CVE-2019-0210

CWE-125 — Out-of-bounds Read11 documents7 sources
Severity
7.5HIGH
EPSS
0.4%
top 41.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Github.com Apache/thriftApache ThriftApache Apache Thrift+2 more
Timeline
PublishedOct 29
Latest updateJul 28

Description

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶Gogithub.com/apache/thrift0.9.3 — 0.13.0+1
▶NVDapache/thrift0.9.3 — 0.12.0
▶CVEListV5apache/apache_thrift0.9.3 to 0.12.0
▶Debianthrift< 0.13.0-2+3

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

5
OSV
Panic due to out-of-bounds read in github.com/apache/thrift↗2021-07-28
▶
GHSA
Out-of-bounds read in Apache Thrift↗2021-05-18
▶
OSV
Out-of-bounds read in Apache Thrift↗2021-05-18
▶
OSV
CVE-2019-0210: In Apache Thrift 0↗2019-10-29
▶
CVEList
CVE-2019-0210: In Apache Thrift 0↗2019-10-28
▶

📋Vendor Advisories

2
Red Hat
thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol↗2019-10-17
▶
Debian
CVE-2019-0210: thrift - In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol↗2019-10-23
▶
Bugzilla
CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol [epel-7]↗2019-10-23
▶
Bugzilla
CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol [fedora-all]↗2019-10-23
▶