Description
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite.
This issue affects Apache Calcite: from 1.5.0 before 1.42.
Users are recommended to upgrade to version 1.42, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Calcite | 1.5.0 – < 1.42 | 1.42 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | No fix yet | — |
| Wolfi rolling | opensearch-3-discovery-ec2 +2 | 3.8.0-r3 | — |
| Wolfi rolling | opensearch-3-sql | 3.7.0-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.calcite:calcite-core | >= 1.5.0, < 1.42.0 | 1.42.0 | GHSA-c2rv-hwqm-wjpg |
References
- https://lists.apache.org/thread/9s37svo343w5ck1ovh478lkzcqk4949v vendor-advisory