PT-2022-23211 · Apache · Apache Avro Rust Sdk

Evan Richter · Published 2022-08-09 · Updated 2022-08-16 · CVE-2022-36124

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Avro Rust SDK versions prior to 0.14.0

Description The issue allows a Reader to consume memory beyond the allowed constraints, leading to out of memory on the system. This affects Rust applications using the Apache Avro Rust SDK.

Recommendations For versions prior to 0.14.0, update to apache-avro version 0.14.0 to address this issue.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2022-36124

GHSA-WCM8-86X6-8MV3

PYSEC-2022-43180

Affected Products

Apache Avro Rust Sdk

References · 10

• https://osv.dev/vulnerability/GHSA-wcm8-86x6-8mv3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36124 · Security Note
• https://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zo · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43180 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2022-43180.yaml · Note
• https://github.com/a0x8o/avro · Note
• https://t.me/cvenotify/34705 · Telegram Post
• https://t.me/cibsecurity/47765 · Telegram Post
• https://t.me/cvenotify/34409 · Telegram Post