CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

Published Oct 2, 2024
·
Updated

A vulnerability was found in Apache Avro. The project would be affected if it accepts an Avro schema for parsing provided by the end-user. By using the special "java-class" attribute an attacker can trigger remote code execution. The issue is fixed in Avro 1.11.4 and 1.12.0.

Other sources

Apache Avro could allow a remote authenticated attacker to execute arbitrary code on the system, caused by a flaw in schema parsing in the Java SDK. By sending a specially crafted request using the "java-class" attribute, an attacker could exploit this vulnerability to execute arbitrary code on the system.

— IBM

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.

— MITRE

Affected Software

6 affected componentsFixes available
Apache Avro<1.11.4
NetApp Active Iq Unified Manager Linux
NetApp Active Iq Unified Manager Vmware Vsphere
NetApp Active Iq Unified Manager Windows
NetApp Brocade San Navigator
maven/org.apache.avro:avro<1.11.4
1.11.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade maven/org.apache.avro:avro to a version that resolves this vulnerability.

    Fixed in 1.11.4
  2. Upgrade

    Upgrade Apache Avro Java SDK to a version that resolves this vulnerability.

    Fixed in 1.11.4Patch CVE-2024-47561
  3. Upgrade

    Upgrade Apache Avro Java SDK to a version that resolves this vulnerability.

    Fixed in 1.12.0Patch CVE-2024-47561
  4. Compensating control

    Ensure the application does not accept untrusted Avro schemas for parsing (the Java SDK is affected when it accepts an Avro schema for parsing).

Event History

Oct 2, 2024
Data Sourced
via Red Hat·02:16 PM
DescriptionSeverityAffected Software
Oct 3, 2024
CVE Published
via MITRE·10:23 AM
Data Sourced
via MITRE·10:23 AM
DescriptionWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·12:30 PM
Data Sourced
via GitHub·12:30 PM
DescriptionSeverityWeaknessAffected Software
Feb 4, 2025
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-47561?

CVE-2024-47561 is a critical vulnerability due to potential remote code execution risks in Apache Avro.

2

How do I fix CVE-2024-47561?

To fix CVE-2024-47561, upgrade to Apache Avro version 1.11.4 or later.

3

What versions of Apache Avro are affected by CVE-2024-47561?

CVE-2024-47561 affects all versions of Apache Avro prior to 1.11.4.

4

Can CVE-2024-47561 be exploited by untrusted users?

Yes, CVE-2024-47561 can be exploited if Apache Avro is configured to accept schemas from untrusted users.

5

What should I do if I cannot upgrade to fix CVE-2024-47561?

If upgrading is not possible, implement strict input validation and avoid accepting user-defined schemas to mitigate CVE-2024-47561.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203