You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@hbase.apache.org by "Michael Stack (Jira)" <ji...@apache.org> on 2020/04/15 00:03:00 UTC

[jira] [Commented] (HBASE-24148) Upgrade Thrift to 0.13.0

    [ https://issues.apache.org/jira/browse/HBASE-24148?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17083703#comment-17083703 ] 

Michael Stack commented on HBASE-24148:
---------------------------------------

Thrift 0.12.0, which has two known CVE: CVE-2019-0205 and CVE-2019-0210. Bringing into 2.3.0 for consideration.

> Upgrade Thrift to 0.13.0
> ------------------------
>
>                 Key: HBASE-24148
>                 URL: https://issues.apache.org/jira/browse/HBASE-24148
>             Project: HBase
>          Issue Type: Improvement
>          Components: Thrift
>    Affects Versions: 3.0.0
>            Reporter: Tamas Penzes
>            Assignee: Tamas Penzes
>            Priority: Major
>             Fix For: 3.0.0, 2.3.0
>
>
> In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.
> To be on the safe side, we could update to 0.13.0.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)