VDB

CVE-2024-47561

CVE-2024-47561 PUBLISHED CVSS 9.2 CRITICAL

Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

Reported by apache · Published October 3, 2024

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
wavefront-proxyWolfi13.7-r2
avroapache1.11.4

Risk scores

CVSS 4.0
9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

VendorProductVersions
Apache Software FoundationApache Avro Java SDK0
wolfiwavefront-proxy0
apacheavro0
wolfitez0
Mavenorg.apache.avro:avro0
Apache Software FoundationApache Avro Java SDK0
chainguardsolr-fips-90
chainguardtez0
chainguardhadoop-client-modules0
chainguardlogstash-80
wolfitrino0
chainguardlogstash-jre-bcfips0
wolfidruid0, 0
chainguardtrino0
chainguardakhq0
chainguardapache-nifi0
chainguarddruid0, 0
wolfiapache-nifi0
wolficeleborn-0.60
wolfiakhq0

…and 4 more

Timeline

  • Oct 3, 2024 CVE Published
  • Oct 4, 2024 EPSS Score (30 in total, the first dated here)
  • Oct 5, 2024 Coalition ESS Score (10 in total, the first dated here)
  • Mar 17, 2026 Security Advisory (31 in total, the first dated here)
  • Nov 2, 2026 Distribution Patch (27 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2024-47561
vulnetix vdb fixes CVE-2024-47561

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-47561/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›