Bump Avro to 1.11.4 — CVE-2024-47561

[abhisheknath2011]

Summary

Bumps the root Avro pin in versions.props from 1.11.1 → 1.11.4 to address CVE-2024-47561 (https://www.cve.org/CVERecord?id=CVE-2024-47561) in the Apache Avro Java SDK.

org.slf4j:* = 1.7.36
com.palantir.tritium:* = 0.17.0
-org.apache.avro:avro = 1.11.1
+org.apache.avro:avro = 1.11.4
org.apache.calcite:* = 1.10.0

Why

Apache Avro versions ≤ 1.11.3 are affected by CVE-2024-47561 — a critical-severity deserialization vulnerability in the Avro Java SDK schema parser that allows arbitrary code execution via a maliciously crafted Avro schema. The fix lands in upstream Apache Avro 1.11.4.

Why 1.11.4 (and not 1.11.5)

We evaluated 1.11.5 (the latest patch in the 1.11.x line) and chose to stay on 1.11.4 for this PR.
Reason:

• The only Avro code-level CVE in this round (CVE-2024-47561) is already fully fixed in 1.11.4.
• 1.11.5 is also flagged for CVE-2025-52999 (https://www.cve.org/CVERecord?id=CVE-2025-52999) — a transitive jackson-core stack-overflow vulnerability on deeply nested JSON, fixed in jackson-core 2.15.0+. This CVE affects 1.11.4 and 1.11.5 equally because Avro 1.11.x ships with a pre-2.15.0 jackson-core.
• Bumping Avro to 1.11.5 does not fix CVE-2025-52999. It needs a separate jackson-core upgrade track (and likely also raising the existing OpenHouse force on jackson-bom:2.13.4 → 2.15.0+).

Net: jumping to 1.11.5 for this PR would add no additional security coverage. We land 1.11.4 here and track CVE-2025-52999 as a separate jackson upgrade.

Impact analysis

This PR is step 1 of the publish chain (root-cause fix in the LinkedIn iceberg fork). Subsequent PRs in openhouse and li-openhouse will bump iceberg coordinates and the product-spec to pick up the new Avro transitively.

What changes (transitively)

org.apache.avro:avro is used as a regular classpath dep throughout iceberg-core / iceberg-spark / iceberg-mr / iceberg-flink / iceberg-hive-runtime. The Palantir versions.props plugin propagates this single pin to every org.apache.avro:avro resolution across all modules — no module-level edits required.

I greped the rest of the repo for additional pins; the other org.apache.avro references are exclusion / shading / compile-only declarations (no version coordinate), so this one-line change covers the whole fork.

Risk — LOW

1.11.4 is a patch within the 1.11.x line. Going from 1.11.1 → 1.11.4:

• No public API changes vs 1.11.1 / 1.11.3 — patch releases only.
• Binary-compatible with the rest of the transitive closure (Iceberg, Parquet, Spark).
• No wire/file format changes — Avro container and RPC formats unchanged.
• No Iceberg manifest read/write behavior changes expected.

1.11.4 is already widely deployed at LinkedIn (per the LinkedIn Avro details dashboard), confirming the 1.11.x patch line is production-stable.

Diff between 1.11.1/1.11.3 and 1.11.4

┌──────────────────────┬────────────────────────────────────────────────────────────────┐
│        Aspect        │                     1.11.1/1.11.3 → 1.11.4                     │
├──────────────────────┼────────────────────────────────────────────────────────────────┤
│ Security             │ CVE-2024-47561 fix — schema-parser deserialization RCE patched │
├──────────────────────┼────────────────────────────────────────────────────────────────┤
│ API surface          │ None (patch release)                                           │
├──────────────────────┼────────────────────────────────────────────────────────────────┤
│ Binary compatibility │ Preserved                                                      │
├──────────────────────┼────────────────────────────────────────────────────────────────┤
│ Wire / file format   │ Unchanged                                                      │
└──────────────────────┴────────────────────────────────────────────────────────────────┘

Known residual exposure (out of scope here)

• CVE-2025-52999 (jackson-core stack overflow on deeply nested JSON) — not fixed by this PR. This can be tracked separately as a jackson upgrade.

Additional changes

Avro 1.11.1 -> 1.11.4 changes the return type of
Conversion.toEnumSymbol(T, Schema, LogicalType) from raw GenericEnumSymbol
to parameterized GenericEnumSymbol<?>. This propagates through
org.apache.iceberg.avro.UUIDConversion, which inherits (not overrides) the
method, and revapi flags it as java.method.returnTypeTypeParametersChanged.

The change is binary-compatible (Java generics are erased at the bytecode
level; the class-file signature is unchanged); only the source-level
signature changed. Accept the break with a justification so the build can
proceed.

Revapi acceptance

Avro 1.11.1 → 1.11.4 refines the return type of
Conversion<T>.toEnumSymbol(T, Schema, LogicalType) from raw GenericEnumSymbol
to GenericEnumSymbol<?>. This propagates up through org.apache.iceberg.avro.UUIDConversion
(which inherits, not overrides, the method) and revapi flags it as
java.method.returnTypeTypeParametersChanged.

The change is binary-compatible — Java generics are erased at the bytecode level,
so the class-file signature is unchanged. Only the source-level signature gains the
<?> wildcard.

Accepted in .palantir/revapi.yml with an explicit justification:

    - code: "java.method.returnTypeTypeParametersChanged"
      old: "method org.apache.avro.generic.GenericEnumSymbol org.apache.avro.Conversion<T>::toEnumSymbol(T, org.apache.avro.Schema, org.apache.avro.LogicalType) @ org.apache.iceberg.avro.UUIDConversion"
      new: "method org.apache.avro.generic.GenericEnumSymbol<?> org.apache.avro.Conversion<T>::toEnumSymbol(T, org.apache.avro.Schema, org.apache.avro.LogicalType) @ org.apache.iceberg.avro.UUIDConversion"
      justification: "Avro 1.11.1 -> 1.11.4 (CVE-2024-47561): generic-type-parameter refinement on inherited Avro method (GenericEnumSymbol -> GenericEnumSymbol<?>). Binary-compatible via type erasure; only the source-level signature changed. Iceberg's UUIDConversion does not override this method."

This was the only revapi break reported across 227 tasks. No other API or behavioral changes.

Verification

• versions.props updated and staged.
• CI build green across all iceberg modules.
• ./gradlew :iceberg-core:dependencyInsight --dependency org.apache.avro:avro reports 1.11.4 (and not 1.11.1).
• Avro manifest read/write integration tests pass.