| <!DOCTYPE HTML> |
| <html lang="en-US"> |
| <head> |
| <meta charset="UTF-8"> |
| <title>Security</title> |
| <meta name="viewport" content="width=device-width,initial-scale=1"> |
| <meta name="generator" content="Jekyll v4.4.1"> |
| <link rel="stylesheet" href="//fonts.googleapis.com/css?family=Lato:300,300italic,400,400italic,700,700italic,900"> |
| <link rel="stylesheet" href="/css/screen.css"> |
| <link rel="icon" type="image/x-icon" href="/favicon.ico"> |
| <!--[if lt IE 9]> |
| <script src="/js/html5shiv.min.js"></script> |
| <script src="/js/respond.min.js"></script> |
| <![endif]--> |
| <!-- Matomo --> |
| <script> |
| var _paq = window._paq = window._paq || []; |
| /* tracker methods like "setCustomDimension" should be called before "trackPageView" */ |
| _paq.push(["setDoNotTrack", true]); |
| _paq.push(["disableCookies"]); |
| _paq.push(['trackPageView']); |
| _paq.push(['enableLinkTracking']); |
| (function() { |
| var u="https://analytics.apache.org/"; |
| _paq.push(['setTrackerUrl', u+'matomo.php']); |
| _paq.push(['setSiteId', '68']); |
| var d=document, g=d.createElement('script'), s=d.getElementsByTagName('script')[0]; |
| g.async=true; g.src=u+'matomo.js'; s.parentNode.insertBefore(g,s); |
| })(); |
| </script> |
| <!-- End Matomo Code --> |
| </head> |
| |
| |
| <body class="wrap"> |
| <header role="banner"> |
| <nav class="mobile-nav show-on-mobiles"> |
| <ul> |
| <li class=""> |
| <a href="/">Home</a> |
| </li> |
| <li class=""> |
| <a href="/releases/"><span class="show-on-mobiles">Rel</span> |
| <span class="hide-on-mobiles">Releases</span></a> |
| </li> |
| <li class=""> |
| <a href="/docs/"><span class="show-on-mobiles">Doc</span> |
| <span class="hide-on-mobiles">Documentation</span></a> |
| </li> |
| <li class=""> |
| <a href="/talks/"><span class="show-on-mobiles">Talk</span> |
| <span class="hide-on-mobiles">Talks</span></a> |
| </li> |
| <li class=""> |
| <a href="/news/">News</a> |
| </li> |
| <li class=""> |
| <a href="/develop/"><span class="show-on-mobiles">Dev</span> |
| <span class="hide-on-mobiles">Develop</span></a> |
| </li> |
| <li class=""> |
| <a href="/help/">Help</a> |
| </li> |
| </ul> |
| |
| </nav> |
| <div class="grid"> |
| <div class="unit one-quarter center-on-mobiles"> |
| <h1> |
| <a href="/"> |
| <span class="sr-only">Apache ORC</span> |
| <img src="/img/logo.png" width="249" height="101" alt="ORC Logo"> |
| </a> |
| </h1> |
| </div> |
| <nav class="main-nav unit three-quarters hide-on-mobiles"> |
| <ul> |
| <li class=""> |
| <a href="/">Home</a> |
| </li> |
| <li class=""> |
| <a href="/releases/"><span class="show-on-mobiles">Rel</span> |
| <span class="hide-on-mobiles">Releases</span></a> |
| </li> |
| <li class=""> |
| <a href="/docs/"><span class="show-on-mobiles">Doc</span> |
| <span class="hide-on-mobiles">Documentation</span></a> |
| </li> |
| <li class=""> |
| <a href="/talks/"><span class="show-on-mobiles">Talk</span> |
| <span class="hide-on-mobiles">Talks</span></a> |
| </li> |
| <li class=""> |
| <a href="/news/">News</a> |
| </li> |
| <li class=""> |
| <a href="/develop/"><span class="show-on-mobiles">Dev</span> |
| <span class="hide-on-mobiles">Develop</span></a> |
| </li> |
| <li class=""> |
| <a href="/help/">Help</a> |
| </li> |
| </ul> |
| |
| </nav> |
| </div> |
| </header> |
| |
| |
| <section class="standalone"> |
| <div class="grid"> |
| |
| <div class="unit whole"> |
| <article> |
| <h1>Security</h1> |
| <p>Apache ORC is a library rather than an execution framework and thus |
| is less likely to have security vulnerabilities. However, if you have |
| discovered one, please follow the process below.</p> |
| |
| <h2 id="threat-model">Threat Model</h2> |
| |
| <p>We align our threat model with other foundational data format libraries like <a href="https://arrow.apache.org/docs/dev/format/Security.html">Apache Arrow</a>. When evaluating potential security vulnerabilities, especially those discovered via fuzzing tools, we apply the following principles to distinguish between normal robustness bugs and actual security vulnerabilities.</p> |
| |
| <h3 id="1-trusted-vs-untrusted-data-boundaries">1. Trusted vs. Untrusted Data Boundaries</h3> |
| |
| <p>Apache ORC is a low-level format library designed to read and write data from trusted storage systems (e.g., internal data lakes, HDFS, S3). The parsing APIs assume that the underlying data originates from a trusted internal source.</p> |
| |
| <p>If an attacker is able to write arbitrary, maliciously crafted ORC files into your internal storage, the system is already compromised at the infrastructure or access control level (e.g., IAM permissions, API gateways). The <code class="language-plaintext highlighter-rouge">orc</code> library itself is not the appropriate security boundary to defend against compromised storage infrastructure.</p> |
| |
| <h3 id="2-robustness-issues-vs-security-vulnerabilities">2. Robustness Issues vs. Security Vulnerabilities</h3> |
| |
| <p>A crash, Out-Of-Memory (OOM), Out-Of-Bounds (OOB) read, or assertion failure caused by feeding a maliciously fuzzed file directly into the low-level parser is considered a <strong>robustness issue</strong> (a regular software bug), not a security vulnerability.</p> |
