In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See https://docs.pinot.apache.org/basics/releases/0.11.0
References
Link | Resource |
---|---|
https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h | Mailing List Patch Third Party Advisory |
Configurations
History
26 Sep 2022, 17:22
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
References | (CONFIRM) https://lists.apache.org/thread/4pb0r12s2b68d78llk04yd8rh3qk5t9h - Mailing List, Patch, Third Party Advisory | |
CWE | NVD-CWE-noinfo | |
CPE | cpe:2.3:a:apache:pinot:*:*:*:*:*:*:*:* | |
First Time |
Apache
Apache pinot |
23 Sep 2022, 08:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-09-23 08:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-26112
Mitre link : CVE-2022-26112
CVE.ORG link : CVE-2022-26112
JSON object : View
Products Affected
apache
- pinot
CWE