{"id":"CVE-2024-43383","summary":"Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator","details":"Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator.\n\nThis issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016.\n\nAn attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access.\n\n\nUsers are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue.","aliases":["GHSA-2qw8-ppr5-m96c"],"modified":"2026-08-12T03:51:46.129740911Z","published":"2024-10-31T09:57:29.062Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43383.json","unresolved_ranges":[{"extracted_events":[{"introduced":"4.8.0-beta00005"},{"last_affected":"4.8.0-beta00016"}],"source":"AFFECTED_FIELD"},{"source":"DESCRIPTION","extracted_events":[{"introduced":"4.8.0-beta00005"},{"fixed":"4.8.0-beta00016"}]}]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2024/10/31/2"},{"type":"WEB","url":"https://www.nuget.org/packages/Lucene.Net.Replicator/4.8.0-beta00016"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43383.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/wlz1p76dxpt4rl9o29voxjd5zl7717nh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43383"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/lucenenet","events":[{"introduced":"ffbe9c3f90297dfbae11c8a3b1dad475821f46b3"},{"last_affected":"bed207a81acb7d100a5545dc28eeeb66d35e06ba"}],"database_specific":{"cpe":["cpe:2.3:a:apache:lucene.net:4.8.0:beta00005:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00006:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00007:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00008:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00009:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00010:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00011:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00012:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00013:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00014:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00015:*:*:*:*:*:*","cpe:2.3:a:apache:lucene.net:4.8.0:beta00016:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.8.0-beta00005"},{"last_affected":"4.8.0-beta00005"},{"introduced":"4.8.0-beta00006"},{"last_affected":"4.8.0-beta00006"},{"introduced":"4.8.0-beta00007"},{"last_affected":"4.8.0-beta00007"},{"introduced":"4.8.0-beta00008"},{"last_affected":"4.8.0-beta00008"},{"introduced":"4.8.0-beta00009"},{"last_affected":"4.8.0-beta00009"},{"introduced":"4.8.0-beta00010"},{"last_affected":"4.8.0-beta00010"},{"introduced":"4.8.0-beta00011"},{"last_affected":"4.8.0-beta00011"},{"introduced":"4.8.0-beta00012"},{"last_affected":"4.8.0-beta00012"},{"introduced":"4.8.0-beta00013"},{"last_affected":"4.8.0-beta00013"},{"introduced":"4.8.0-beta00014"},{"last_affected":"4.8.0-beta00014"},{"introduced":"4.8.0-beta00015"},{"last_affected":"4.8.0-beta00015"},{"introduced":"4.8.0-beta00016"},{"last_affected":"4.8.0-beta00016"}],"source":"CPE_STRING"}}],"versions":["4.8.0-beta00005","4.8.0-beta00006","4.8.0-beta00007","4.8.0-beta00008","4.8.0-beta00009","4.8.0-beta00010","4.8.0-beta00011","4.8.0-beta00012","4.8.0-beta00013","4.8.0-beta00014","4.8.0-beta00015","4.8.0-beta00016","Lucene.Net_4_8_0_beta00016","Lucene.Net_4_8_0_beta00015","Lucene.Net_4_8_0_beta00014","Lucene.Net_4_8_0_beta00013","Lucene.Net_4_8_0_beta00012","Lucene.Net_4_8_0_beta00011","Lucene.Net_4_8_0_beta00010","Lucene.Net_4_8_0_beta00009","Lucene.Net_4_8_0_beta00008","Lucene.Net_4_8_0_beta00007","Lucene.Net_4_8_0_beta00006","Lucene.Net_4_8_0_beta00005"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43383.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}