PT-2022-11763 · Apache+1 · Apache Avro+1

Philip Sanetra · Published 2022-01-06 · Updated 2023-12-22 · CVE-2021-43045

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Avro versions 1.10.2 and prior versions

Description A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack.

Recommendations For Apache Avro versions 1.10.2 and prior versions, update to version 1.11.0 to address this issue.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2023-1375

CVE-2021-43045

GHSA-868X-RG4C-CJQG

OESA-2023-1950

Affected Products

Alt Linux

Apache Avro

References · 13

• https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43045 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-868x-rg4c-cjqg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43045 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1950 · Vendor Advisory
• https://github.com/apache/avro · Note
• https://github.com/apache/avro/pull/1357 · Note
• https://issues.apache.org/jira/browse/AVRO-3226 · Note
• https://t.me/cvenotify/25074 · Telegram Post
• https://issues.apache.org/jira/browse/AVRO-3225 · Note
• https://t.me/cibsecurity/35073 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/06/8 · Note
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1950 · Note