CVE-2023-41834CWE-113CWE-74

CVE-2023-41834: fallo en Apache Flink Stateful Functions

Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Flink Stateful Functions

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 2.3%
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. Users should upgrade to Apache Flink Stateful Functions version 3.3.0.
Productos afectados
Apache Software Foundation · Apache Flink Stateful Functions