Apache IoTDB: Unsafe deserialize map in Sync Tool

CRÍTICO 9.8CVE-2023-51656 · GHSA-f23h-52hj-99p6 · Published 21/12/2023 · updated 17/06/2026

En resumen

CVE-2023-51656 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a org.apache.iotdb:iotdb-parent, iotdb (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.0%, mayor que el 63.9% de las vulnerabilidades.
Solución: actualizar a 1.2.2 o posterior.

Package	Affected versions	Patched versions
org.apache.iotdb:iotdb-parent Maven	`≥ 0.13.0, < 1.2.2`	`1.2.2`
iotdb apache	`≥ 0.13.0, ≤ 0.13.4`	No fix yet

Description

Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4.

Users are recommended to upgrade to version 1.2.2, which fixes the issue.

NVD description

Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue.

References

nvd.nist.gov/vuln/detail/CVE-2023-51656 · ADVISORY
apache/iotdb · PACKAGE
lists.apache.org/thread/zy3klwpv11vl5n65josbfo2fyzxg3dxc · WEB
openwall.com/lists/oss-security/2023/12/21/5 · WEB

Más vulnerabilidades de org.apache.iotdb:iotdb-parent

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.iotdb:iotdb-parent

Maven

≥ 0.13.0, < 1.2.2

1.2.2

iotdb

apache

≥ 0.13.0, ≤ 0.13.4

No fix yet

Description

Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4.

Users are recommended to upgrade to version 1.2.2, which fixes the issue.

NVD description

Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade to version 1.2.2, which fixes the issue.

Más vulnerabilidades de org.apache.iotdb:iotdb-parent

Ver todo →