Apache Parquet

Question

@RandallWilliams ; the Trust Site is showing this CVE as "Esri Assessment & Response:
Component not present" ; but Tenable is scanning the jar files in the Pro installation folder and returning this:

Plugin Output:

Path              : C:\Program Files\ArcGIS\Pro\java\runtime\spark\jars\parquet-column-1.13.1.jar

Installed version : 1.13.1

Fixed version     : 1.15.1

Path              : C:\Program Files\ArcGIS\Pro\java\runtime\spark\jars\parquet-common-1.13.1.jar

Installed version : 1.13.1

Fixed version     : 1.15.1

Path              : C:\Program Files\ArcGIS\Pro\java\runtime\spark\jars\parquet-encoding-1.13.1.jar

Installed version : 1.13.1

Fixed version     : 1.15.1

Path              : C:\Program Files\ArcGIS\Pro\java\runtime\spark\jars\parquet-hadoop-1.13.1.jar

Installed version : 1.13.1

Fixed version     : 1.15.1

RandallWilliams · Answer

Hi,

I'd argue that there is a bug in your tooling.

This finding as against the parquet-avro module, which is not in the list of JARS the tool you've provided.

TKSHEP · Answer

We got it on server, do you have an update for this?

Description: The version of Apache Parquet on the remote host is prior to 1.15.1. It is, therefore, affected by a remote code execution vulnerability:

* Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue. (CVE-2025-30065)

**************
Plugin Title: Apache Parquet < 1.15.1 Remote Code Execution (CVE-2025-30065)

**************
Plugin Output:

* Path : C:\Program Files\ArcGIS\Server\framework\runtime\spark\jars\parquet-hadoop-1.13.1.jar
* Installed version : 1.13.1
* Fixed version : 1.15.1

* Path : C:\Program Files\ArcGIS\Server\framework\runtime\spark\jars\parquet-encoding-1.13.1.jar
* Installed version : 1.13.1
* Fixed version : 1.15.1

* Path : C:\Program Files\ArcGIS\Server\framework\runtime\spark\jars\parquet-column-1.13.1.jar
* Installed version : 1.13.1
* Fixed version : 1.15.1

* Path : C:\Program Files\ArcGIS\Server\framework\runtime\spark\jars\parquet-common-1.13.1.jar
* Installed version : 1.13.1
* Fixed version : 1.15.1
**************
CVE(s): CVE-2025-30065

dewright_ca · Answer

Thank you for the additional detail; I have forwarded this thread to my security team.