critical9.8
CVE-2022-26112
Apache Pinot has Groovy Function support enabled by default
Impact
Pinot allows you to run any function using Apache Groovy scripts. In versions prior to 0.10.0, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to groovy function support being enabled by default. This issue has been fixed by making function support disabled by default, in version 0.11.0. A potential workaround is to disable groovy script support.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.pinot:pinot | < 0.11.0 | 0.11.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Pinot | before 0.11.0 |