Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-53wx-pr6q-m3j5

Опубликовано: 06 мая 2025
Источник: github
Github: Прошло ревью
CVSS4: 7.1

Описание

Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code.

While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed.

The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted)

Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.

Пакеты

Наименование

org.apache.parquet:parquet-avro

maven
Затронутые версииВерсия исправления

< 1.15.2

1.15.2

EPSS

Процентиль: 29%
0.00101
Низкий

7.1 High

CVSS4

Дефекты

CWE-73

Связанные уязвимости

CVSS3: 6.4
redhat
3 месяца назад

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted) Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.

CVSS3: 9.8
nvd
3 месяца назад

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted) Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.

CVSS3: 9.9
fstec
4 месяца назад

Уязвимость модуля parquet-avro библиотеки Apache Parquet Java, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 29%
0.00101
Низкий

7.1 High

CVSS4

Дефекты

CWE-73