Apache IoTDB: Unsafe deserialize map in Sync Tool

2023-12-2112:30:29

Google

osv.dev

deserialization

untrusted data

apache iotdb

sync tool

upgrade

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.1 High

AI Score

Confidence

High

0.037 Low

EPSS

Percentile

91.8%

JSON

Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4.

Users are recommended to upgrade to version 1.2.2, which fixes the issue.

CPENameOperatorVersion
org.apache.iotdb:iotdb-parenteq0.13.1
org.apache.iotdb:iotdb-parenteq0.14.0-preview1
org.apache.iotdb:iotdb-parenteq0.13.3
org.apache.iotdb:iotdb-parenteq1.2.1
org.apache.iotdb:iotdb-parenteq1.0.0
org.apache.iotdb:iotdb-parenteq0.13.0
org.apache.iotdb:iotdb-parenteq0.13.4
org.apache.iotdb:iotdb-parenteq0.14.0-preview2
org.apache.iotdb:iotdb-parenteq1.1.1
org.apache.iotdb:iotdb-parenteq1.1.2

Name	Operator	Version
org.apache.iotdb:iotdb-parent	eq	0.13.1
org.apache.iotdb:iotdb-parent	eq	0.14.0-preview1
org.apache.iotdb:iotdb-parent	eq	0.13.3
org.apache.iotdb:iotdb-parent	eq	1.2.1
org.apache.iotdb:iotdb-parent	eq	1.0.0
org.apache.iotdb:iotdb-parent	eq	0.13.0
org.apache.iotdb:iotdb-parent	eq	0.13.4
org.apache.iotdb:iotdb-parent	eq	0.14.0-preview2
org.apache.iotdb:iotdb-parent	eq	1.1.1
org.apache.iotdb:iotdb-parent	eq	1.1.2