MEDIUM5.3
GHSA-rrjr-v56m-ww88
ParquetSharp: Possible Stack Overflow When Reading a ParquetFile with Large Decimal Type Width
Quick fix
GHSA-rrjr-v56m-ww88 — ParquetSharp: upgrade to the fixed version with the command below.
dotnet add package ParquetSharp --version 23.0.0.1Details
`DecimalConverter.ReadDecimal` makes a stackalloc using what might be an attacker-supplied value. If an attacker declares a decimal column with some unreasonable width, this could lead to a stack overflow. In a service environment, this would potentially take down a service.
This affects applications using ParquetSharp to read untrusted Parquet files in a network service.
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/ParquetSharp
Introduced in:
18.1.0Fixed in: 23.0.0.1Fix
dotnet add package ParquetSharp --version 23.0.0.1