CVE-2024-47561 | THREATINT

Description

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

PUBLISHED Reserved 2024-09-27 | Published 2024-10-03 | Updated 2024-10-21 | Assigner apache

CRITICAL: 9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-502 Deserialization of Untrusted Data

Product status

Default status

unaffected

Any version before 1.11.4

affected

Credits

Kostya Kortchinsky, from the Databricks Security Team finder

References

www.openwall.com/lists/oss-security/2024/10/03/1

security.netapp.com/advisory/ntap-20241011-0003/

lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x vendor-advisory

cve.org (CVE-2024-47561)

nvd.nist.gov (CVE-2024-47561)

Download JSON