When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.
This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.
CVE-2023-39410 - High Severity Vulnerability
Avro core components
Library home page: http://avro.apache.org
Path to dependency file: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/avro/avro/1.7.7/avro-1.7.7.jar
Dependency Hierarchy: - hadoop-common-3.3.0.jar (Root Library) - :x: **avro-1.7.7.jar** (Vulnerable Library)
Found in HEAD commit: eb687271afab9d7c61ca82fce2ed4fdb3d5e1a70
Found in base branch: master
When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up to and including 1.11.2. Users should update to apache-avro version 1.11.3 which addresses this issue.
Publish Date: 2023-09-29
URL: CVE-2023-39410
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-rhrv-645h-fjfh
Release Date: 2023-09-29
Fix Resolution (org.apache.avro:avro): 1.11.3
Direct dependency fix Resolution (org.apache.hadoop:hadoop-common): 3.3.6
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.