Vulnerabilities

TI-2022-16548 CVE-2022-36125 · GHSA-3w5g-989p-35r8

Integer overflow when reading corrupted .avro file in Avro Rust SDK

MEDIUM 42

It is possible to crash (panic) an application by providing a corrupted data to be read.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01589 Published 2022-08-09 Fixed in 0.14.0 CWE-20

TI-2022-16547 CVE-2022-36124 · GHSA-wcm8-86x6-8mv3

MEDIUM 42

It is possible for a Reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01553 Published 2022-08-09 Fixed in 0.14.0 CWE-770

TI-2022-16171 CVE-2022-35724 · GHSA-v456-chpw-6mmw

LOW 36

It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01822 Published 2022-08-09 Fixed in 0.14.0 CWE-20