Critical Apache Roller flaw allows to retain unauthorized access even after a password change

A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the user themselves or by an administrator, existing sessions remain active and usable. This allows continued access to the application through old sessions even after password changes, potentially enabling unauthorized access if credentials were compromised. This issue affects Apache Roller versions up to and including 6.1.4. The vulnerability is fixed in Apache Roller 6.1.5 by implementing centralized session management that properly invalidates all active sessions when passwords are changed or users are disabled.

The parquet-avro module of Apache Parquet Java, versions 1.15.0 and all earlier versions, contains a flaw (CWE-502, deserialization of untrusted data) in how it parses Avro schemas embedded in Parquet files, which allows arbitrary code execution. It is triggered when a vulnerable application reads a Parquet file whose embedded Avro schema is attacker-controlled, for example a file uploaded to a data pipeline or fetched from partially trusted storage. An attacker gains arbitrary code execution in the context of the process reading the file, with high impact on confidentiality, integrity and availability (CVSS 4.0 base score of 10.0, no privileges or user interaction required). Any application or data platform using parquet-avro through 1.15.0 to ingest Parquet files is affected, including big-data frameworks and custom ETL jobs that bundle the Java library. There is no confirmed in-the-wild exploitation yet (not in CISA KEV), but a public proof of concept exists, public scanning/exploit tooling has been released, and EPSS assigns a 43.6% probability of exploitation within 30 days (99th percentile).

Do: Upgrade the parquet-avro dependency (and any bundled Parquet Java library) to version 1.15.1 immediately, including in Spark, Hive, Flink, Kafka Connect and custom ETL images that pull it in transitively. Until patched, only parse Parquet files from fully trusted sources and review whether externally supplied or user-uploaded Parquet files reach vulnerable code paths. Audit dependency trees for parquet-avro versions 1.15.0 or earlier and use the publicly released scanning tooling to locate affected servers.