CVE-2023-38264 IBM SDK, Java Technology Edition denial of service
Attackers can cause denial of service in IBM Java SDK ORB by exploiting improper deserialization filter enforcement.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38264?
CVE-2023-38264 is a medium-severity unsafe deserialization vulnerability in IBM SDK, Java Technology Edition, published on 10 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The IBM SDK, Java Technology Edition's Object Request Broker (ORB) 7.1.0.0 through 7.1.5.21 and 8.0.0.0 through 8.0.8.21 is vulnerable to a denial of service attack in some circumstances due to improper enforcement of the JEP 290 MaxRef and MaxDepth deserialization filters. IBM X-Force ID: 260578.
Weakness: CWE-502
Which versions are affected by CVE-2023-38264?
It affects 1 product.
Linux distribution packages (14)
java-1.8.0-ibm Red Hat:enterprise_linux:8::supplementary | All versions | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-demo Red Hat:enterprise_linux:8::supplementary | All versions | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-devel Red Hat:enterprise_linux:8::supplementary | All versions | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-headless Red Hat:enterprise_linux:8::supplementary | All versions | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-jdbc Red Hat:enterprise_linux:8::supplementary | All versions | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-plugin Red Hat:enterprise_linux:8::supplementary | All versions | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-src Red Hat:enterprise_linux:8::supplementary | All versions | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm-webstart Red Hat:enterprise_linux:8::supplementary | All versions | 1:1.8.0.8.25-1.el8_10 |
java-1.8.0-ibm Red Hat:rhel_extras:7 | All versions | 1:1.8.0.8.25-1jpp.1.el7 |
java-1.8.0-ibm-demo Red Hat:rhel_extras:7 | All versions | 1:1.8.0.8.25-1jpp.1.el7 |
java-1.8.0-ibm-devel Red Hat:rhel_extras:7 | All versions | 1:1.8.0.8.25-1jpp.1.el7 |
java-1.8.0-ibm-jdbc Red Hat:rhel_extras:7 | All versions | 1:1.8.0.8.25-1jpp.1.el7 |
java-1.8.0-ibm-plugin Red Hat:rhel_extras:7 | All versions | 1:1.8.0.8.25-1jpp.1.el7 |
java-1.8.0-ibm-src Red Hat:rhel_extras:7 | All versions | 1:1.8.0.8.25-1jpp.1.el7 |
Products include Ibm Java Software Development Kit.
How do I fix CVE-2023-38264?
Apply the vendor's patch.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-38264 being exploited?
There is no known exploitation of CVE-2023-38264 in the wild and no public exploit code.
Sources
Also known as GHSA-p7p5-3hmf-xx69, RHSA-2024:3685, RHSA-2024:4160.