[MINOR][DOCS] Minor update to example

[CarterFendley]

What changes were proposed in this pull request?

To recommend the latest bug fixed version.

Why are the changes needed?

Release Notes https://github.com/apache/parquet-java/releases/tag/apache-parquet-1.15.1

Does this PR introduce any user-facing change?

No.

How was this patch tested?

Pass GHA.

Was this patch authored or co-authored using generative AI tooling?

No

[CarterFendley]

Based on discussion from #50583

cc: @HyukjinKwon @dongjoon-hyun

[HyukjinKwon]

Let's fix the linter tho.

[dongjoon-hyun]

Given that Apache Parquet 1.15.1 is partial, according to the ASF policy, I'd recommend not to mention this CVE in Apache Spark repository, @CarterFendley .

https://apache.org/security/committers.html#work-in-private

[dongjoon-hyun]

Just a question for my understanding.

• Is this based on the official Apache Parquet community CVE announcement?
• If then, could you provide the Apache Parquet Security website link in this PR description, @CarterFendley ?

Dismissed per Dongjoon's comment.

dismiss

[CarterFendley]

Hey sorry, just getting back to this now after a busy week. Apologies for the delay, thanks for all the comments.

@dongjoon-hyun I am a little confused. The CVE has been publicly announced on April 1st, the work done to patch the parquet-java package was done in private in March. Would you still like me to remove mention of the CVE even though it is public now? Just want to make sure.

With respect to this:

Is this based on the official Apache Parquet community CVE announcement?

No, there are some threads on the community mailing list but this just in reaction to the CVE announcement.

[CarterFendley]

@HyukjinKwon Will fix the linter after I get the final word on what should be done with regards to the mention of the CVE or not 🫡

[dongjoon-hyun]

@CarterFendley To be correct here, I get a chance to double-check the Parquet community mailing lists Today again. Here is the update as of now.

• 2025-03-21: The Apache Parquet community announced CVE-2025-30065: Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata.

• 2025-04-01: CVE has been publicly announced on April 1st.

• 2025-04-07: There was another on-going activity in private@parquet about the above patch. I cannot expose the title of the discussion threads here. However, IIUC, Apache Parquet community is preparing another release. That's the meaning when I said Parquet 1.15.1 is partial.

BTW, this PR looks a little misleading to me because we don't want to re-iterate all library CVEs announcement in Apache Spark documentation. Especially, when it's unable to affect Spark users. So, I can give +1 if you remove the CVE ID from this PR as I recommended. I believe that recommending new Parquet would be enough and sufficient in Apache Spark user perspective.

[CarterFendley]

@dongjoon-hyun That is helpful context, and makes a lot more sense. I am not on many of those mailing lists so that is helpful to know. Thank you!

Especially, when it's unable to affect Spark users.

I am not sure about this. In the general case, yes I agree as stated on previous PRs. However with respect to this specific example, if the example is followed directly with a vulnerable version of the parquet-avro module, I believe it will lead users of Spark who are following it to be vulnerable.

The AvroParquetInputFormat class which this example is instructing users to supply is a part of the vulnerable module. And it appears to be connected to the vulnerable code (AvroParquetInputFormat > AvroReadSupport > AvroRecordConverter > FieldStringableConverter). As this is your area of expertise, not mine, please let me know if I have made a mistake here.

I will remove mention of the CVE due to the other considerations mentioned above, the context you provided me made sense!

[dongjoon-hyun]

Thank you for removing the ID. I also revised the PR description by removing the ID.

[dongjoon-hyun]

Merged to master/4.0 for Apache Spark 4.0.0.

[CarterFendley]

@dongjoon-hyun Sure thing, happy to help! I appreciate your feedback!

Thanks for all you do!

[dongjoon-hyun]

Thank you for your efforts, @CarterFendley .

For the record, Apache Parquet 1.15.2 RC0 vote started.

• [VOTE] Release Apache Parquet Java 1.15.2 RC0