CVE-2022-23974: Logic error in Apache Pinot
Summary
CVE-2022-23974: Logic error in Apache Pinot. Affects org.apache.pinot:pinot versions < 0.10.0. Fixed in 0.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Pinot is an open-source distributed columnar data store used for real-time analytics. It provides low-latency querying and scalable data ingestion capabilities. Pinot allows users to import segment directories into Pinot tables. However, versions 0.9.3 and older have a logic error in the segment upload path, which can be exploited in Pinot installations with open access to the controller.
Vulnerability Detail
The logic error in Apache Pinot allows for a specially crafted request to disrupt the Pinot service. An attacker can exploit this vulnerability to cause disruption or potentially execute arbitrary code. Pinot release 0.10.0 fixes this vulnerability.
How To Fix
Minimum fixed version
0.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to Apache Pinot 0.10.0 or newer.
Conclusion
Apache Pinot versions 0.9.3 and older are vulnerable to a logic error that can be exploited to disrupt the Pinot service. It is crucial to upgrade to Apache Pinot 0.10.0 or newer to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.pinot:pinot →
FAQ
Apache Pinot is an open-source distributed columnar data store used for real-time analytics. It provides low-latency querying and scalable data ingestion capabilities.
Versions 0.9.3 and older of Apache Pinot are affected by this vulnerability.
This vulnerability can be exploited to cause disruption in Pinot service or potentially execute arbitrary code.
Upgrade to Apache Pinot version 0.10.0 or newer to fix this vulnerability.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pinot:pinot.
