oss-security - Apache ORC 1.5.0 and 1.4.4 Released

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAHfHakEnvyeMLZkyTSmWC4k5k9SaVU66NPVuMLWwt_eVU23cuA@mail.gmail.com>
Date: Thu, 17 May 2018 15:10:15 -0700
From: "Owen O'Malley" <owen.omalley@...il.com>
To: user@....apache.org
Cc: Terry Chia <terrycwk1994@...il.com>, security@....apache.org, 
	oss-security@...ts.openwall.com
Subject: Apache ORC 1.5.0 and 1.4.4 Released

All,
   This week we released two releases ORC 1.5.0 and ORC 1.4.4. The 1.5
release adds some great new features:

   - New C++ Writer
   - Support for variable length HDFS blocks
   - CSV to ORC converter
   - Much faster decimal implementation for precision <= 18 digits
   - Support for building C++ library on Microsoft Visual C++.
   - Support for older versions of Hadoop (all of the way back to 2.2.x)

For more details, please see
https://orc.apache.org/news/2018/05/14/ORC-1.5.0/ .

These releases also fix a denial of service vulnerability. Users are
encouraged to update.

# CVE-2018-8015: Apache ORC denial of service vulnerability

## Severity:

Medium

## Vendor:

[The Apache Software Foundation](https://apache.org)

## Versions Affected:

* ORC 1.0.0 to 1.4.3

## Description:

A malformed ORC file can trigger an endlessly recursive function call in the
C++ or Java parser.

The impact of this bug is most likely denial-of-service against software
that
uses the ORC file parser. With the C++ parser, the stack overflow might
possibly corrupt the stack.

## Mitigation:

* 1.3.x and 1.4.x users should upgrade to 1.4.4.
* 1.0.x to 1.2.x users should apply ORC-360 (Java) and ORC-313 (C++).

## Example:

An ORC file with a struct, union, array, or map type that includes itself as
a child will cause the parser to infinitely recurse until the stack
overflows.

## Credit:

This issue was discovered by Terry Chia.

## References:
[Apache ORC security](https://orc.apache.org/security/)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.