kritik
CVE-2024-47561
apache-avro: Schema parsing may trigger Remote Code Execution (RCE)
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Julia9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: GHSA, Red Hat, Julia.
Açıklama
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Avro_jll | düzeltme belirtilmemiş |
| maven::GitHub Security Advisory Maven | org.apache.avro:avro | 1.11.4 |
| Red Hat | avro | düzeltme belirtilmemiş |
| chainguard | akhq, apache-nifi, celeborn-0.6 ve 8 tane daha | 0.25.1-r1 ve 10 tane daha |
| echo maven::Echo OSV | org.apache.avro:avro | 1.11.4 |
| minimos | apache-druid, apache-druid-fips | 38.0.0-r0 |
| seal maven::Seal Security Database | org.apache.avro:avro, org.apache.hadoop:hadoop-client-runtime, seal.sp1.org.apache.avro:avro ve 1 tane daha | 1.11.2+sp999, 1.9.2+sp2 ve 3 tane daha |
| wolfi | akhq, apache-nifi, celeborn-0.6 ve 5 tane daha | 0.25.1-r1 ve 7 tane daha |
8 kaynaktaki 29 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Avro_jll | düzeltme belirtilmemiş |
| maven::GitHub Security Advisory Maven | org.apache.avro:avro | 1.11.4 |
| Red Hat | avro | düzeltme belirtilmemiş |
| chainguard | akhq | 0.25.1-r1 |
| chainguard | apache-nifi | 2.3.0-r0 |
| chainguard | celeborn-0.6 | 0.6.3-r7 |
| chainguard | druid | 37.0.0-r56 |
| chainguard | hadoop-client-modules | 3.3.6-r8 |
| chainguard | logstash-8 | 8.17.3-r3 |
| chainguard | solr-9 | 9.10.1-r13 |
| chainguard | solr-fips-9 | 9.10.1-r1 |
| chainguard | tez | 0.10.4-r8 |
| chainguard | trino | 472-r0 |
| chainguard | wavefront-proxy | 13.7-r2 |
| echo maven::Echo OSV | org.apache.avro:avro | 1.11.4 |
| minimos | apache-druid | 38.0.0-r0 |
| minimos | apache-druid-fips | 38.0.0-r0 |
| seal maven::Seal Security Database | org.apache.avro:avro | 1.11.2+sp999, 1.9.2+sp2 |
| seal maven::Seal Security Database | org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp2 |
| seal maven::Seal Security Database | seal.sp1.org.apache.avro:avro | 1.11.2+sp999, 1.9.2+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.hadoop:hadoop-client-runtime | 3.4.0+sp999 |
| wolfi | akhq | 0.25.1-r1 |
| wolfi | apache-nifi | 2.3.0-r0 |
| wolfi | celeborn-0.6 | 0.6.3-r7 |
| wolfi | druid | 37.0.0-r56 |
| wolfi | logstash-8 | 8.17.3-r3 |
| wolfi | tez | 0.10.4-r8 |
| wolfi | trino | 472-r0 |
| wolfi | wavefront-proxy | 13.7-r2 |
Referanslar
- http://www.openwall.com/lists/oss-security/2024/10/03/1
- https://access.redhat.com/security/cve/CVE-2024-47561
- https://advisory.echohq.com/cve/CVE-2024-47561
- https://github.com/advisories/GHSA-r7pg-v2c8-mfg3
- https://github.com/apache/avro
- https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900
- https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285
- https://github.com/apache/avro/pull/2934
17 referansın hepsi
- https://github.com/apache/avro/pull/2980
- https://issues.apache.org/jira/browse/AVRO-3985
- https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
- https://nvd.nist.gov/vuln/detail/CVE-2024-47561
- https://security.netapp.com/advisory/ntap-20241011-0003
- https://security.netapp.com/advisory/ntap-20241011-0003/
- https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html
- https://www.cve.org/CVERecord?id=CVE-2024-47561
- https://www.openwall.com/lists/oss-security/2024/10/03/1