CVE-2022-23974 Pinot segment push endpoint has a vulnerability in unprotected environments
Attackers can cause service disruption in Apache Pinot via crafted requests if the controller allows open access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23974?
CVE-2022-23974 is a high-severity denial of service vulnerability in Apache Pinot, published on 5 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
Weakness: CWE-674
Which versions are affected by CVE-2022-23974?
2 open source packages ship an affected version, including org.apache.pinot:pinot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.pinot:pinot Maven | All versions | 0.10.0 |
org.apache.pinot:pinot Maven | All versions | 0.10.0 |
Products include Apache Pinot.
How do I fix CVE-2022-23974?
Upgrade org.apache.pinot:pinot to 0.10.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-23974 being exploited?
There is no known exploitation of CVE-2022-23974 in the wild and no public exploit code.
Other vulnerabilities in Apache Pinot
Sources
Also known as GHSA-29f8-q7mf-7cqj.