Apache Thrift vulnerabilities

Infinite loop and prototype pollution vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol. Affects versions before 0.25.0.

The C++ and D libraries of Apache Thrift contain a certificate validation flaw where, upon a host name mismatch, subjectAltName dNSName entries are checked first and the Common Name is consulted afterwards despite the presence of dNSName entries. A non-matching dNSName yields a "skip" result instead of rejection, allowing a certificate with a matching Common Name to be accepted. This affects the C++ library from 0.7.0 through 0.24.0 and the D library from 0.9.0 through 0.24.0.

Apache Thrift Python bindings (versions before 0.25.0) contain improper certificate validation and return of wrong status code vulnerabilities. This can lead to accepting invalid certificates and communication errors.

Apache Thrift Perl bindings (versions before 0.25.0) contain improper certificate validation and initialization of a resource with an insecure default vulnerabilities. This can lead to establishing insecure connections.

Integer underflow and out-of-bounds write in Apache Thrift C++ 32-bit THeaderTransport. Affects versions before 0.25.0.

Memory allocation with excessive size and resource allocation without limits in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D language bindings. Affects versions before 0.25.0.

Allocation of resources without limits or throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. Affects versions before 0.25.0.

Vulnerability involving allocation of resources without limits or throttling in Apache Thrift Erlang bindings. Lack of limits can lead to resource exhaustion. Affects versions before 0.25.0.

Vulnerability in Apache Thrift Java bindings involving improper handling of exceptional conditions and missing release of resources after effective lifetime. Affects versions before 0.25.0.

Vulnerability in Apache Thrift nodejs bindings involving improper validation of specified quantity in input and allocation of resources without limits. Affects versions before 0.25.0.

Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. Lack of limits can lead to resource exhaustion. Affects versions before 0.25.0.

Uncaught exception vulnerability in Apache Thrift PHP bindings. An unhandled exception can lead to unexpected termination of the application. Affects versions before 0.25.0.

Improper handling of length parameter inconsistency, uncaught exception, inefficient algorithmic complexity, memory allocation with excessive size value, and initialization of a resource with an insecure default vulnerability exists in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings. This issue affects Apache Thrift versions before 0.25.0.

Improper handling of exceptional conditions, allocation of resources without limits or throttling, and uncaught exception vulnerability exists in Apache Thrift Java bindings. This issue affects Apache Thrift versions before 0.25.0.

Allocation of resources without limits or throttling and improper handling of length parameter inconsistency vulnerability exists in Apache Thrift Lua bindings. This issue affects Apache Thrift versions before 0.25.0.

A vulnerability in Apache Thrift Python bindings before version 0.24.0 involves improper validation of certificate with host mismatch, enabling man-in-the-middle attacks.

Allocation of resources without limits or throttling vulnerability in Apache Thrift Rust bindings. Affects versions before 0.24.0.

A vulnerability in Apache Thrift C++ bindings before version 0.24.0 causes a buffer over-read, potentially leading to data disclosure or crash.

Integer overflow or wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi, and Haxe bindings. Affects versions before 0.24.0.

Inefficient algorithmic complexity and allocation of resources without limits or throttling vulnerability in Apache Thrift Node.js bindings. Affects versions before 0.24.0.

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Ruby bindings. Affects versions before 0.24.0.

Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. Affects versions before 0.24.0.

Improper validation of certificate with host mismatch in Apache Thrift C++ bindings. Affects versions before 0.24.0.

A vulnerability in Apache Thrift Java bindings from version 0.19.0 before 0.24.0 involves allocation of resources without limits or throttling, potentially leading to resource exhaustion (DoS).

An infinite loop vulnerability exists in Apache Thrift Python, Go, PHP and Java bindings. The issue affects versions before 0.24.0.

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This affects Apache Thrift before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Vulnerability in Apache Thrift involving memory allocation with excessive size. Affects versions before 0.23.0.

Apache Thrift before version 0.23.0 improperly validates TLS certificates, allowing host mismatch. An attacker can exploit this for man-in-the-middle attacks.

An out-of-bounds read vulnerability has been identified in Apache Thrift before version 0.23.0. The issue is fixed in version 0.23.0.

In Apache Thrift before version 0.23.0, an uncontrolled recursion vulnerability was found that could lead to denial of service. The issue is fixed in version 0.23.0.

Apache Thrift before version 0.23.0 contains an integer overflow or wraparound vulnerability. The issue is fixed in version 0.23.0.

Apache Thrift before version 0.23.0 contains an out-of-bounds read vulnerability. The issue is fixed in version 0.23.0.

An integer overflow or wraparound vulnerability has been identified in the Go language implementation of TFramedTransport in Apache Thrift before version 0.23.0. This can lead to unexpected behavior or potential remote code execution.

Mismatched memory management routines in Apache Thrift c_glib language bindings can crash a Thrift server with a 'free(): invalid pointer' error when processing a specially crafted request.