CVE-2023-39913

Summary

CVE-2023-39913 is a deserialization vulnerability affecting Apache UIMA Java SDK versions before 3.5.0. The issue lies in the deserialization of untrusted data, specifically Java-serialized CAS files, which can result in arbitrary code execution. This vulnerability impacts several components, including the CasIOUtils class, the CAS Editor Eclipse plugin, and the Vinci Analysis Engine service. To mitigate the risk, users or developers can set up a global or context-specific ObjectInputFilter on Java 9+ platforms, allowing the deserialization of specific classes while blocking others. Alternatively, upgrading to Apache UIMA 3.5.0 is recommended, as it uses tightly scoped ObjectInputFilters for improved security.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.