CVE-2024-47561: apache software foundation apache avro java sdk Deserialization of Untrusted Data

CVSS: 9.2v4.0CriticalAnalyzed

AliasesRHSA-2024:7811CGA-24g4-9hf8-6frcCGA-25vw-vg4q-ggf2+174 more

Published 03-10-2024Last modified 21-10-2024

Vulnerability summary

CVE-2024-47561 is a critical (CVSS 9.2) Deserialization of Untrusted Data vulnerability in apache software foundation apache avro java sdk. EPSS estimates a 3.26% chance of exploitation in the next 30 days, higher than 88.1% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.2/10

010

Critical · v4.0 (CVE.org)

EPSS score

3.26%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 7

RHSA-2024:10207 RHSA-2024:10208 CGA-24WG-F7C9-6234 CGA-62P4-R2V4-5PH8 CGA-6HQM-X64F-4F58 CGA-6PM2-J37H-3FVW+3 more

Timeline

03-10-2024
PublishedVulnerability first disclosed.
21-10-2024
Last modifiedVulnerability information updated.

Description

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

CVSS metrics

9 scores · 6 sources · 2 versions

v4.09.2v3.17.3

EPSS trend

Probability

3.26%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.26% on 18-09-2026

18-09-202618-10-2026

EPSS score

3.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected systems

Chainguard81 products

akhq< 0.25.1-r1
apache-nifi< 2.3.0-r0
apache-nifi-compat< 2.3.0-r0
apache-nifi-toolkit< 2.3.0-r0
celeborn-0.5All versions (No fix recorded)

celeborn-0.6< 0.6.3-r7
druid< 37.0.0-r56 | < 37.0.0-r14 | < 36.0.0-r0 | < 36.0.0-r1 | All versions (No fix recorded)
hadoop-client-modules< 3.3.6-r8
hadoop-fips-3.3.6All versions (No fix recorded)
logstash-8-with-output-opensearch< 8.17.3-r3
rangerAll versions (No fix recorded)
solr-9-full< 9.10.1-r13
solr-fips-9-full< 9.10.1-r1
spark-3.5-scala-2.12All versions (No fix recorded)
spark-3.5-scala-2.13All versions (No fix recorded)
spark-fips-3.5-scala-2.12All versions (No fix recorded)
spark-fips-3.5-scala-2.13All versions (No fix recorded)
tez< 0.10.4-r8
trino< 472-r0
trino-config< 472-r0
trino-oci-entrypoint< 472-r0
trino-plugin-ai-functions< 472-r0
trino-plugin-bigquery< 472-r0
trino-plugin-blackhole< 472-r0
trino-plugin-cassandra< 472-r0
trino-plugin-clickhouse< 472-r0
trino-plugin-delta-lake< 472-r0
trino-plugin-druid< 472-r0
trino-plugin-duckdb< 472-r0
trino-plugin-elasticsearch< 472-r0
trino-plugin-exasol< 472-r0
trino-plugin-exchange-filesystem< 472-r0
trino-plugin-exchange-hdfs< 472-r0
trino-plugin-faker< 472-r0
trino-plugin-functions-python< 472-r0
trino-plugin-geospatial< 472-r0
trino-plugin-google-sheets< 472-r0
trino-plugin-hive< 472-r0
trino-plugin-http-event-listener< 472-r0
trino-plugin-http-server-event-listener< 472-r0
trino-plugin-hudi< 472-r0
trino-plugin-iceberg< 472-r0
trino-plugin-ignite< 472-r0
trino-plugin-jmx< 472-r0
trino-plugin-kafka< 472-r0
trino-plugin-kafka-event-listener< 472-r0
trino-plugin-lakehouse< 472-r0
trino-plugin-ldap-group-provider< 472-r0
trino-plugin-loki< 472-r0
trino-plugin-mariadb< 472-r0
trino-plugin-memory< 472-r0
trino-plugin-ml< 472-r0
trino-plugin-mongodb< 472-r0
trino-plugin-mysql< 472-r0
trino-plugin-mysql-event-listener< 472-r0
trino-plugin-opa< 472-r0
trino-plugin-openlineage< 472-r0
trino-plugin-opensearch< 472-r0
trino-plugin-oracle< 472-r0
trino-plugin-password-authenticators< 472-r0
trino-plugin-pinot< 472-r0
trino-plugin-postgresql< 472-r0
trino-plugin-prometheus< 472-r0
trino-plugin-ranger< 472-r0
trino-plugin-redis< 472-r0
trino-plugin-redshift< 472-r0
trino-plugin-resource-group-managers< 472-r0
trino-plugin-session-property-managers< 472-r0
trino-plugin-singlestore< 472-r0
trino-plugin-snowflake< 472-r0
trino-plugin-spooling-filesystem< 472-r0
trino-plugin-sqlserver< 472-r0
trino-plugin-teradata-functions< 472-r0
trino-plugin-thrift< 472-r0
trino-plugin-tpcds< 472-r0
trino-plugin-tpch< 472-r0
trino-plugin-vertica< 472-r0
wavefront-proxy< 13.7-r2
wavefront-proxy-compat< 13.7-r2
wavefront-proxy-config< 13.7-r2
wavefront-proxy-licenses< 13.7-r2

