Quick answers
- Is CVE-2022-36124 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-36124 being exploited in the wild.
- How severe is CVE-2022-36124?
- High severity, with a CVSS score of 7.5, published 10 August 2022.
- Which products and versions are affected?
- Apache Software Foundation Avro < 0.14.0; apache-avro (crates.io) < 0.14.0, SEMVER:introduced=0,fixed=0.14.0.
- Is there a fix for CVE-2022-36124?
- Yes. apache-avro (crates.io): upgrade to 0.14.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-36124 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2022-36124?
- Check whether you run Apache Software Foundation Avro, apache-avro (crates.io) or avro (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- apache-avro (crates.io): upgrade to 0.14.0 or later
cargo update -p apache-avro
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the Apache Avro Rust SDK (formerly avro-rs) prior to version 0.14.0. The 'Reader' component fails to properly throttle or limit memory allocation when processing incoming data. A remote, unauthenticated attacker can provide specially crafted Avro data that triggers excessive memory consumption, leading to an Out-of-Memory (OOM) state and a denial-of-service (DoS) condition. The vulnerability is reachable over the network without user interaction. Users are advised to upgrade to apache-avro version 0.14.0.
Affected products
- Apache apache-avro < 0.14.0
Identifiers
- CVE-2022-36124
- GHSA-wcm8-86x6-8mv3
- PYSEC-2022-43180
Timeline
- 2022-08-09: disclosed: NVD publication date
- 2022-08-10: advisory: GitHub Advisory published