Medium · 6.5 CVE-2018-11798 EUVD-2019-0195GHSA-vx85-mj8c-4qm6

Apache Thrift Node.js static web server sandbox escape

Published Jan 7, 2019 · Updated Aug 5, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Thrift Package: druid Package: org.apache.thrift:libthrift Package: thrift Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Ecosystem: Debian Ecosystem: Maven Ecosystem: Wolfi

Description

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Thrift	Apache Thrift 0.9.2 to 0.11.0	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	thrift	0.11.0-4	—
Debian 13	thrift	0.11.0-4	—
Debian 12	thrift	0.11.0-4	—

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	druid	35.0.1-r1	—
Wolfi rolling	trino +58	440-r0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.thrift:libthrift	>= 0.9.2, < 0.12.0	0.12.0	GHSA-vx85-mj8c-4qm6

References

106501 vdb-entry
https://lists.apache.org/thread.html/6e9edd282684896cedf615fb67a02bebfe6007f2d5baf03ba52e34fd%40%3Cuser.thrift.apache.org%3E
RHSA-2019:1545 vendor-advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
RHSA-2019:3140 vendor-advisory