CVE-2019-0210GHSA-JQ7P-26H5-W78RGO-2021-0101
In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid inp
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.13.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
Timeline
- CVE published
- Record last updated
Affected versions
- Apache Apache Thrift
0.9.3 to 0.12.0
- github.com/apache/thriftGo
From 0.9.3 · fixed in 0.13.0
- github.com/apache/thriftGo
From 0.0.0-20151001171628-53dd39833a08 · fixed in 0.13.0
References 11
access.redhat.com
lists.apache.org
- thread.html/r55609613abab203a1f2c1f3de050b63ae8f5c4a024df0d848d6915ff@<commits.pulsar.apache.org>
- thread.html/rab740e5c70424ef79fd095a4b076e752109aeee41c4256c2e5e5e142@<commits.pulsar.apache.org>
- thread.html/r2832722c31d78bef7526e2c701ba4b046736e4c851473194a247392f@<commits.pulsar.apache.org>
- thread.html/r36581cc7047f007dd6aadbdd34e18545ec2c1eb7ccdae6dd47a877a9@<commits.pulsar.apache.org>