CoreCVE
Back

HIGH

thrift: Endless loop when feed with specific input data

Published Oct 28, 2019

Description

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

Affected products

Remediation

Red Hat statement

Red Hat OpenStack Platform ships OpenDaylight, which contains a vulnerable version of libthrift. However, OpenDaylight does not expose libthrift in a vulnerable way, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time. The thrift package in OpenShift Container Platform is installed only in Curator images in the Logging stack. The affected code is included in this package, it's functionality is not used. This vulnerability is therefore rated Low for OpenShift Container Platform.

Metrics

Weaknesses (2)

CWE-400

Uncontrolled Resource Consumption

CWE-835

References (82)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Oct 28, 2019
Updated Aug 4, 2024
Reserved Nov 14, 2018
Link CVE-2019-0205
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-0205
Red Hat
Severity Moderate
Public date Oct 17, 2019
Links CVE-2019-0205 - Bugzilla
GHSA-RJ7P-RFGP-852X