CVE-2025-46762
Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default setting of trusted packages still allows malicious classes from these packages to be executed. The exploit is only applicable if the client code of parquet-avro uses the "specific" or the "reflect" models deliberately for reading Parquet files. ("generic" model is not impacted) Users are recommended to upgrade to 1.15.2 or set the system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an empty string on 1.15.1. Both are sufficient to fix the issue.
El análisis de esquemas en el módulo parquet-avro de Apache Parquet 1.15.0 y versiones anteriores permite a actores maliciosos ejecutar código arbitrario. Si bien la versión 1.15.1 introdujo una corrección para restringir los paquetes no confiables, la configuración predeterminada de los paquetes confiables aún permite la ejecución de clases maliciosas de estos paquetes. El exploit solo es aplicable si el código cliente de parquet-avro utiliza deliberadamente los modelos "specific" o "reflect" para leer archivos de Parquet. (El modelo "genérico" no se ve afectado). Se recomienda a los usuarios actualizar a la versión 1.15.2 o configurar la propiedad del sistema "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" con una cadena vacía en la versión 1.15.1. Ambas opciones son suficientes para solucionar el problema.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2025-04-29 CVE Reserved
- 2025-05-06 CVE Published
- 2025-05-07 CVE Updated
- 2025-07-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-73: External Control of File Name or Path
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
http://www.openwall.com/lists/oss-security/2025/05/02/1 |
|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://lists.apache.org/thread/t7724lpvl110xsbgqwsmrdsns0rhycdp | 2025-05-06 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Apache Software Foundation Search vendor "Apache Software Foundation" | Apache Parquet Java Search vendor "Apache Software Foundation" for product "Apache Parquet Java" | <= 1.15.1 Search vendor "Apache Software Foundation" for product "Apache Parquet Java" and version " <= 1.15.1" | en |
Affected
|