CVE-2022-36124

HIGH7.5EPSS 3.0%

Apache Avro Rust SDK's Reader could consume memory beyond allowed constraints

發布日:2022/8/9修改日:2026/5/19

也稱為:GHSA-wcm8-86x6-8mv3PYSEC-2022-43180

描述

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

受影響套件(2)

crates.io/apache-avrofrom 0, < 0.14.0
PyPI/avro

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(4)

ADVISORYhttps://lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zo
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-36124
PATCHhttps://github.com/a0x8o/avro
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/avro/PYSEC-2022-43180.yaml