What is GHSA-29f8-q7mf-7cqj?

GHSA-29f8-q7mf-7cqj is a security advisory published by GitHub Security Advisories with High severity. Logic error in Apache Pinot

Which CVE IDs does GHSA-29f8-q7mf-7cqj cover?

GHSA-29f8-q7mf-7cqj covers the following CVE IDs: CVE-2022-23974. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-29f8-q7mf-7cqj?

GHSA-29f8-q7mf-7cqj has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-29f8-q7mf-7cqj?

GHSA-29f8-q7mf-7cqj affects 1 product, including: maven/org.apache.pinot:pinot:\u003c 0.10.0.

GHSA-29f8-q7mf-7cqjHighCVSS 7.5

Logic error in Apache Pinot

Vendor

GitHub Security Advisories

Published

April 6, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-23974 →

📋 Description

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0

🎯 Affected products1

maven/org.apache.pinot:pinot:< 0.10.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2022-23974
https://lists.apache.org/thread/3dk8pf1n02p8oj2j3czbtchyjsf8khwr
https://github.com/apache/pinot/pull/7969
https://docs.pinot.apache.org/basics/releases/0.10.0
https://github.com/advisories/GHSA-29f8-q7mf-7cqj