IT48307: IBM STORAGE INSIGHTS SECURITY APAR FOR CVE-2025-46762

APAR status

• Closed as program error.

Error description

• Filename: parquet-avro-1.12.2.jar
  Artifact ID: parquet-avro
  Group ID: org.apache.parquet
  Name: Apache Parquet Avro
  Version: 1.12.2
  Description: null
  Type: MAVEN_ARTIFACT
  
  
  Mend References (at the time of ADV creation):
  
  https://www.mend.io/vulnerability-database/CVE-2025-46762
  https://issues.apache.org/jira/browse/AVRO-3985
  https://github.com/apache/parquet-java
  
  
  External References (at the time of ADV creation):
  
  CVEs: (details as of the time of ADV creation)
  CVEID: CVE-2025-46762
  Description: Schema parsing in the parquet-avro module of Apache
  Parquet 1.15.0 and previous versions allows bad actors to
  execute arbitrary code.  While 1.15.1 introduced a fix to
  restrict
  untrusted packages, the default setting of trusted packages
  still
  allows malicious classes from these packages to be executed.
  
  Users are recommended to upgrade to 1.15.2 or set the
  system property "org.apache.parquet.avro.SERIALIZABLE_PACKAGES"
  to an empty string on 1.15.1. Both are sufficient to fix the
  issue.
  
  CWE: CWE-73: External Control of File Name or Path
  CVSS Source: security@apache.org
  CVSS Base Score: 9.8
  CVSS Vector:
  (CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:H/VA:H/SC:L
  /SI:H/SA:H/S:N/RE:M/U:Amber)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  *                                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR:                                           *
  * CVE-2025-46762                                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following release:
  
  IBM Storage Insights 3Q25   [ 54X-IBM-SI ]
  ( release target 3Q 2025 / July )
  
  To protect IBM Storage Insights against emerging
  security vulnerabilities, the service was updated to
  protected against vulnerabilities.
  
  No action is required, there is nothing that you need
  to do following the IBM Storage Insights upgrade.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels