Bug 1667188 (CVE-2018-11798) - CVE-2018-11798 thrift: Improper Access Control grants access to files outside the webservers docroot path
Summary: CVE-2018-11798 thrift: Improper Access Control grants access to files outside...
Status: NEW
Alias: CVE-2018-11798
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20181005,repo...
Keywords: Security
Depends On: 1667189 1667190 1700972 1700973 1700982 1700983
Blocks: 1667192
TreeView+ depends on / blocked
 
Reported: 2019-01-17 16:57 UTC by Laura Pardo
Modified: 2019-04-17 17:35 UTC (History)
17 users (show)

Fixed In Version: thrift 0.12.0
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Laura Pardo 2019-01-17 16:57:24 UTC
The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.


References:
https://lists.apache.org/thread.html/6e9edd282684896cedf615fb67a02bebfe6007f2d5baf03ba52e34fd@%3Cuser.thrift.apache.org%3E

Upstream Patch:
https://github.com/apache/thrift/pull/1606

Comment 1 Laura Pardo 2019-01-17 16:57:39 UTC
Created thrift tracking bugs for this issue:

Affects: epel-7 [bug 1667189]
Affects: fedora-all [bug 1667190]

Comment 2 James Hebden 2019-01-18 00:47:33 UTC
Statement:

OpenStack and OpenDaylight:
The Java implementation of thrift is used in OpenDaylight by parts of the vpnservice functionality. This flaw refers to the JavaScript (node.js) server for Thrift, which is not used or shipped with OpenDaylight or any other part of Red Hat OpenStack Platform.


Note You need to log in before you can comment on or make changes to this bug.