GHSA-qj9p-jvmw-82rh

Source

https://github.com/advisories/GHSA-qj9p-jvmw-82rh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/09/GHSA-qj9p-jvmw-82rh/GHSA-qj9p-jvmw-82rh.json

Aliases

• CVE-2022-26112

Published

2022-09-25T00:00:26Z

Modified

2023-11-08T04:08:53.250056Z

Details

Pinot allows you to run any function using Apache Groovy scripts. In versions prior to 0.10.0, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to groovy function support being enabled by default. This issue has been fixed by making function support disabled by default, in version 0.11.0. A potential workaround is to disable groovy script support.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-26112
• https://github.com/apache/pinot/pull/8711
• https://docs.pinot.apache.org/basics/releases/0.11.0
• https://github.com/apache/pinot
• https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h