[HBASE-24148] Upgrade Thrift to 0.13.0: 0.12.0 has outstanding CVEs. - ASF JIRA

Log work

Agile Board

Rank to Top

Rank to Bottom

Attach files

Attach Screenshot

Bulk Copy Attachments

Bulk Move Attachments

Voters

Watch issue

Watchers

Create sub-task

Convert to sub-task

Move

Link

Clone

Labels

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Improvement
Status: Resolved
Priority: Major
Resolution: Fixed
Affects Version/s: 3.0.0-alpha-1
Fix Version/s: 3.0.0-alpha-1, 2.3.0, 1.3.7, 1.7.0, 1.4.14, 2.2.5
Component/s: Thrift
Labels:
None

Hadoop Flags:

Reviewed

Description

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

To be on the safe side, we could update to 0.13.0.