Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Apache Thrift: C++ WebSocket server transport does not read a full request length
Apache Thrift: C++ TEvhttpServer leaks its RequestContext when the processor throws before calling back
Apache Thrift: Perl TLS client disables certificate verification by default
Apache Thrift: cglib TZlibTransport reports a full read after a premature stream end
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings.
This issue affects Apache Thrift: from 0.19.0 before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
Apache Thrift: Python TSSLSocket Hostname Matcher Import
Apache Thrift: cglib heap out-of-bounds read in transport leftover-bytes path
The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
References:
http://grokbase.com/t/thrift/user/15c2tss3td/notice-apache-thrift-security-vulnerability-cve-2015-1774
Upstream issue:
https://issues.apache.org/jira/browse/THRIFT-3231
Upstream patch:
https://github.com/apache/thrift/commit/cfaadcc4adcfde2a8232c62ec89870b73ef40df1