Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()

Apache Thrift: C++ THeaderTransport::transform() heap buffer overflow (write direction)

Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Thrift: C++ JSON OOB read

Apache Thrift: cglib TLS Client Missing Hostname Verification

Improper validation of the filepath argument in tgogenerator.cc:formatgooutput() of the Apache Thrift Go client library can allow an attacker to execute arbitrary commands.

The filepath parameter is derived from the service name. If an attacker can provide a service name to a framework invoking Thrift, the attacker could craft the name in a way leading to arbitrary commands being executed.

This affects versions before Apache Thrift 0.10.0.

Upstream Advisory:

http://mail-archives.apache.org/modmbox/thrift-user/201701.mbox/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E

Upstream Issue:

https://issues.apache.org/jira/browse/THRIFT-3893

Upstream Commit:

https://github.com/apache/thrift/commit/2007783e874d524a46b818598a45078448ecc53e

Apache Thrift: Node.js skip() recursion

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass

Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Thrift: C++ THeaderTransport::writeVarint32() stack buffer overflow on a negative protocol id

Apache Thrift: Dart TBinaryProtocol.readMessageBegin allocates from the pre-versioned name length

Apache Thrift: PHP thriftprotocol accelerator: zero-byte container elements

Apache Thrift: C++ THeaderTransport::untransform() leaks the zlib stream on the error path

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)

Apache Thrift: PHP TSimpleServer exits the whole process on any non-transport exception

Apache Thrift: nodejs web server: no error listener on an upgraded WebSocket connection

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer.

This issue affects Apache Thrift: before 0.25.0.

Users are recommended to upgrade to version 0.25.0, which fixes the issue.

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Container element count not bounded by the bytes available

Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service

Apache Thrift: PHP thriftprotocol accelerator dereferences a missing container-element spec

Apache Thrift: Node.js server.js ends the process on any per-connection error (+ two triggers)

Apache Thrift: Ruby SimpleServer ends serve() on any non-Transport/Protocol exception

Apache Thrift: Lua TFramedTransport/THttpTransport re-slice the buffer on every read (quadratic)

Apache Thrift: cglib multiplexed processor crashes on a message it cannot route

Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)