OESA-2021-1017

Dashboard / Vulnerabilities / OESA-2021-1017

OESA-2021-1017

Summary: thrift security update

Details: The Apache Thrift software framework for cross-language services development combines a software stack with a code generation engine to build services that work efficiently and seamlessly between C++, Java, Python, and other languages.\r\n\r\n Security Fix(es):\r\n\r\n In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.(CVE-2019-0205)\r\n\r\n In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.(CVE-2019-0210)\r\n\r\n

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1017, https://nvd.nist.gov/vuln/detail/CVE-2019-0205, https://nvd.nist.gov/vuln/detail/CVE-2019-0210