Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Java]: Upgrade to Avro 1.11.3 #39299

Closed
jbonofre opened this issue Dec 19, 2023 · 0 comments · Fixed by #39300
Closed

[Java]: Upgrade to Avro 1.11.3 #39299

jbonofre opened this issue Dec 19, 2023 · 0 comments · Fixed by #39300
Assignees
@jbonofre
Labels
Component: Java Type: enhancement
Milestone
15.0.0

Comments

@jbonofre
Copy link
Member

jbonofre commented Dec 19, 2023 •
edited
Loading

Describe the enhancement requested

Avro 1.11.3 especially fixes CVE-2023-39410 (https://nvd.nist.gov/vuln/detail/CVE-2023-39410).
The fix limit the size of the stream (reading header) to avoid OOME when a stream is corrupted.
It could happen in Arrow Avro adapter, so I propose to update Avro version. I'm preparing a PR about that.

Component(s)

Java
jbonofre added a commit to jbonofre/arrow that referenced this issue Dec 19, 2023
@jbonofre
apacheGH-39299: [Java] Upgrade to Avro 1.11.3
11204a6
@github-actions github-actions bot mentioned this issue Dec 19, 2023
Merged
lidavidm pushed a commit that referenced this issue Dec 19, 2023
@jbonofre
GH-39299: [Java] Upgrade to Avro 1.11.3 (#39300)
b862b16 
### Rationale for this change

Upgrade to Avro 1.11.3 to fix CVE-2023-39410

### What changes are included in this PR?

Upgrade to Avro 1.11.3

### Are these changes tested?

Run local tests especially on Avro adapter

### Are there any user-facing changes?

Not directly

* Closes: #39299

Authored-by: JB Onofré <jbonofre@apache.org>
Signed-off-by: David Li <li.davidm96@gmail.com>
@lidavidm lidavidm added this to the 15.0.0 milestone Dec 19, 2023
clayburn pushed a commit to clayburn/arrow that referenced this issue Jan 23, 2024
@jbonofre @clayburn
apacheGH-39299: [Java] Upgrade to Avro 1.11.3 (apache#39300)
2ae8961 
### Rationale for this change

Upgrade to Avro 1.11.3 to fix CVE-2023-39410

### What changes are included in this PR?

Upgrade to Avro 1.11.3

### Are these changes tested?

Run local tests especially on Avro adapter

### Are there any user-facing changes?

Not directly

* Closes: apache#39299

Authored-by: JB Onofré <jbonofre@apache.org>
Signed-off-by: David Li <li.davidm96@gmail.com>
dgreiss pushed a commit to dgreiss/arrow that referenced this issue Feb 19, 2024
@jbonofre @dgreiss
apacheGH-39299: [Java] Upgrade to Avro 1.11.3 (apache#39300)
7d83518 
### Rationale for this change

Upgrade to Avro 1.11.3 to fix CVE-2023-39410

### What changes are included in this PR?

Upgrade to Avro 1.11.3

### Are these changes tested?

Run local tests especially on Avro adapter

### Are there any user-facing changes?

Not directly

* Closes: apache#39299

Authored-by: JB Onofré <jbonofre@apache.org>
Signed-off-by: David Li <li.davidm96@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jbonofre jbonofre

Labels
Component: Java Type: enhancement
Projects
None yet
Milestone
15.0.0
Development

Successfully merging a pull request may close this issue.

GH-39299: [Java] Upgrade to Avro 1.11.3 jbonofre/arrow
2 participants
@jbonofre @lidavidm