Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-47561

Good to know:

icon

Date: October 3, 2024

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.

Language: Java

Severity Score

Related Resources (13)

https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900
https://www.openwall.com/lists/oss-security/2024/10/03/1
https://github.com/apache/avro
https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html
https://issues.apache.org/jira/browse/AVRO-3985
https://github.com/apache/avro/pull/2934
https://nvd.nist.gov/vuln/detail/CVE-2024-47561
http://www.openwall.com/lists/oss-security/2024/10/03/1
https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
https://github.com/apache/avro/pull/2980
https://security.netapp.com/advisory/ntap-20241011-0003/
https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285
https://www.mend.io/vulnerability-database/CVE-2024-47561

Severity Score

Weakness Type (CWE)

Deserialization of Untrusted Data

CWE-502

Top Fix

icon

Upgrade Version

Upgrade to version mpa-portable - no_fix;pyspark - 3.2.3;pyspark - no_fix;pyspark - 3.5.0;pyspark - 3.3.2;pepgenome - no_fix;gorpipe - no_fix;org.modeshape:modeshape-jca:3.4.0.Final;org.apache.avro:avro:1.11.4

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): LOW

Do you need more information?

Contact Us