CRITICAL9.8

GHSA-r7pg-v2c8-mfg3

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

Quick fix

GHSA-r7pg-v2c8-mfg3 — org.apache.avro:avro: upgrade to the fixed version with the command below.

# pom.xml: bump <version>1.11.4</version> for org.apache.avro:avro

Details

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.apache.avro:avro

Introduced in: 0Fixed in: 1.11.4

Fix# pom.xml: bump <version>1.11.4</version> for org.apache.avro:avro

References

https://nvd.nist.gov/vuln/detail/CVE-2024-47561[ADVISORY]
https://github.com/apache/avro/pull/2934[WEB]
https://github.com/apache/avro/pull/2980[WEB]
https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900[WEB]
https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285[WEB]
https://github.com/apache/avro[PACKAGE]
https://issues.apache.org/jira/browse/AVRO-3985[WEB]
https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x[WEB]
https://security.netapp.com/advisory/ntap-20241011-0003[WEB]
https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html[WEB]
https://www.openwall.com/lists/oss-security/2024/10/03/1[WEB]
http://www.openwall.com/lists/oss-security/2024/10/03/1[WEB]