Junglewise Threat Intelligence

CVE-2022-36124: Apache Avro Rust SDK resource exhaustion in Reader

CVE-2022-36124 · Severity: high · CVSS 7.5 · Published 2022-08-10

Technologies: apache-avro (crates.io), avro (PyPI). Vendors: crates.io, Apache, Apache Software Foundation, PyPI.

Executive brief

The Apache Avro Rust SDK, a library used for data serialization and exchange, contains a vulnerability that allows it to consume excessive system memory. An attacker could exploit this to crash applications or services using the library, leading to a denial of service. This could disrupt business operations and impact the availability of systems processing Avro data.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in the Apache Avro Rust SDK (formerly avro-rs) prior to version 0.14.0. The 'Reader' component fails to properly throttle or limit memory allocation when processing incoming data. A remote, unauthenticated attacker can provide specially crafted Avro data that triggers excessive memory consumption, leading to an Out-of-Memory (OOM) state and a denial-of-service (DoS) condition. The vulnerability is reachable over the network without user interaction. Users are advised to upgrade to apache-avro version 0.14.0.

Affected products

  • Apache apache-avro < 0.14.0

Timeline

  • 2022-08-09: disclosed: NVD publication date
  • 2022-08-10: advisory: GitHub Advisory published

References

Related threats