Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
Apache Thrift: C++ JSON OOB read
Apache Thrift: cglib TLS Client Missing Hostname Verification
Improper validation of the filepath argument in tgogenerator.cc:formatgooutput() of the Apache Thrift Go client library can allow an attacker to execute arbitrary commands.
The filepath parameter is derived from the service name. If an attacker can provide a service name to a framework invoking Thrift, the attacker could craft the name in a way leading to arbitrary commands being executed.
This affects versions before Apache Thrift 0.10.0.
Upstream Advisory:
http://mail-archives.apache.org/modmbox/thrift-user/201701.mbox/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E
Upstream Issue:
https://issues.apache.org/jira/browse/THRIFT-3893
Upstream Commit:
https://github.com/apache/thrift/commit/2007783e874d524a46b818598a45078448ecc53e
Apache Thrift: Node.js skip() recursion
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass
Out-of-bounds Read vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
A flaw was found in Apache Thrift up to and including 0.12.0. A server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed by THRIFT-4024 in version 0.11.0, depending on the installed version it affects only certain language bindings.
References:
https://seclists.org/oss-sec/2019/q4/28
Apache Thrift: Swift Compact Protocol integer overflow
Apache Thrift: cglib dispatch stack overflow
Apache Thrift: Go TFramedTransport uint32 overflow
Apache Thrift: Specially crafted input can crash a cglib Thrift server with invalid pointer error.
Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
A flaw was found in Apache Thrift versions 0.9.3 to 0.12.0. A server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
References:
https://seclists.org/oss-sec/2019/q4/29
Apache Thrift is vulnerable to a denial of service, caused by improper input validation. By sending specially-crafted messages, a remote attacker could exploit this vulnerability to cause a large memory allocation.
Apache Thrift Java client library versions 0.5.0 prior to 0.9.3-1 and 0.10.0 prior to 0.12.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Apache Thrift: Java TSSLTransportFactory hostname verification
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability in Apache Thrift.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.