[CVE-2023-41834] Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences

[Martijn Visser]

CVE-2023-41834: Apache Flink Stateful Functions allowed HTTP header
injection due to Improper Neutralization of CRLF Sequences

Severity: moderate

Vendor:
The Apache Software Foundation

Versions Affected:
Stateful Functions 3.1.0 to 3.2.0

Description:
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache
Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote
attackers to inject arbitrary HTTP headers and conduct HTTP response
splitting attacks via crafted HTTP requests. Attackers could
potentially inject malicious content into the HTTP response that is
sent to the user. This could include injecting a fake login form or
other phishing content, or injecting malicious JavaScript code that
can steal user credentials or perform other malicious actions on the
user's behalf.

Mitigation:
Users should upgrade to 3.3.0

Credit:
This issue was discovered by Andrea Cosentino from Apache Software Foundation

References:
https://flink.apache.org/security/

[ANNOUNCE] Apache Flink Stateful Functions Release 3.3.0 released

[Martijn Visser]

The Apache Flink community is excited to announce the release of
Stateful Functions 3.3.0!

Stateful Functions is a cross-platform stack for building Stateful
Serverless applications, making it radically simpler to develop
scalable, consistent, and elastic distributed applications. This new
release upgrades the Flink runtime to 1.16.2.

Release highlight:
- Upgrade underlying Flink dependency to 1.16.2

Release blogpost:
https://flink.apache.org/2023/09/19/stateful-functions-3.3.0-release-announcement/

The release is available for download at:
https://flink.apache.org/downloads/

Java SDK can be found at:
https://search.maven.org/artifact/org.apache.flink/statefun-sdk-java/3.3.0/jar

Python SDK can be found at:
https://pypi.org/project/apache-flink-statefun/

GoLang SDK can be found at:
https://github.com/apache/flink-statefun/tree/statefun-sdk-go/v3.3.0

JavaScript SDK can be found at:
https://www.npmjs.com/package/apache-flink-statefun

Official Docker image for Flink Stateful Functions can be
found at: https://hub.docker.com/r/apache/flink-statefun

The full release notes are available in Jira:
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12315522=12351276

We would like to thank all contributors of the Apache Flink community who
made this release possible!

Regards,
Martijn Visser