PT-2022-22951 · Apache · Apache Avro Rust Sdk

Evan Richter · Published 2022-08-09 · Updated 2022-08-15 · CVE-2022-35724

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Avro Rust SDK versions prior to 0.14.0

Description It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications.

Recommendations For versions prior to 0.14.0, update to apache-avro version 0.14.0 to address this issue. As a temporary workaround, consider restricting the input data to prevent endless loops until the update is applied.

Fix

Infinite Loop

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-835

CWE-770

CWE-20

Related Identifiers

CVE-2022-35724

GHSA-V456-CHPW-6MMW

Affected Products

Apache Avro Rust Sdk

References · 7

• https://lists.apache.org/thread/771z1nwrpkn1ovmyfb2fm65mchdxgy7p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v456-chpw-6mmw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35724 · Security Note
• https://github.com/a0x8o/avro · Note
• https://t.me/cvenotify/34410 · Telegram Post
• https://t.me/cibsecurity/47769 · Telegram Post