PT-2022-23212 · Apache · Apache Avro Rust Sdk

Evan Richter · Published 2022-08-09 · Updated 2026-03-06 · CVE-2022-36125

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Avro Rust SDK versions prior to 0.14.0

Description It is possible to crash an application by providing corrupted data to be read. This issue affects Rust applications using the Apache Avro Rust SDK.

Recommendations For versions prior to 0.14.0, update to apache-avro version 0.14.0 to address this issue.

Fix

Integer Overflow

RCE

Weakness Enumeration

CWE-190

CWE-20

Related Identifiers

CVE-2022-36125

GHSA-3W5G-989P-35R8

Affected Products

Apache Avro Rust Sdk

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-36125 · Security Note
• https://lists.apache.org/thread/t1r5xz0pvhm4tosqopjpj6dz8zlsht07 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3w5g-989p-35r8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36125 · Vendor Advisory
• https://github.com/a0x8o/avro · Note
• https://t.me/cibsecurity/47770 · Telegram Post
• https://t.me/cvenotify/34408 · Telegram Post
• https://t.me/cveNotify/154509 · Telegram Post