GHSA-qj9p-jvmw-82rh
Apache Pinot has Groovy Function support enabled by default
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.pinot:pinot | < 0.11.0 | 0.11.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Pinot allows you to run any function using Apache Groovy scripts. In versions prior to 0.10.0, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to groovy function support being enabled by default. This issue has been fixed by making function support disabled by default, in version 0.11.0. A potential workaround is to disable groovy script support.
References
External links from the advisory. They lead to third-party sites.