REDHAT-BUG-1462783: Medium severity apache thrift vulnerability
The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
References:
http://grokbase.com/t/thrift/user/15c2tss3td/notice-apache-thrift-security-vulnerability-cve-2015-1774
Upstream issue:
https://issues.apache.org/jira/browse/THRIFT-3231
Upstream patch:
https://github.com/apache/thrift/commit/cfaadcc4adcfde2a8232c62ec89870b73ef40df1
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1462783?
REDHAT-BUG-1462783 is classified as a critical vulnerability that can lead to denial of service due to infinite recursion.
How do I fix REDHAT-BUG-1462783?
To mitigate REDHAT-BUG-1462783, update Apache Thrift to version 0.9.3 or later.
Who is affected by REDHAT-BUG-1462783?
Users of Apache Thrift versions prior to 0.9.3 are affected by REDHAT-BUG-1462783.
What impact does REDHAT-BUG-1462783 have?
The impact of REDHAT-BUG-1462783 is a potential denial of service that can occur with specially crafted input.
Is REDHAT-BUG-1462783 a known vulnerability?
Yes, REDHAT-BUG-1462783 is a known vulnerability that has been documented and reported by the Apache community.