CasAnnotationViewerApplet, CasTreeViewerApplet, and the checkpointing feature of the CPE module. The unrestricted deserialization of Java-serialized CAS files may allow arbitrary remote code execution. Users or developers who use the CasIOUtils in their own applications and services to parse serialized CAS data are affected unless they ensure that the data passed to CasIOUtils is not a serialized Java object.

Recommendations To resolve the issue, upgrade to Apache UIMA Java SDK version 3.5.0, which fixes the issue. For users running on Java 9+ platforms, configure a filter pattern through the "jdk.serialFilter" system property to allow deserializing specific classes, and use "!*" as the final component to disallow deserialization of any classes not listed in the pattern. For Java 1.8, upgrade to a recent Java version to secure the affected UIMA version, as Java 1.8 does not support the ObjectInputFilter.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-20

CWE-502

Related Identifiers

CVE-2023-39913

GHSA-5R8J-QMCM-7G7Q

OPENSUSE-SU-2024:13471-1

Affected Products

Apache Uima Java Sdk

Java

References · 12

• https://osv.dev/vulnerability/CVE-2023-39913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39913 · Security Note
• https://lists.apache.org/thread/lw30f4qlq3mhkhpljj16qw4fot3rg7v4 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5r8j-qmcm-7g7q · Vendor Advisory
• https://github.com/apache/uima-uimaj/releases/tag/rel%2Fuimaj-3.5.0 · Note
• https://github.com/apache/uima-uimaj · Note
• https://twitter.com/oss_security/status/1722232775435255955 · Twitter Post
• http://openwall.com/lists/oss-security/2023/11/08/1 · Note
• https://t.me/cvenotify/93244 · Telegram Post
• https://t.me/pentestingnews/40863 · Telegram Post
• https://twitter.com/fletch_ai/status/1722450692579758272 · Twitter Post
• https://twitter.com/autumn_good_35/status/1722217469132378199 · Twitter Post