GHSA-2c59-37c4-qrx5

Source

https://github.com/advisories/GHSA-2c59-37c4-qrx5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-2c59-37c4-qrx5/GHSA-2c59-37c4-qrx5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2c59-37c4-qrx5

Aliases

CVE-2025-30065

Published

2025-04-01T09:30:20Z

Modified

2025-04-01T18:12:27.576099Z

Severity

10.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution

Details

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code

Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Database specific

{
    "nvd_published_at": "2025-04-01T08:15:15Z",
    "cwe_ids": [
        "CWE-502"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2025-04-01T18:04:17Z"
}

References

Affected packages

Maven / org.apache.parquet:parquet-avro

Package

Name: org.apache.parquet:parquet-avro; View open source insights on deps.dev
Purl: pkg:maven/org.apache.parquet/parquet-avro

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.15.1

Affected versions

1.*

1.7.0

1.8.0

1.8.1

1.8.2

1.8.3

1.9.0

1.10.0

1.10.1

1.11.0

1.11.1

1.11.2

1.12.0

1.12.1

1.12.2

1.12.3

1.13.0

1.13.1

1.14.0

1.14.1

1.14.2

1.14.3

1.14.4

1.15.0