CVE-2022-36125 Integer overflow when reading corrupted .avro file in Avro Rust SDK

2022-08-0906:50:40

CWE-20

apache

www.cve.org

cve-2022-36125

integer overflow

corrupted file

apache avro rust sdk

rust applications

update required

EPSS

0.001

Percentile

33.9%

JSON

It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

CNA Affected

[
  {
    "platforms": [
      "Rust"
    ],
    "product": "Apache Avro",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "0.14.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.apache.org/thread/t1r5xz0pvhm4tosqopjpj6dz8zlsht07

EPSS

0.001

Percentile

33.9%

JSON

Related for CVELIST:CVE-2022-36125