petermalkwin's public Squad

A severe security flaw in the Apache Avro Java SDK (CVE-2024-47561) has been discovered, enabling remote code execution on affected systems. With a CVSS score of 9.3, this vulnerability exists in versions prior to 1.11.4. Users are advised to upgrade to version 1.11.4 or 1.12.0 to mitigate the risk. The vulnerability arises from improperly sanitized schemas, and it is crucial to avoid parsing user-provided schemas to prevent potential exploitation.

Apache Avro SDK Remote Code Execution Vulnerability: Mitigation Tips