CVE-2015-3254

Published: Jun 16, 2017Modified: May 13, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.

Affected (1)

Products: Apache: Thrift

Apache

1 product

Thrift

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Thrift	Up to 0.9.2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://grokbase.com/t/thrift/user/15c2tss3td/notice-apache-thrift-security-vulnerability-cve-2015-1774

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/99112

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2017:2477

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2017:3115

Source: secalert@redhat.com

https://issues.apache.org/jira/browse/THRIFT-3231

Source: secalert@redhat.com

Issue TrackingPatchVendor Advisory

https://mail-archives.apache.org/mod_mbox/thrift-user/201512.mbox/%3CCANyrgvcjvEcjTVmaL+tVXCBm4o5G+1neu=MUubD9GbU85bO_Ew%40mail.gmail.com%3E

Source: secalert@redhat.com

http://grokbase.com/t/thrift/user/15c2tss3td/notice-apache-thrift-security-vulnerability-cve-2015-1774