kritisch
CVE-2024-47561
apache-avro: Schema parsing may trigger Remote Code Execution (RCE)
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Julia9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Trivys eigenes Label ist CRITICAL. Kritisch laut GHSA, Red Hat, Julia.
Beschreibung
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Avro_jll | kein Fix angegeben |
| maven::GitHub Security Advisory Maven | org.apache.avro:avro | 1.11.4 |
| Red Hat | avro | kein Fix angegeben |
| chainguard | akhq, apache-nifi, celeborn-0.6 und 8 weitere | 0.25.1-r1 und 10 weitere |
| echo maven::Echo OSV | org.apache.avro:avro | 1.11.4 |
| minimos | apache-druid, apache-druid-fips | 38.0.0-r0 |
| seal maven::Seal Security Database | org.apache.avro:avro, org.apache.hadoop:hadoop-client-runtime, seal.sp1.org.apache.avro:avro und 1 weitere | 1.11.2+sp999, 1.9.2+sp2 und 3 weitere |
| wolfi | akhq, apache-nifi, celeborn-0.6 und 5 weitere | 0.25.1-r1 und 7 weitere |
Alle 29 Einträge aus 8 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Avro_jll | kein Fix angegeben |
| maven::GitHub Security Advisory Maven | org.apache.avro:avro | 1.11.4 |
| Red Hat | avro | kein Fix angegeben |
| chainguard | akhq | 0.25.1-r1 |
| chainguard | apache-nifi | 2.3.0-r0 |
| chainguard | celeborn-0.6 | 0.6.3-r7 |
| chainguard | druid | 37.0.0-r56 |
| chainguard | hadoop-client-modules | 3.3.6-r8 |
| chainguard | logstash-8 | 8.17.3-r3 |
| chainguard | solr-9 | 9.10.1-r13 |
| chainguard | solr-fips-9 | 9.10.1-r1 |
| chainguard | tez | 0.10.4-r8 |
| chainguard | trino | 472-r0 |
| chainguard | wavefront-proxy | 13.7-r2 |
| echo maven::Echo OSV | org.apache.avro:avro | 1.11.4 |
| minimos | apache-druid | 38.0.0-r0 |
| minimos | apache-druid-fips | 38.0.0-r0 |
| seal maven::Seal Security Database | org.apache.avro:avro | 1.11.2+sp999, 1.9.2+sp2 |
| seal maven::Seal Security Database | org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp2 |
| seal maven::Seal Security Database | seal.sp1.org.apache.avro:avro | 1.11.2+sp999, 1.9.2+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999 |
| wolfi | akhq | 0.25.1-r1 |
| wolfi | apache-nifi | 2.3.0-r0 |
| wolfi | celeborn-0.6 | 0.6.3-r7 |
| wolfi | druid | 37.0.0-r56 |
| wolfi | logstash-8 | 8.17.3-r3 |
| wolfi | tez | 0.10.4-r8 |
| wolfi | trino | 472-r0 |
| wolfi | wavefront-proxy | 13.7-r2 |
Referenzen
- http://www.openwall.com/lists/oss-security/2024/10/03/1
- https://access.redhat.com/security/cve/CVE-2024-47561
- https://advisory.echohq.com/cve/CVE-2024-47561
- https://github.com/advisories/GHSA-r7pg-v2c8-mfg3
- https://github.com/apache/avro
- https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900
- https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285
- https://github.com/apache/avro/pull/2934
Alle 17 Referenzen
- https://github.com/apache/avro/pull/2980
- https://issues.apache.org/jira/browse/AVRO-3985
- https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
- https://nvd.nist.gov/vuln/detail/CVE-2024-47561
- https://security.netapp.com/advisory/ntap-20241011-0003
- https://security.netapp.com/advisory/ntap-20241011-0003/
- https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html
- https://www.cve.org/CVERecord?id=CVE-2024-47561
- https://www.openwall.com/lists/oss-security/2024/10/03/1