CVE-2022-36125
Assigner: apache
Published: 2022-08-09T06:50:40
State: PUBLISHED
affected: platforms: Rust
product: Apache Avro
vendor: Apache Software Foundation
versions: lessThan: 0.14.0
status: affected
version: unspecified
versionType: custom
credits: value: This issue was reported to the Apache Avro team by Evan Richter at ForAllSecure and found with Mayhem.
descriptions: value: It is possible to crash (panic) an application by providing a corrupted data to be read. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
metrics: other: content: other: important
type: unknown
problemTypes: descriptions: cweId: CWE-20
description: CWE-20 Improper Input Validation
type: CWE
source: discovery: UNKNOWN
title: Integer overflow when reading corrupted .avro file in Avro Rust SDK
x_generator: engine: Vulnogram 0.0.9