GHSA-v456-chpw-6mmw

Source

https://github.com/advisories/GHSA-v456-chpw-6mmw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-v456-chpw-6mmw/GHSA-v456-chpw-6mmw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v456-chpw-6mmw

Aliases

CVE-2022-35724

Published

2022-08-10T00:00:31Z

Modified

2023-11-08T04:09:52.001902Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Apache Avro Rust SDK vulnerable to reader looping in cycle endlessly, consuming CPU

Details

It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

Database specific

{
    "nvd_published_at": "2022-08-09T07:15:00Z",
    "github_reviewed_at": "2022-08-18T19:15:54Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-835"
    ]
}

References

Affected packages

crates.io / apache-avro

Package

Name: apache-avro; View open source insights on deps.dev
Purl: pkg:cargo/apache-avro

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.14.0