HIGH7.5
GHSA-mqmp-4mcp-vg8v
Apache ORC vulnerable to Uncontrolled Recursion
Quick fix
GHSA-mqmp-4mcp-vg8v — org.apache.orc:orc: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1.4.4</version> for org.apache.orc:orcDetails
In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most likely denial-of-service against software that uses the ORC file parser. With the C++ parser, the stack overflow might possibly corrupt the stack.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.apache.orc:orc
Introduced in:
1.0.0Fixed in: 1.4.4Fix
# pom.xml: bump <version>1.4.4</version> for org.apache.orc:orcReferences
- https://nvd.nist.gov/vuln/detail/CVE-2018-8015[ADVISORY]
- https://github.com/apache/orc/pull/266[WEB]
- https://github.com/apache/orc/commit/d5018d309a8adc6b8e0567cb692a17371d16e108[WEB]
- https://github.com/apache/orc[PACKAGE]
- https://github.com/apache/orc/blob/9cf9d26a20ac4d43911d7967ecaef8ef26b60594/site/security/CVE-2018-8015.md[WEB]
- https://github.com/apache/orc/commits/rel/release-1.4.4[WEB]
- https://orc.apache.org/security/CVE-2018-8015[WEB]