Vulnerability · Published Jan 6, 2022 · Assigned by apache
CVE-2021-43045Possible DOS vulnerabilities in C# Avro SDK
High 7.5
In plain English
A high-severity resource allocation without limits in Apache Avro from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)3.1%top 12.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | apache.avro | 1.11.0 | GHSA-868x-rg4c-cjqg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Avro | Apache Avro – through 1.10.2 |
Weakness: CWE-770
References
- https://lists.apache.org/thread/5fttw9vk6gd2p3b846nox7hcj5469xfd x_refsource_MISC
- [oss-security] 20220106 CVE-2021-43045: Apache Avro: Possible DOS vulnerabilities in C# Avro SDK mailing-list, x_refsource_MLIST