trino-plugin-hudi

7 results · Clear filters · Feed

• Critical 9.1
  CVE-2025-22871

  Request smuggling due to acceptance of invalid chunked data in net/http

  The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

  Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Packagist Go
  Apr 8, 2025
• Critical 9.5
  CVE-2024-52577

  Apache Ignite: Possible RCE when deserializing incoming messages by the server node

  In Apache Ignite versions from 2.6.0 and before 2.17.0, configured Class Serialization Filters are ignored for some Ignite endpoints. The vulnerability could be exploited if an attacker manually crafts an Ignite message containing a vulnerable object whose cl…

  Apache Software Foundation Apache Ignite trino trino-plugin-opensearch Wolfi Maven
  Feb 14, 2025
• Critical 9.2
  CVE-2024-47561

  Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)

  Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue.

  Apache Software Foundation Apache Avro Java SDK druid trino Wolfi Maven
  Oct 3, 2024
• Critical 10.0
  CVE-2024-32888

  Amazon JDBC Driver for Redshift SQL Injection via line comment generation

  The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is po…

  AWS amazon-redshift-jdbc-driver trino trino-plugin-opensearch Wolfi Maven
  May 15, 2024
• Critical 10.0
  CVE-2024-1597

  pgjdbc SQL Injection via line comment generation

  pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There mu…

  pgjdbc pgjdbc trino trino-plugin-opensearch Debian Ubuntu Alpine Wolfi Maven
  Feb 19, 2024
• Critical 9.8
  CVE-2023-38647

  Apache Helix: Deserialization vulnerability in Helix workflow and REST

  An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remo…

  Apache Software Foundation Apache Helix trino trino-plugin-opensearch Wolfi Maven
  Jul 26, 2023
• Critical 9.8
  CVE-2022-39135

  Apache Calcite: potential XEE attacks

  Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefo…

  Apache Software Foundation Apache Calcite trino trino-plugin-opensearch Wolfi Maven
  Sep 11, 2022