Описание
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.
Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
A vulnerability was found in Apache Avro. The project is affected and at risk if it accepts an org.apache.Avro/avroAvro schema for parsing provided by an end user. This flaw allows an attacker to trigger remote code execution by using the special "java-class" attribute.
Отчет
The Red Hat build of Apache Camel K 1.10 was rated Important as it allows users to provide an Avro schema for parsing. Note that this functionality is limited to authenticated users. Red Hat Single Sign-On 7 ships the affected component in its maven repository but does not use it in the product. As such it is affected but not vulnerable to the flaw, and is assessed at Moderate security impact.
Меры по смягчению последствий
- Avoid parsing user-provided schemas.
- Ensure proper input validation and sanitization of schemas before parsing.
- Monitor systems for any unusual activities that may indicate exploitation attempts.
- Apply the principle of least privilege to minimize the potential impact of successful exploits.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| A-MQ Clients 2 | avro | Not affected | ||
| Logging Subsystem for Red Hat OpenShift | org.elasticsearch-elasticsearch | Not affected | ||
| Red Hat build of Apache Camel for Spring Boot 3 | avro | Out of support scope | ||
| Red Hat build of Apicurio Registry 2 | avro | Affected | ||
| Red Hat build of Debezium 2 | avro | Not affected | ||
| Red Hat Build of Keycloak | avro | Not affected | ||
| Red Hat Data Grid 8 | avro | Not affected | ||
| Red Hat Fuse 7 | avro | Will not fix | ||
| Red Hat JBoss Data Grid 7 | avro | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 7 | avro | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)
Уязвимость библиотеки сериализации данных Apache Avro связана с недостатками механизма десериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код путём внедрения специально сформированной схемы данных
EPSS
8.8 High
CVSS3