CVE-2020-13949GHSA-G2FG-MR77-6VRMBIT-THRIFT-2020-13949
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potential
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.14.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.
Timeline
- CVE published
- Record last updated
Affected versions
- n/a Apache Thrift
Apache Thrift 0.9.3 to 0.13.0
- org.apache.thrift:libthriftMaven
From 0.9.3 · fixed in 0.14.0
References 25
lists.apache.org
- thread.html/r43dc2b2e928e9d845b07ac075634cb759d91bb852421dc282f87a74a@<dev.thrift.apache.org>
- thread.html/r143ca388b0c83fe659db14be76889d50b453b0ee06f423181f736933@<issues.hbase.apache.org>
- thread.html/r3a1291a7ab8ee43db87cb0253371489810877028fc6e7c68dc640926@<issues.hbase.apache.org>
- thread.html/r27b7d3d95ffa8498899ef1c9de553d469f8fe857640a3f6e58dba640@<issues.hbase.apache.org>
- thread.html/r515e01a30443cfa2dbb355c44c63149869afd684fb7b0344c58fa67b@<issues.hbase.apache.org>
- thread.html/r93f23f74315e009f4fb68ef7fc794dceee42cf87fe6613814dcd8c70@<issues.hbase.apache.org>
- thread.html/rd78cdd87d84499a404202f015f55935db3658bd0983ecec81e6b18c6@<issues.hbase.apache.org>
- thread.html/r3f3e1d562c528b4bafef2dde51f79dd444a4b68ef24920d68068b6f9@<issues.hbase.apache.org>
- thread.html/rd49d53b146d94a7d3a135f6b505589655ffec24ea470e345d31351bb@<issues.hbase.apache.org>
- thread.html/r2d180180f37c2ab5cebd711d080d01d8452efa8ad43c5d9cd7064621@<issues.hbase.apache.org>
- thread.html/r89fdd39965efb7c6d22bc21c286d203252cea476e1782724aca0748e@<user.thrift.apache.org>
- thread.html/rbc5cad06a46d23253a3c819229efedecfc05f89ef53f5fdde77a86d6@<user.thrift.apache.org>
- thread.html/r02f7771863383ae993eb83cdfb70c3cb65a355c913242c850f61f1b8@<issues.hbase.apache.org>
- thread.html/r7ae909438ff5a2ffed9211e6ab0bd926396fd0b1fc33f31a406ee704@<issues.hbase.apache.org>
- thread.html/rf603d25213cfff81d6727c259328846b366fd32a43107637527c9768@<issues.hbase.apache.org>
- thread.html/r6990c849aeafe65366794bfd002febd47b7ffa8cf3c059b400bbb11d@<issues.hbase.apache.org>
- thread.html/r298a25228868ebc0943d56c8f3641212a0962d2dbcf1507d5860038e@<issues.hbase.apache.org>
- thread.html/rf741d08c7e0ab1542c81ea718467422bd01159ed284796a36ad88311@<issues.hbase.apache.org>
- thread.html/r278e96edc4bc13efb2cb1620a73e48f569162b833c6bda3e6ea18b80@<issues.hbase.apache.org>
- thread.html/r421a9a76811c1aed7637b5fe5376ab14c09ccdd7b70d5211d6e76d1e@<issues.hbase.apache.org>
- thread.html/r1fb2d26b81c64ce96c4fd42b9e6842ff315b02c36518213b6c057350@<issues.hbase.apache.org>
- thread.html/r286e9a13d3ab0550042997219101cb87871834b8d5ec293b0c60f009@<issues.hbase.apache.org>
- thread.html/r117d5d2b08d505b69558a2a31b0a1cf8990cd0385060b147e70e76a9@<issues.hbase.apache.org>
- thread.html/r2f6a547f226579f542eb08793631d1f2d47d7aed7e2f9d11a4e6af9f@<issues.hbase.apache.org>
- thread.html/r449288f6a941a2585262e0f4454fdefe169d5faee33314f6f89fab30@<issues.hbase.apache.org>