Show all 81

Wolfi71 products

akhq< 0.25.1-r1
apache-nifi< 2.3.0-r0
apache-nifi-compat< 2.3.0-r0
apache-nifi-toolkit< 2.3.0-r0
celeborn-0.6< 0.6.3-r7

druid< 37.0.0-r56 | < 37.0.0-r14 | < 36.0.0-r0 | < 36.0.0-r1 | All versions (No fix recorded)
logstash-8-with-output-opensearch< 8.17.3-r3
tez< 0.10.4-r8
trino< 472-r0
trino-config< 472-r0
trino-oci-entrypoint< 472-r0
trino-plugin-ai-functions< 472-r0
trino-plugin-bigquery< 472-r0
trino-plugin-blackhole< 472-r0
trino-plugin-cassandra< 472-r0
trino-plugin-clickhouse< 472-r0
trino-plugin-delta-lake< 472-r0
trino-plugin-druid< 472-r0
trino-plugin-duckdb< 472-r0
trino-plugin-elasticsearch< 472-r0
trino-plugin-exasol< 472-r0
trino-plugin-exchange-filesystem< 472-r0
trino-plugin-exchange-hdfs< 472-r0
trino-plugin-faker< 472-r0
trino-plugin-functions-python< 472-r0
trino-plugin-geospatial< 472-r0
trino-plugin-google-sheets< 472-r0
trino-plugin-hive< 472-r0
trino-plugin-http-event-listener< 472-r0
trino-plugin-http-server-event-listener< 472-r0
trino-plugin-hudi< 472-r0
trino-plugin-iceberg< 472-r0
trino-plugin-ignite< 472-r0
trino-plugin-jmx< 472-r0
trino-plugin-kafka< 472-r0
trino-plugin-kafka-event-listener< 472-r0
trino-plugin-lakehouse< 472-r0
trino-plugin-ldap-group-provider< 472-r0
trino-plugin-loki< 472-r0
trino-plugin-mariadb< 472-r0
trino-plugin-memory< 472-r0
trino-plugin-ml< 472-r0
trino-plugin-mongodb< 472-r0
trino-plugin-mysql< 472-r0
trino-plugin-mysql-event-listener< 472-r0
trino-plugin-opa< 472-r0
trino-plugin-openlineage< 472-r0
trino-plugin-opensearch< 472-r0
trino-plugin-oracle< 472-r0
trino-plugin-password-authenticators< 472-r0
trino-plugin-pinot< 472-r0
trino-plugin-postgresql< 472-r0
trino-plugin-prometheus< 472-r0
trino-plugin-ranger< 472-r0
trino-plugin-redis< 472-r0
trino-plugin-redshift< 472-r0
trino-plugin-resource-group-managers< 472-r0
trino-plugin-session-property-managers< 472-r0
trino-plugin-singlestore< 472-r0
trino-plugin-snowflake< 472-r0
trino-plugin-spooling-filesystem< 472-r0
trino-plugin-sqlserver< 472-r0
trino-plugin-teradata-functions< 472-r0
trino-plugin-thrift< 472-r0
trino-plugin-tpcds< 472-r0
trino-plugin-tpch< 472-r0
trino-plugin-vertica< 472-r0
wavefront-proxy< 13.7-r2
wavefront-proxy-compat< 13.7-r2
wavefront-proxy-config< 13.7-r2
wavefront-proxy-licenses< 13.7-r2

Show all 71

Netapp2 products

Apache1 product

avro< 1.11.4

Apache software foundation1 product

apache avro java sdk< 1.11.4

Org.apache.avro1 product

avro< 1.11.4

Redhat1 product

eap7-avro< 0:1.11.4-1.redhat_00001.1.el7eap | < 0:1.11.4-1.redhat_00001.1.el8eap | < 0:1.11.4-1.redhat_00001.1.el9eap

7 vendors · 158 products

References

23 links

lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5xVendor AdvisoryAdvisoryWEBMailing List
www.openwall.com/lists/oss-security/2024/10/03/1WEBMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20241011-0003/AdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2024:7811Advisory
access.redhat.com/security/updates/classification/ARTICLE
docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.4ARTICLE
docs.redhat.com/en/…ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2316116REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7811.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-47561REPORT

Show all 23 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities