PT-2018-18380 · Apache · Apache Orc

Terry Chia · Published 2018-05-18 · Updated 2022-05-13 · CVE-2018-8015

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Apache ORC versions 1.0.0 through 1.4.3

Description: A malformed ORC file can cause an endlessly recursive function call in the C++ or Java parser, potentially leading to a denial-of-service against software that uses the ORC file parser. The C++ parser may also experience a stack overflow, which could corrupt the stack.

Recommendations: For Apache ORC versions 1.0.0 through 1.4.3, consider updating to a version that fixes this issue to prevent denial-of-service attacks and potential stack corruption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2018-8015

GHSA-MQMP-4MCP-VG8V

Affected Products

Apache Orc

References · 10

• 🔥 https://github.com/apache/orc/blob/9cf9d26a20ac4d43911d7967ecaef8ef26b60594/site/security/CVE-2018-8015.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-8015 · Security Note
• https://orc.apache.org/security/CVE-2018-8015 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8015 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mqmp-4mcp-vg8v · Vendor Advisory
• https://github.com/apache/orc · Note
• https://github.com/apache/orc/commits/rel/release-1.4.4 · Note
• https://github.com/apache/orc/commit/d5018d309a8adc6b8e0567cb692a17371d16e108 · Note
• https://github.com/apache/orc/pull/266 · Note
• http://securityfocus.com/bid/104215 · Note