CVE-2022-36125
Plain English Summary
AI-powered analysis for quick understanding
An attacker can crash an application by sending it corrupted data when using the Apache Avro Rust SDK, which can disrupt services and lead to downtime. This vulnerability affects versions prior to 0.14.0, so users should upgrade to the latest version to protect against this issue.
Technical Description
It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
CVSS Vector Analysis
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Aug 9, 2022
over 3 years ago
Last Modified
Mar 6, 2026
about 1 month ago
Vendor
apache
Product
avro
Related Vulnerabilities
This vulnerability allows an attacker to access files outside of the intended directory on an Apache Livy server, potentially exposing sensitive data. It can only be exploited if the server is configured with a non-default setting for local directory access, so users should upgrade to version 0.9.0 to protect against this risk.
This vulnerability allows an attacker to access files they shouldn't be able to reach by sending specially crafted requests to Apache Livy's REST or JDBC interface. To exploit this, the attacker must already have access to these interfaces and be able to include specific Spark configuration values in their requests.
An attacker could gain unauthorized access to different AWS instances by reusing SAML authentication responses from other instances, potentially bypassing access controls. This vulnerability occurs because the system does not verify the origin of the SAML response against the actual instance URL, so it's crucial to upgrade to version 9.22.0 of the provider if you're using AWS Auth Manager.
This vulnerability allows an attacker with access to the database to run unauthorized code, effectively giving them the same permissions as the original creator of workflows in Airflow. While direct access to the database is uncommon and not recommended, upgrading to version 6.0.0 of the provider is essential to eliminate this risk.
This vulnerability allows an attacker to send malicious input to Apache IoTDB, potentially leading to unauthorized access or manipulation of data. It affects versions 1.0.0 to 1.3.6 and 2.0.0 to 2.0.6, so users should upgrade to the latest versions to protect against this risk.