critique
CVE-2024-47561
apache-avro: Schema parsing may trigger Remote Code Execution (RCE)
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Julia9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Le label propre à Trivy est CRITICAL. Critique selon GHSA, Red Hat, Julia.
Description
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Avro_jll | pas de correctif indiqué |
| maven::GitHub Security Advisory Maven | org.apache.avro:avro | 1.11.4 |
| Red Hat | avro | pas de correctif indiqué |
| chainguard | akhq, apache-nifi, celeborn-0.6 et 8 autres | 0.25.1-r1 et 10 autres |
| echo maven::Echo OSV | org.apache.avro:avro | 1.11.4 |
| minimos | apache-druid, apache-druid-fips | 38.0.0-r0 |
| seal maven::Seal Security Database | org.apache.avro:avro, org.apache.hadoop:hadoop-client-runtime, seal.sp1.org.apache.avro:avro et 1 autres | 1.11.2+sp999, 1.9.2+sp2 et 3 autres |
| wolfi | akhq, apache-nifi, celeborn-0.6 et 5 autres | 0.25.1-r1 et 7 autres |
Afficher les 29 entrées de 8 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Avro_jll | pas de correctif indiqué |
| maven::GitHub Security Advisory Maven | org.apache.avro:avro | 1.11.4 |
| Red Hat | avro | pas de correctif indiqué |
| chainguard | akhq | 0.25.1-r1 |
| chainguard | apache-nifi | 2.3.0-r0 |
| chainguard | celeborn-0.6 | 0.6.3-r7 |
| chainguard | druid | 37.0.0-r56 |
| chainguard | hadoop-client-modules | 3.3.6-r8 |
| chainguard | logstash-8 | 8.17.3-r3 |
| chainguard | solr-9 | 9.10.1-r13 |
| chainguard | solr-fips-9 | 9.10.1-r1 |
| chainguard | tez | 0.10.4-r8 |
| chainguard | trino | 472-r0 |
| chainguard | wavefront-proxy | 13.7-r2 |
| echo maven::Echo OSV | org.apache.avro:avro | 1.11.4 |
| minimos | apache-druid | 38.0.0-r0 |
| minimos | apache-druid-fips | 38.0.0-r0 |
| seal maven::Seal Security Database | org.apache.avro:avro | 1.11.2+sp999, 1.9.2+sp2 |
| seal maven::Seal Security Database | org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp2 |
| seal maven::Seal Security Database | seal.sp1.org.apache.avro:avro | 1.11.2+sp999, 1.9.2+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999 |
| wolfi | akhq | 0.25.1-r1 |
| wolfi | apache-nifi | 2.3.0-r0 |
| wolfi | celeborn-0.6 | 0.6.3-r7 |
| wolfi | druid | 37.0.0-r56 |
| wolfi | logstash-8 | 8.17.3-r3 |
| wolfi | tez | 0.10.4-r8 |
| wolfi | trino | 472-r0 |
| wolfi | wavefront-proxy | 13.7-r2 |
Références
- http://www.openwall.com/lists/oss-security/2024/10/03/1
- https://access.redhat.com/security/cve/CVE-2024-47561
- https://advisory.echohq.com/cve/CVE-2024-47561
- https://github.com/advisories/GHSA-r7pg-v2c8-mfg3
- https://github.com/apache/avro
- https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900
- https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285
- https://github.com/apache/avro/pull/2934
Les 17 références
- https://github.com/apache/avro/pull/2980
- https://issues.apache.org/jira/browse/AVRO-3985
- https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
- https://nvd.nist.gov/vuln/detail/CVE-2024-47561
- https://security.netapp.com/advisory/ntap-20241011-0003
- https://security.netapp.com/advisory/ntap-20241011-0003/
- https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html
- https://www.cve.org/CVERecord?id=CVE-2024-47561
- https://www.openwall.com/lists/oss-security/2024/10/03/1