CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2024-47561

CVSS 9.2v4.0pub. 2024-10-03upd. 2025-07-10

Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The vulnerability results from unsafe deserialization (CWE-502) in the schema parsing mechanism of Apache Avro Java SDK. An attacker can provide a crafted schema whose processing by the vulnerable library leads to arbitrary code execution in the application context. The attack can be performed remotely without authentication.

Impact

An attacker can execute arbitrary code on a server or in an application processing an Avro schema, which may lead to complete system compromise, data theft, or data modification.

Mitigation & patch

Apache Avro Java SDK should be updated to version 1.11.4 or 1.12.0, which eliminate the vulnerability. Users of NetApp products (Active IQ Unified Manager, Brocade SAN Navigator) should apply patches available from the vendor according to references (advisory ntap-20241011-0003).

Who is affected

Apache Avro Java SDK version 1.11.3 and earlier. The vulnerability also affects NetApp products: Active IQ Unified Manager and Brocade SAN Navigator, which use this library.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X