Описание
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
Ссылки
- Mailing ListRelease Notes
- Mailing ListThird Party Advisory
- Issue TrackingThird Party Advisory
- Issue TrackingPatch
- Issue TrackingThird Party Advisory
- ExploitPress/Media CoverageThird Party Advisory
- https://github.com/h3st4k3r/CVE-2025-30065/blob/main/POC-CVE-2025-30065-ParquetExploitGenerator.javaThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.15.1 (исключая)
cpe:2.3:a:apache:parquet_java:*:*:*:*:*:*:*:*
EPSS
Процентиль: 63%
0.00443
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-502
Связанные уязвимости
CVSS3: 10
redhat
10 месяцев назад
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.
github
10 месяцев назад
Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
CVSS3: 10
fstec
11 месяцев назад
Уязвимость модуля parquet-avro формата столбцового хранения для обработки данных Apache Parquet Java, позволяющая нарушителю выполнить произвольный код
EPSS
Процентиль: 63%
0.00443
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-502