{"id":20225,"date":"2026-09-09T20:32:02","date_gmt":"2026-09-09T12:32:02","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-73334"},"modified":"2026-09-09T20:32:02","modified_gmt":"2026-09-09T12:32:02","slug":"cve-2026-73334","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-73334","title":{"rendered":"CVE-2026-73334 &#8211; Potential problem for users of the\u00a0org.apache.parquet.crypto.keytools package in Apache Pa"},"content":{"rendered":"<p>Potential problem for users of the\u00a0org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18.<br \/>\nThis package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps (encrypts) data keys via a Key Management Service (KMS).\u00a0<br \/>\nOn the reader side, the KMS URL can be application-controlled or file-controlled.<br \/>\nIf the user does not leverage application control for this parameter, a file-controlled KMS URL is forwarded to a pluggable KmsClient implementation.<br \/>\nIf the pluggable implementation does not perform host validation, a KMS token can be sent to a malicious host set by an attacker in the file.<\/p>\n<p>Before the problem is fixed, users are recommended to\u00a0leverage application control for KMS URL parameter in readers (versions 1.12-1.18).<br \/>\nAfter the problem is fixed (presumably in version 1.19), the upgrade will disable file-controlled KMS URL by default. Users of the KMS URL parameter\u00a0<br \/>\nwill have two options then:\u00a0leverage application control for KMS URL parameter in readers, or enable file-controlled\u00a0KMS URL (via a new app parameter).<br \/>\nThe latter option will explicitly require (in the new parameter documentation) to validate the KMS URL and use authentication in the custom implementation of the KMS client plug in.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Potential problem for users of the\u00a0org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18.<br \/>\nThis package enables users to encrypt Parquet files via an envelope encryption <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-20225","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/20225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=20225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=20225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=20225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}