GitHub Advisoryadvisory · Maven

GHSA-qj9p-jvmw-82rh Apache Pinot has Groovy Function support enabled by default

CRITICAL Published 2022-09-25 Modified 2025-05-28 Official page ↗
Aliases
CVE-2022-26112
Ecosystem
Maven
Packages
org.apache.pinot:pinot
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2022-09-29

Affected packages

• Maven org.apache.pinot:pinot: < 0.11.0 → fixed in 0.11.0

Description

Pinot allows you to run any function using Apache Groovy scripts. In versions prior to 0.10.0, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to groovy function support being enabled by default. This issue has been fixed by making function support disabled by default, in version 0.11.0. A potential workaround is to disable groovy script support.

Related

Alias · CVE (1)

  • CVE-2022-26112 In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References