Description
The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
Advisories 1
- WID-SEC-2023-0720 Red Hat JBoss: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 22, 2023
References
- http://grokbase.com/t/thrift/user/15c2tss3td/notice-apache-thrift-security-vulnerability-cve-2015-1774
- https://issues.apache.org/jira/browse/THRIFT-3231
- 99112 vdb-entry
- [thrift-user] 20151210 Re: [NOTICE]: Apache Thrift Security Vulnerability CVE-2015-1774 mailing-list
- RHSA-2017:2477 vendor-advisory
- RHSA-2017:3115 vendor-advisory