Parquet
Monthly
Apache Parquet Hadoop's envelope encryption subsystem (org.apache.parquet.crypto.keytools, versions 1.12-1.18.0) can leak KMS authentication tokens to an attacker-controlled endpoint when a crafted Parquet file embeds a malicious KMS URL and the reader application relies on file-controlled URL resolution. The pluggable KmsClient receives the file-embedded URL without host validation, allowing a file author to silently redirect KMS token requests to an arbitrary server. No public exploit has been identified at time of analysis; the fix ships in version 1.18.1, which disables file-controlled KMS URLs by default.
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Parquet Hadoop's envelope encryption subsystem (org.apache.parquet.crypto.keytools, versions 1.12-1.18.0) can leak KMS authentication tokens to an attacker-controlled endpoint when a crafted Parquet file embeds a malicious KMS URL and the reader application relies on file-controlled URL resolution. The pluggable KmsClient receives the file-embedded URL without host validation, allowing a file author to silently redirect KMS token requests to an arbitrary server. No public exploit has been identified at time of analysis; the fix ships in version 1.18.1, which disables file-controlled KMS URLs by default.
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.