GitHub Advisoryadvisory · Maven

GHSA-29f8-q7mf-7cqj Logic error in Apache Pinot

HIGH Published 2022-04-06 Modified 2022-04-17 Official page ↗
Aliases
CVE-2022-23974
Ecosystem
Maven
Packages
org.apache.pinot:pinot
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-674
Reviewed
2022-04-07

Affected packages

• Maven org.apache.pinot:pinot: < 0.10.0 → fixed in 0.10.0

Description

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0

Related

Alias · CVE (1)

  • CVE-2022-23974 In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References