Bug 1667188 (CVE-2018-11798) - CVE-2018-11798 thrift: Improper Access Control grants access to files outside the webservers docroot path
Summary: CVE-2018-11798 thrift: Improper Access Control grants access to files outside...
Alias: CVE-2018-11798
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1667189 1667190 1700972 1700973 1700982 1700983
Blocks: 1667192
TreeView+ depends on / blocked
Reported: 2019-01-17 16:57 UTC by Laura Pardo
Modified: 2021-02-16 22:30 UTC (History)
22 users (show)

Fixed In Version: thrift 0.12.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Node.js static web server in Apache Thrift, where it allowed a remote user to access files outside of the set web servers' docroot path. An attacker could use this flaw to possibly access unauthorized files and sensitive information.
Clone Of:
Last Closed: 2019-07-12 13:06:28 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1545 0 None None None 2019-06-18 19:52:38 UTC
Red Hat Product Errata RHSA-2019:3140 0 None None None 2019-10-17 14:55:06 UTC

Description Laura Pardo 2019-01-17 16:57:24 UTC
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.


Upstream Patch:

Comment 1 Laura Pardo 2019-01-17 16:57:39 UTC
Created thrift tracking bugs for this issue:

Affects: epel-7 [bug 1667189]
Affects: fedora-all [bug 1667190]

Comment 2 James Hebden 2019-01-18 00:47:33 UTC

OpenStack and OpenDaylight:
The Java implementation of thrift is used in OpenDaylight by parts of the vpnservice functionality. This flaw refers to the JavaScript (node.js) server for Thrift, which is not used or shipped with OpenDaylight or any other part of Red Hat OpenStack Platform.

Comment 8 Joshua Padman 2019-05-16 02:39:41 UTC
This vulnerability is out of security support scope for the following product:
 * Red Hat JBoss Fuse Service Works 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.

Comment 9 Joshua Padman 2019-05-16 02:44:09 UTC
JBoss Operations Network does not use the the vulnerable component marking as wontfix.

Comment 10 errata-xmlrpc 2019-06-18 19:52:36 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.3.1

Via RHSA-2019:1545 https://access.redhat.com/errata/RHSA-2019:1545

Comment 11 Product Security DevOps Team 2019-07-12 13:06:28 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Comment 12 errata-xmlrpc 2019-10-17 14:55:04 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Data Virtualization 6.4.8

Via RHSA-2019:3140 https://access.redhat.com/errata/RHSA-2019:3140

Note You need to log in before you can comment on or make changes to this bug.