Vulnerability in Apache Flink Stateful Functions
CVE-2023-41834
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted HTTP requests. Attackers could potentially inject malicious content into the HTTP response that is sent to the user's browser. Users should upgrade to Apache Flink Stateful Functions version 3.3.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.023 (82.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 83rd percentile — 82.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.023 · change: +0.007
Affected products
Weakness classification (CWE)
References
- lists.apache.org/thread/cvxcsdyjqc3lysj1tz7s06zwm36zvwrm (vendor-advisory, Mailing List, Vendor Advisory)
- www.openwall.com/lists/oss-security/2023/09/19/3 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2023-41834?
- CVE-2023-41834 is a medium-severity vulnerability in Apache Flink Stateful Functions, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 6.1/10. Published 2023-09-19.
- How severe is CVE-2023-41834?
- Medium severity. CVSS v3 base score is 6.1 out of 10.