Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)

🗓️ 03 Oct 2024 12:30:48Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 33 Views

Apache Avro Java SDK: Arbitrary Code Execution in Schema Parsin

Reporter	Title	Published	Views	Family All 97
IBM Security Bulletins	Security Bulletin: IBM Asset Data Dictionary uses multiple third party dependencies which is vulnerable to CVEs.	6 Feb 202505:30	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to arbitrary code execution due to Apache Avro (CVE-2024-47561)	29 Apr 202513:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities	19 Dec 202415:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Endpoint Management	12 Nov 202410:48	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for December 2024 and January 2025	12 Mar 202511:48	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFix for Junuary 2025.	7 Feb 202518:48	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Avro affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component.	13 Mar 202517:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected by multiple vulnerabilities	27 Feb 202517:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to arbitrary code execution on the system due to the Apache Avro component (CVE-2024-47561).	30 Jan 202512:00	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	15 Apr 202503:11	–	ibm

Vulners

Node

org.apache.avro avroRange<1.11.4maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-47561
lists	www.lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x
github	www.github.com/apache/avro/pull/2934
github	www.github.com/apache/avro/pull/2980
github	www.github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900
github	www.github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285
issues	www.issues.apache.org/jira/browse/AVRO-3985
thehackernews	www.thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html
openwall	www.openwall.com/lists/oss-security/2024/10/03/1
security	www.security.netapp.com/advisory/ntap-20241011-0003

10 Jul 2025 23:19Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.3

CVSS 49.2

EPSS0.00674

SSVC

apache avro java sdk arbitrary code execution schema parsing upgrade software