New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Address CVE-2024-47561: Apache Avro Vulnerable to Arbitrary Code Execution via Specially Crafted Schema Data #1388

Open

rnaval opened this issue Oct 17, 2024 · 0 comments

rnaval commented Oct 17, 2024

AWS Glue Schema registry has updated Apache Avro to address a security vulnerability.

Can the gsr version in the kinesis client be updated to this updated version? See https://github.com/awslabs/amazon-kinesis-client/blob/master/amazon-kinesis-client/pom.xml#L56

More information on the issue submitted: awslabs/aws-glue-schema-registry#356

Schema parsing in Apache Avro allows bad actors to execute arbitrary code by supplying specially crafted schema data.

How to fix it
Solution - Fix Available
Fixed in version 1.11.4-rc1 by this commit.

The latest releases can be found here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment