Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN280

_____________________________________________________________________

DATE                : 06/05/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Parquet Java versions
                                 prior to 1.15.2.

=====================================================================
https://lists.apache.org/thread/t7724lpvl110xsbgqwsmrdsns0rhycdp
_____________________________________________________________________

CVE-2025-46762: Apache Parquet Java: Potential malicious code
execution from trusted packages in the parquet-avro module when
reading an Avro schema from a Parquet file metadata

Affected versions:

- Apache Parquet Java through 1.15.1


Description:

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0
and previous versions allows bad actors to execute arbitrary code.

While 1.15.1 introduced a fix to restrict untrusted packages, the
default setting of trusted packages still allows malicious classes
from these packages to be executed.

The exploit is only applicable if the client code of parquet-avro
uses the "specific" or the "reflect" models deliberately for
reading Parquet files. ("generic" model is not impacted)

Users are recommended to upgrade to 1.15.2 or set the system
property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES" to an
empty string on 1.15.1. Both are sufficient to fix the issue.


Credit:

Andrew Pikler (reporter)
David Handermann (reporter)
Nándor Kollár (reporter)


References:

https://lists.apache.org/thread/vr1h7dnr4jp2f1xhzzkwzcw49qgfgsyl
https://parquet.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-46762


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================