oss-security - CVE-2025-30065: Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <042ceaf8-642e-e59f-f891-ffa07e21c86d@apache.org>
Date: Tue, 01 Apr 2025 02:03:07 +0000
From: Gang Wu <gangwu@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-30065: Apache Parquet Java: Arbitrary code execution in
 the parquet-avro module when reading an Avro schema from a Parquet file
 metadata 

Affected versions:

- Apache Parquet Java through 1.15.0

Description:

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code


Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Credit:

Keyi Li (Amazon) (finder)

References:

https://lists.apache.org/thread/okzqb3kn479gqzxm21gg5vqr35om9gw5
https://parquet.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-30065

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.