All errata/sisyphus/ALT-PU-2019-4238-1
ALT-PU-2019-4238-1

Package update python-module-thrift in branch sisyphus

Version0.11.0-alt1
Task#237451
Published2019-09-15
Max severityHIGH
Severity:

Closed issues (3)

CVE-2015-3254
MEDIUM6.5

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.

Published: 2017-06-16Modified: 2025-04-20
CVSS 2.0MEDIUM 4.0
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
CVE-2016-5397
HIGH8.8

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

Published: 2018-02-12Modified: 2024-11-21
CVSS 2.0CRITICAL 9.0
CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
GHSA-r4m4-pmvw-m6j5
HIGH8.8

Apache Thrift Go Library Command Injection

Published: 2022-05-13Modified: 2023-07-31
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References