Description (CNA)
JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types. Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Spring / Spring for Apache Kafka | affected 4.0.0 before 4.0.5.1; affected 3.3.0 before 3.3.15.1; affected 3.2.0 before 3.2.14; affected 2.9.0 before 2.9.14; affected 2.8.0 before 2.8.12 |
CWE
CWE-502
References
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in the spring-kafka component. A remote attacker, by supplying crafted header values, could exploit a vulnerability in JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper that incorrectly matched type headers against trusted packages. This issue, combined with Jackson's default bean deserialization, could allow the consumer to deserialize arbitrary Java Development Kit (JDK) types. This could lead to arbitrary code execution on the affected system.