Remote Code Execution (RCE)

2018-05-1505:18:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.005 Low

EPSS

Percentile

77.2%

JSON

github.com/apache/thrift is vulnerable to remote code execution (RCE) attacks. The vulnerability exists in format_go_otuput of t_go_generator.cc where a malicious user can provide a service name which could deliver a payload that leads to RCE attacks.

CPENameOperatorVersion
github.com/apache/thrifteq0.9.3
github.com/apache/thrifteqHEAD
git.apache.org/thrift.giteq0.9.3

Name	Operator	Version
github.com/apache/thrift	eq	0.9.3
github.com/apache/thrift	eq	HEAD
git.apache.org/thrift.git	eq	0.9.3

References

mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E

www.securityfocus.com/bid/103025

access.redhat.com/errata/RHSA-2018:2669

access.redhat.com/errata/RHSA-2019:3140

github.com/apache/thrift/commit/2007783e874d524a46b818598a45078448ecc53e

github.com/apache/thrift/pull/1061

issues.apache.org/jira/browse/THRIFT-3893

lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E

0.005 Low

EPSS

Percentile

77.2%

JSON

Related for VERACODE:6293