High severity · published Oct 3, 2024
CVE-2024-47561
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code
7.3
CVSS
3.3%
EPSS
No
On KEV
Description
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.
Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
AV
Avro · Apache
before 1.11.4 · source: NVD
BS
Brocade San Navigator · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47561
Mailing List
https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
Mailing List
http://www.openwall.com/lists/oss-security/2024/10/03/1
Third Party Advisory
https://security.netapp.com/advisory/ntap-20241011-0003/
More from Avro
7.5
CVE-2023-39410
When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system
7.5
CVE-2022-36125
Integer overflow when reading corrupted .avro file in Avro Rust SDK
7.5
CVE-2022-36124
Memory overconsumption in Avro Rust SDK
7.5
CVE-2022-35724
Denial of service while reading data in Avro Rust SDK
7.5
CVE-2021-43045
A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack