CVE-2021-40146 A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.java

What is CVE-2021-40146?

CVE-2021-40146 is a critical unsafe deserialization vulnerability in Apache Any23, published on 11 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.

Which versions are affected by CVE-2021-40146?

2 open source packages ship an affected version, including org.apache.any23:apache-any23. It affects 1 product.

Products include Apache Any23.

How do I fix CVE-2021-40146?

Upgrade org.apache.any23:apache-any23 to 2.5 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2021-40146 being exploited?

There is no known exploitation of CVE-2021-40146 in the wild and no public exploit code.

Other vulnerabilities in Apache Any23

• CVE-2022-25312 An XML external entity (XXE) injection vulnerability exists in the Apache Any23 RDFa XSLTStylesheet extractor Critical 9.1
• CVE-2021-38555 An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java Critical 9.1
• CVE-2023-34150 Apache Any23: Possible excessive allocation of resources reading input. Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-99px-7724-484v.