CVE-2022-36124
Summary
| CVE | CVE-2022-36124 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-08-09 07:15:00 UTC |
| Updated | 2022-08-16 00:11:00 UTC |
| Description | It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue. |
Risk And Classification
Problem Types: CWE-770
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| lists.apache.org/thread/kj429rzo1xxjgz058qqqg0y7c0p512zo | MISC | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: This issue was reported to the Apache Avro team by Evan Richter at ForAllSecure and found with Mayhem.
There are currently no legacy QID mappings associated with this CVE.