Vulnerability Details CVE-2015-3254
The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.053
EPSS Ranking 91.6%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.0
References
- http://grokbase.com/t/thrift/user/15c2tss3td/notice-apache-thrift-security-vulnerability-cve-2015-1774
- http://www.securityfocus.com/bid/99112
- https://access.redhat.com/errata/RHSA-2017:2477
- https://access.redhat.com/errata/RHSA-2017:3115
- https://issues.apache.org/jira/browse/THRIFT-3231
- https://mail-archives.apache.org/mod_mbox/thrift-user/201512.mbox/%3CCANyrgvcjvEcjTVmaL+tVXCBm4o5G+1neu=MUubD9GbU85bO_Ew%40mail.gmail.com%3E
- http://grokbase.com/t/thrift/user/15c2tss3td/notice-apache-thrift-security-vulnerability-cve-2015-1774
- http://www.securityfocus.com/bid/99112
- https://access.redhat.com/errata/RHSA-2017:2477
- https://access.redhat.com/errata/RHSA-2017:3115
- https://issues.apache.org/jira/browse/THRIFT-3231
- https://mail-archives.apache.org/mod_mbox/thrift-user/201512.mbox/%3CCANyrgvcjvEcjTVmaL+tVXCBm4o5G+1neu=MUubD9GbU85bO_Ew%40mail.gmail.com%3E
Products affected by CVE-2015-3254
-
cpe:2.3:a:apache:thrift:0.2.0
-
cpe:2.3:a:apache:thrift:0.3.0
-
cpe:2.3:a:apache:thrift:0.4.0
-
cpe:2.3:a:apache:thrift:0.5.0
-
cpe:2.3:a:apache:thrift:0.6.0
-
cpe:2.3:a:apache:thrift:0.6.1
-
cpe:2.3:a:apache:thrift:0.7.0
-
cpe:2.3:a:apache:thrift:0.8.0
-
cpe:2.3:a:apache:thrift:0.9.0
-
cpe:2.3:a:apache:thrift:0.9.1
-
cpe:2.3:a:apache:thrift:0.9.2