Apache Parquet Avro Schema Parsing Arbitrary Code Execution Vulnerability

A vulnerability in the parquet-avro module of Apache Parquet in versions through 1.15.1 allows for arbitrary code execution. This issue arises during schema parsing when the 'specific' or 'reflect' models are used to read Parquet files, as the 'generic' model is not affected. While version 1.15.1 attempted to address this vulnerability by restricting untrusted packages, the default trusted package settings still permit the execution of malicious classes from those packages.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code within the application using the affected Parquet library.

Remediation

Users are advised to upgrade to Apache Parquet version 1.15.2. Alternatively, for those using version 1.15.1, the system property 'org.apache.parquet.avro.SERIALIZABLE_PACKAGES' can be set to an empty string to mitigate the issue.