PT-2025-21135 · Apache · Apache Iotdb

Nbxiglk + 1 · Published 2025-05-14 · Updated 2025-05-19 · CVE-2024-24780

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache IoTDB versions 1.0.0 through 1.3.3

Description: The issue is related to a Remote Code Execution vulnerability with untrusted URI of UDF in Apache IoTDB. An attacker with privilege to create UDF can register a malicious function from an untrusted URI.

Recommendations: For Apache IoTDB versions 1.0.0 through 1.3.3, upgrade to version 1.3.4, which fixes the issue. As a temporary workaround, consider restricting the creation of UDFs to trusted sources until the upgrade is applied.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-24780

GHSA-F4RQ-F4J9-F6RM

PYSEC-2025-59

Affected Products

Apache Iotdb

References · 16

• https://lists.apache.org/thread/xphtm98v3zsk9vlpfh481m1ry2ctxvmj · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-59 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24780 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24780 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f4rq-f4j9-f6rm · Vendor Advisory
• https://github.com/apache/iotdb · Note
• https://github.com/apache/iotdb/pull/14365 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2025-59.yaml · Note
• https://twitter.com/oss_security/status/1922513002630127618 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1922567102579245457 · Twitter Post
• https://t.me/cvenotify/122098 · Telegram Post
• https://twitter.com/CVEnew/status/1922695649788821864 · Twitter Post
• http://openwall.com/lists/oss-security/2025/05/14/2 · Note
• https://t.me/purp_sec/634 · Telegram Post
• https://t.me/cvetracker/23817 · Telegram Post