Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.apache.calcite.avatica:avatica-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8MavenPublished

    Apache Calcite Avatica JDBC driver arbitrary code execution

    CVE-2022-36364 · GHSA-w7f5-jrpr-5c2m

    Affected
    • Maven org.apache.calcite.avatica:avatica-core < 1.22.0
    Fixed in
    1.22.0· Vendor fix available
    Issue
    Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via httpclientimpl connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary classes and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor with URL parameter and ability to execute code) in the classpath. From Apache Calcite Avatica 1.22.0 onwards, it will be verified that the class implements the expected interface before invoking its constructor.

    Recommended action: Upgrade to 1.22.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →