All errata/sisyphus/ALT-PU-2017-2692-2
ALT-PU-2017-2692-2

Package update thrift in branch sisyphus

Version0.10.0-alt1_4jpp8
Task#195295
Published2026-02-04
Max severityHIGH
Severity:

Closed issues (3)

CVE-2015-3254
MEDIUM6.5

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.

Published: 2017-06-16Modified: 2025-04-20
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
CVE-2016-5397
HIGH8.8

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

Published: 2018-02-12Modified: 2024-11-21
CVSS 2.0CRITICAL 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
GHSA-r4m4-pmvw-m6j5
HIGH8.8

Apache Thrift Go Library Command Injection

Published: 2022-05-13Modified: 2023-07-31
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References