PT-2022-16378 · Apache · Apache Pinot

Bubblegumkk + 2 · Published 2022-04-05 · Updated 2022-04-15 · CVE-2022-23974

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Pinot versions 0.9.3 and earlier

Description The issue allows segment directories to be imported into Pinot tables through the segment upload path in Apache Pinot. In installations with open access to the controller, a specially crafted request can potentially disrupt the Pinot service.

Recommendations For Apache Pinot versions 0.9.3 and earlier, update to Pinot release 0.10.0 to fix the issue.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2022-23974

GHSA-29F8-Q7MF-7CQJ

Affected Products

Apache Pinot

References · 8

• https://osv.dev/vulnerability/GHSA-29f8-q7mf-7cqj · Vendor Advisory
• https://lists.apache.org/thread/3dk8pf1n02p8oj2j3czbtchyjsf8khwr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23974 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23974 · Vendor Advisory
• https://github.com/apache/pinot · Note
• https://github.com/apache/pinot/pull/7969 · Note
• https://t.me/cibsecurity/40203 · Telegram Post
• https://docs.pinot.apache.org/basics/releases/0.10.0 · Note