Executive brief
The Apache Avro Rust SDK, a library used for data serialization and exchange, contains a vulnerability that allows it to consume excessive system memory. An attacker could exploit this to crash applications or services using the library, leading to a denial of service. This could disrupt business operations and impact the availability of systems processing Avro data.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in the Apache Avro Rust SDK (formerly avro-rs) prior to version 0.14.0. The 'Reader' component fails to properly throttle or limit memory allocation when processing incoming data. A remote, unauthenticated attacker can provide specially crafted Avro data that triggers excessive memory consumption, leading to an Out-of-Memory (OOM) state and a denial-of-service (DoS) condition. The vulnerability is reachable over the network without user interaction. Users are advised to upgrade to apache-avro version 0.14.0.
Affected products
- Apache apache-avro < 0.14.0
Timeline
- 2022-08-09: disclosed: NVD publication date
- 2022-08-10: advisory: GitHub Advisory published