Bug 1667188 (CVE-2018-11798) - CVE-2018-11798 thrift: Improper Access Control grants access to files outside the webservers docroot path
Summary: CVE-2018-11798 thrift: Improper Access Control grants access to files outside...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-11798
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1667189 1667190 1700972 1700973 1700982 1700983
Blocks: 1667192
TreeView+ depends on / blocked
 
Reported: 2019-01-17 16:57 UTC by Laura Pardo
Modified: 2021-02-16 22:30 UTC (History)
22 users (show)

Fixed In Version: thrift 0.12.0
Clone Of:
Environment:
Last Closed: 2019-07-12 13:06:28 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:1545 0 None None None 2019-06-18 19:52:38 UTC
Red Hat Product Errata RHSA-2019:3140 0 None None None 2019-10-17 14:55:06 UTC

Description Laura Pardo 2019-01-17 16:57:24 UTC 
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.


References:
https://lists.apache.org/thread.html/6e9edd282684896cedf615fb67a02bebfe6007f2d5baf03ba52e34fd@%3Cuser.thrift.apache.org%3E

Upstream Patch:
https://github.com/apache/thrift/pull/1606
Comment 1 Laura Pardo 2019-01-17 16:57:39 UTC 
Created thrift tracking bugs for this issue:

Affects: epel-7 [bug 1667189]
Affects: fedora-all [bug 1667190]
Comment 2 James Hebden 2019-01-18 00:47:33 UTC 
Statement:

OpenStack and OpenDaylight:
The Java implementation of thrift is used in OpenDaylight by parts of the vpnservice functionality. This flaw refers to the JavaScript (node.js) server for Thrift, which is not used or shipped with OpenDaylight or any other part of Red Hat OpenStack Platform.
Comment 8 Joshua Padman 2019-05-16 02:39:41 UTC 
This vulnerability is out of security support scope for the following product:
 * Red Hat JBoss Fuse Service Works 6

Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Comment 9 Joshua Padman 2019-05-16 02:44:09 UTC 
JBoss Operations Network does not use the the vulnerable component marking as wontfix.
Comment 10 errata-xmlrpc 2019-06-18 19:52:36 UTC 
This issue has been addressed in the following products:

  Red Hat Fuse 7.3.1

Via RHSA-2019:1545 https://access.redhat.com/errata/RHSA-2019:1545
Comment 11 Product Security DevOps Team 2019-07-12 13:06:28 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-11798
Comment 12 errata-xmlrpc 2019-10-17 14:55:04 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Data Virtualization 6.4.8

Via RHSA-2019:3140 https://access.redhat.com/errata/RHSA-2019:3140
Note You need to log in before you can comment on or make changes to this bug.