| |
| <p>Such issues are only treated as security vulnerabilities (CVEs) if they:</p> |
| <ul> |
| <li>Lead to Remote Code Execution (RCE).</li> |
| <li>Bypass a defined security boundary or cause cross-tenant data leakage.</li> |
| <li>Occur in a server component explicitly designed to process unverified, external data.</li> |
| </ul> |
| |
| <p>Missing bounds checks or crashes during the parsing of malformed files do not typically lead to code execution or break isolation sandboxes. They are treated as regular software defects.</p> |
| |
| <h3 id="3-responsibilities-of-the-low-level-library">3. Responsibilities of the Low-Level Library</h3> |
| |
| <p>The primary goal of a low-level serialization/deserialization library like ORC is high performance. Mandating strict defensive programming and validation on every internal memory operation would severely degrade performance.</p> |
| |
| <p>Security validation and sanitization of untrusted inputs should occur at the data ingestion layer (e.g., before data is admitted into the data lake). It is outside the scope of the format parser to proactively defend against all possible artificially corrupted bits.</p> |
| |
| <h2 id="reporting-a-vulnerability">Reporting a Vulnerability</h2> |
| |
| <p>We strongly encourage folks to report security vulnerabilities to our |
| private security mailing list first, before disclosing them in a |
| public forum.</p> |
| |
| <p>Please note that the security mailing list should only be used for |
| reporting undisclosed security vulnerabilities in Apache ORC and |
| managing the process of fixing such vulnerabilities. We cannot accept |
| regular bug reports or other security related queries at this |
| address. All mail sent to this address that does not relate to an |
| undisclosed security problem in Apache ORC will be ignored.</p> |
| |
| <p>The ORC security mailing list address is: |
| <a href="mailto:security@orc.apache.org">security@orc.apache.org</a>. |
| This is a private mailing list and only members of the ORC project |
| are subscribed.</p> |
| |
| <p>Please note that we do not use a team GnuPG key. If you wish to |
| encrypt your e-mail to security@orc.apache.org then please use the GnuPG |
| keys from <a href="https://dist.apache.org/repos/dist/release/orc/KEYS">ORC GPG keys</a> for |
| the members of the |
| <a href="https://people.apache.org/phonebook.html?ctte=orc">ORC PMC</a>.</p> |
| |
| <h2 id="vulnerability-handling">Vulnerability Handling</h2> |
| |
| <p>An overview of the vulnerability handling process is:</p> |
| |
| <ul> |
| <li>The reporter sends email to the project privately.</li> |
| <li>The project works privately with the reporter to resolve the vulnerability.</li> |
| <li>The project releases a new version that includes the fix.</li> |
| <li>The vulnerability is publicly announced via a <a href="https://cve.mitre.org/">CVE</a> to the mailing lists and the original reporter.</li> |
| </ul> |
| |
| <p>The full process can be found on the |
| <a href="https://www.apache.org/security/committers.html#vulnerability-handling">Apache Security Process</a> page.</p> |
| |
| <h2 id="fixed-cves">Fixed CVEs</h2> |
| |
| <ul> |
| <li><a href="CVE-2018-8015">CVE-2018-8015</a> - ORC files with malformed types cause stack overflow.</li> |
| <li><a href="CVE-2025-47436">CVE-2025-47436</a> - Potential Heap Buffer Overflow during C++ LZO Decompression</li> |
| </ul> |
| |
| </article> |
| </div> |
| |
| <div class="clear"></div> |
| |
| </div> |
| </section> |
| |
| |
| <footer role="contentinfo"> |
| <p style="margin-left: 20px; margin-right; 20px; text-align: center">The contents of this website are © 2026 |
| <a href="https://www.apache.org/">Apache Software Foundation</a> |
| under the terms of the <a |
| href="https://www.apache.org/licenses/LICENSE-2.0.html"> |
| Apache License v2</a>. Apache ORC and its logo are trademarks |
| of the Apache Software Foundation.</p> |
| </footer> |
| |
| <script> |
| var anchorForId = function (id) { |
| var anchor = document.createElement("a"); |
| anchor.className = "header-link"; |
| anchor.href = "#" + id; |
| anchor.innerHTML = "<span class=\"sr-only\">Permalink</span><i class=\"fa fa-link\"></i>"; |
| anchor.title = "Permalink"; |
| return anchor; |
| }; |
| |
| var linkifyAnchors = function (level, containingElement) { |
| var headers = containingElement.getElementsByTagName("h" + level); |
| for (var h = 0; h < headers.length; h++) { |
| var header = headers[h]; |
| |
| if (typeof header.id !== "undefined" && header.id !== "") { |
| header.appendChild(anchorForId(header.id)); |
| } |
| } |
| }; |
| |
| document.onreadystatechange = function () { |
| if (this.readyState === "complete") { |
| var contentBlock = document.getElementsByClassName("docs")[0] || document.getElementsByClassName("news")[0]; |
| if (!contentBlock) { |
| return; |
| } |
| for (var level = 1; level <= 6; level++) { |
| linkifyAnchors(level, contentBlock); |
| } |
| } |
| }; |
| </script> |
| |
| |
| </body> |
| </html> |
