Veracode Vulnerability DatabaseVERACODE:6293Remote Code Execution (RCE)
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
9 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
github.com/apache/thrift is vulnerable to remote code execution (RCE) attacks. The vulnerability exists in format_go_otuput of t_go_generator.cc where a malicious user can provide a service name which could deliver a payload that leads to RCE attacks.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/apache/thrift | eq | 0.9.3 | |
| github.com/apache/thrift | eq | HEAD | |
| git.apache.org/thrift.git | eq | 0.9.3 |
References
mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E
www.securityfocus.com/bid/103025
access.redhat.com/errata/RHSA-2018:2669
access.redhat.com/errata/RHSA-2019:3140
github.com/apache/thrift/commit/2007783e874d524a46b818598a45078448ecc53e
github.com/apache/thrift/pull/1061
issues.apache.org/jira/browse/THRIFT-3893
lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
9 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C