PT-2022-17682 · Apache · Apache Pinot

Haoruo Chen · Published 2022-09-23 · Updated 2022-09-26 · CVE-2022-26112

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Pinot versions 0.10.0 and earlier

Description The issue is related to the groovy function support in the Pinot query endpoint and realtime ingestion layer, which poses a risk in unprotected environments. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. The vulnerability is due to the groovy function support being enabled by default in older versions. API Endpoints: The Pinot query endpoint is affected. Vulnerable Parameters or Variables: No specific variables are mentioned. Function Names: No specific function names are mentioned, but the groovy function support is implicated.

Recommendations For Apache Pinot versions 0.10.0 and earlier, update to version 0.11.0 or later, where the groovy function support is disabled by default. As a temporary workaround, consider disabling the groovy script support until a patch is available.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-26112

GHSA-QJ9P-JVMW-82RH

Affected Products

Apache Pinot

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-26112 · Security Note
• https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h · Patch
• https://osv.dev/vulnerability/GHSA-qj9p-jvmw-82rh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26112 · Vendor Advisory
• https://github.com/apache/pinot · Note
• https://github.com/apache/pinot/pull/8711 · Note
• https://t.me/cibsecurity/50307 · Telegram Post
• https://docs.pinot.apache.org/basics/releases/0.11.0 · Note