Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

ALTO 7.3CVE-2024-47561 · GHSA-r7pg-v2c8-mfg3 · Published 03/10/2024 · updated 17/06/2026

In breve

CVE-2024-47561 è una vulnerabilità ALTO (CVSS 7.3) che riguarda org.apache.avro:avro, avro (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.3%, superiore al 88.4% delle vulnerabilità.
Correzione: aggiornare a 1.11.4 o successiva.

Package	Affected versions	Patched versions
org.apache.avro:avro Maven	`< 1.11.4`	`1.11.4`
avro apache	`< 1.11.4`	`1.11.4`

Description

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2024-47561 · ADVISORY
apache/avro#2934 · WEB
apache/avro#2980 · WEB
apache/avro commit 8f89868 · WEB
apache/avro commit f6b3bd7 · WEB
apache/avro · PACKAGE
issues.apache.org/jira/browse/AVRO-3985 · WEB
lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x · WEB
security.netapp.com/advisory/ntap-20241011-0003 · WEB
thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html · WEB
openwall.com/lists/oss-security/2024/10/03/1 · WEB
openwall.com/lists/oss-security/2024/10/03/1

Altre vulnerabilità di org.apache.avro:avro

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.avro:avro

Maven

< 1.11.4

1.11.4

avro

apache

< 1.11.4

1.11.4

Description

NVD description