Bug 1462783 (CVE-2015-3254)

Summary:	CVE-2015-3254 thrift: Infinite recursion via vectors involving the skip function
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abhgupta, ahardin, aileenc, bleanhar, ccoleman, chazlett, ctubbsii, dbaker, dedgar, dmcphers, gvarsami, jcoleman, jgoulding, jkeck, jokerman, jolee, jshepherd, kconner, ldimaggi, loleary, mchappel, milleruntime, nwallace, rwagner, sardella, spinder, tcunning, theute, tiwillia, tkirby, vhalbert, willb
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A vulnerability was discovered in Apache Thrift client libraries that allows remote, authenticated attackers to cause an infinite recursion via vectors involving the skip function; resulting in a denial of service (DoS) condition.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:15:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1462785, 1462784, 1463719, 1463720, 1471339, 1471340, 1471341, 1471342
Bug Blocks:	1462786, 1475996

Description Andrej Nemec 2017-06-19 14:13:32 UTC

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function. 

References:

http://grokbase.com/t/thrift/user/15c2tss3td/notice-apache-thrift-security-vulnerability-cve-2015-1774

Upstream issue:

https://issues.apache.org/jira/browse/THRIFT-3231

Upstream patch:

https://github.com/apache/thrift/commit/cfaadcc4adcfde2a8232c62ec89870b73ef40df1

Comment 1 Andrej Nemec 2017-06-19 14:14:33 UTC

Created thrift tracking bugs for this issue:

Affects: epel-7 [bug 1462785]
Affects: fedora-all [bug 1462784]

Comment 5 errata-xmlrpc 2017-08-15 15:10:05 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Data Virtualization

Via RHSA-2017:2477 https://access.redhat.com/errata/RHSA-2017:2477

Comment 6 errata-xmlrpc 2017-11-02 20:09:36 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Fuse

Via RHSA-2017:3115 https://access.redhat.com/errata/RHSA-2017:3115

Comment 7 Jason Shepherd 2018-04-03 04:32:04 UTC

libthrift is not included in Openshift Enterprise. Setting as not affected.

Comment 11 Joshua Padman 2019-05-15 22:44:38 UTC

This vulnerability is out of security support scope for the following product:
 * Red Hat JBoss Operations Network 3

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.