crítica
CVE-2024-47561
apache-avro: Schema parsing may trigger Remote Code Execution (RCE)
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Julia9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA, Red Hat, Julia.
Descripción
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Avro_jll | sin corrección indicada |
| maven::GitHub Security Advisory Maven | org.apache.avro:avro | 1.11.4 |
| Red Hat | avro | sin corrección indicada |
| chainguard | akhq, apache-nifi, celeborn-0.6 y 8 más | 0.25.1-r1 y 10 más |
| echo maven::Echo OSV | org.apache.avro:avro | 1.11.4 |
| minimos | apache-druid, apache-druid-fips | 38.0.0-r0 |
| seal maven::Seal Security Database | org.apache.avro:avro, org.apache.hadoop:hadoop-client-runtime, seal.sp1.org.apache.avro:avro y 1 más | 1.11.2+sp999, 1.9.2+sp2 y 3 más |
| wolfi | akhq, apache-nifi, celeborn-0.6 y 5 más | 0.25.1-r1 y 7 más |
Mostrar las 29 entradas de 8 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Avro_jll | sin corrección indicada |
| maven::GitHub Security Advisory Maven | org.apache.avro:avro | 1.11.4 |
| Red Hat | avro | sin corrección indicada |
| chainguard | akhq | 0.25.1-r1 |
| chainguard | apache-nifi | 2.3.0-r0 |
| chainguard | celeborn-0.6 | 0.6.3-r7 |
| chainguard | druid | 37.0.0-r56 |
| chainguard | hadoop-client-modules | 3.3.6-r8 |
| chainguard | logstash-8 | 8.17.3-r3 |
| chainguard | solr-9 | 9.10.1-r13 |
| chainguard | solr-fips-9 | 9.10.1-r1 |
| chainguard | tez | 0.10.4-r8 |
| chainguard | trino | 472-r0 |
| chainguard | wavefront-proxy | 13.7-r2 |
| echo maven::Echo OSV | org.apache.avro:avro | 1.11.4 |
| minimos | apache-druid | 38.0.0-r0 |
| minimos | apache-druid-fips | 38.0.0-r0 |
| seal maven::Seal Security Database | org.apache.avro:avro | 1.11.2+sp999, 1.9.2+sp2 |
| seal maven::Seal Security Database | org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp2 |
| seal maven::Seal Security Database | seal.sp1.org.apache.avro:avro | 1.11.2+sp999, 1.9.2+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999 |
| wolfi | akhq | 0.25.1-r1 |
| wolfi | apache-nifi | 2.3.0-r0 |
| wolfi | celeborn-0.6 | 0.6.3-r7 |
| wolfi | druid | 37.0.0-r56 |
| wolfi | logstash-8 | 8.17.3-r3 |
| wolfi | tez | 0.10.4-r8 |
| wolfi | trino | 472-r0 |
| wolfi | wavefront-proxy | 13.7-r2 |
Referencias
- http://www.openwall.com/lists/oss-security/2024/10/03/1
- https://access.redhat.com/security/cve/CVE-2024-47561
- https://advisory.echohq.com/cve/CVE-2024-47561
- https://github.com/advisories/GHSA-r7pg-v2c8-mfg3
- https://github.com/apache/avro
- https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900
- https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285
- https://github.com/apache/avro/pull/2934
Las 17 referencias
- https://github.com/apache/avro/pull/2980
- https://issues.apache.org/jira/browse/AVRO-3985
- https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
- https://nvd.nist.gov/vuln/detail/CVE-2024-47561
- https://security.netapp.com/advisory/ntap-20241011-0003
- https://security.netapp.com/advisory/ntap-20241011-0003/
- https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html
- https://www.cve.org/CVERecord?id=CVE-2024-47561
- https://www.openwall.com/lists/oss-security/2024/10/03/1