Denial-of-Service Vulnerability in Apache ORC Parser

CVE-2018-8015

What is CVE-2018-8015?

In Apache ORC versions 1.0.0 to 1.4.3, a vulnerability exists in the parsing of malformed ORC files, which may lead to denial-of-service conditions. Specifically, this issue arises from an endlessly recursive function call in both the C++ and Java parsers. When exploited, the C++ parser can potentially cause stack corruption, leading to a crash of the software that relies on the ORC file parser. It is crucial for users of the affected versions to apply patches and investigate potential impacts on their systems.

References