Описание
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.
This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0.
Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
A code injection flaw has been discovered in Apache Avro. This vulnerability manifests when generating specific records from untrusted Avro schemas.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat build of Apache Camel 4 for Quarkus 3 | avro | Fix deferred | ||
| Red Hat build of Apache Camel for Spring Boot 4 | avro | Fix deferred | ||
| Red Hat build of Apicurio Registry 2 | avro | Fix deferred | ||
| Red Hat build of Apicurio Registry 3 | avro | Fix deferred | ||
| Red Hat build of Debezium 2 | avro | Fix deferred | ||
| Red Hat build of Debezium 3 | avro | Fix deferred | ||
| Red Hat Data Grid 8 | avro | Fix deferred | ||
| Red Hat Fuse 7 | avro | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 7 | avro | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 8 | avro | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.6 Medium
CVSS3
Связанные уязвимости
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. This issue affects Apache Avro Java SDK: all versions through 1.11.4 and version 1.12.0. Users are recommended to upgrade to version 1.12.1 or 1.11.5, which fix the issue.
EPSS
5.6 Medium
CVSS3