logo

Database

Insecure deserialization In org.apache.avro:avro

Description

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK) Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2024-475612. NVD-2024-475613. OSV-2024-475614. GCVE-2024-47561

References

1. https://github.com/apache/avro/pull/29342. https://github.com/apache/avro/pull/29803. https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d9004. https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba312855. https://issues.apache.org/jira/browse/AVRO-39856. https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x7. https://security.netapp.com/advisory/ntap-20241011-00038. https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html9. https://www.openwall.com/lists/oss-security/2024/10/03/110. http://www.openwall.com/lists/oss-security/2024/10/03/1

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.