CVE-2020-13949

Aliases:GHSA-g2fg-mr77-6vrmBIT-thrift-2020-13949DEBIAN-CVE-2020-13949CGA-22mj-42fx-96hwCGA-25f5-gvc6-rj2wCGA-2cv3-9vcj-fcpwCGA-2f23-5qx3-6pm9CGA-2m9g-9xmr-hjj6CGA-2wc2-xv6h-8w93CGA-36rg-5mfj-27fqCGA-3732-383p-j7x2CGA-378w-c55q-42x3CGA-3fhc-7c88-g7xqCGA-3rgh-cjp8-9gm2CGA-3vgr-q6rj-x7qgCGA-3vjg-7w46-fv7mCGA-3w8c-74vx-x8g9CGA-424r-699p-j6fhCGA-445x-ppqq-wqj3CGA-4988-44cj-vh48CGA-4fx6-pc66-j68hCGA-4h8c-4f66-jjqvCGA-4hhr-4ff8-4wmqCGA-4p9c-vj5m-6q59CGA-4vpr-266q-frffCGA-4x82-7rmh-jgrhCGA-4x8c-chx3-3vq4CGA-54hm-x2mq-jh82CGA-5f8p-cxrh-2v9cCGA-5fmg-8cq5-pvgvCGA-5h26-p27r-mhx4CGA-5hfp-329f-jqj4CGA-5mrf-45gc-8vxrCGA-5p5p-g656-xhvrCGA-5pq2-fjfj-f5c6CGA-5xrq-wmvv-jj8cCGA-62qg-m5q4-hjwqCGA-6576-8735-3hq3CGA-6f65-mrhv-9m3vCGA-6gg4-hf68-c7gvCGA-6m6x-x9gx-c834CGA-6qjp-hvmq-hvjrCGA-7h2p-85w6-hm96CGA-7jvx-4w24-vprhCGA-7q57-pmpc-4q57CGA-7x2c-qjhm-5239CGA-7xqm-6hc7-j3jjCGA-87x2-c46m-2g67CGA-8fqw-vpj9-fq4gCGA-8wq3-4v7f-q78hCGA-9546-rxf5-3px3CGA-95gq-p2h8-h6q8CGA-9628-vvrf-pc9mCGA-99r2-4475-63cwCGA-9cw8-89q4-mv9vCGA-9ffw-vwx6-2vq3CGA-9h77-c6q7-8r62CGA-9h8q-g64w-g3w2CGA-c36j-3c95-3c86CGA-cfqr-wmcp-4p8qCGA-cj7j-5r2g-p7vxCGA-cqhf-885v-pghmCGA-crxw-65p7-vw69CGA-f33p-9829-qf55CGA-f785-xjxx-29wvCGA-f97h-hm36-qv55CGA-ff2x-cx3f-p7g9CGA-ff7x-9qcx-xhfpCGA-fjfc-5mh3-8p2vCGA-fq3q-h6x7-f4q5CGA-g89j-p5wh-c74wCGA-gmvx-8qf6-x446CGA-gqp4-q3xg-m9jhCGA-h2g3-66mj-4qwrCGA-h55r-hh6q-gg4mCGA-h6m3-83mp-rch5CGA-h6xm-ccrr-4935CGA-hcj9-7wmp-c4q5CGA-hg9x-237x-7q2hCGA-hj6f-2rpx-hpqgCGA-hpm4-6m7r-984rCGA-hq9v-qxf8-2mhrCGA-j4fm-8vh9-fhhrCGA-j66w-fr56-qm3hCGA-jjjp-fhmr-c6xjCGA-jvhf-wpfh-vqj5CGA-jw3q-37p9-5xh2CGA-m424-xv94-c85wCGA-mw7w-v3f4-9x9mCGA-mxgh-2wh9-f8v7CGA-p22f-2fwc-wqwrCGA-p7x4-xf5v-pw48CGA-p9p8-6qv5-96h8CGA-p9qr-g8w8-m234CGA-pr2w-7698-q67mCGA-pvxp-fmfr-xgvhCGA-pw69-fgf6-hr58CGA-55q5-px9r-3vv7CGA-656j-x8w9-44rhCGA-87m9-g4hh-8jq9CGA-f4qx-j442-7mxpCGA-f4r5-rqjv-xw4mCGA-h67c-9v9q-6f4hCGA-mhvx-r8ph-vr95CGA-q3mj-qgv7-522fCGA-q3pc-7fc9-66wvCGA-q56p-88f9-7jm6CGA-q85v-cr7x-q7qrCGA-q9jc-wx6j-mpggCGA-qc39-v6p4-f879CGA-qj97-xrf5-vhcjCGA-qmpp-32pg-wchgCGA-qmr5-4mr3-m839CGA-qqg4-rm5q-7vjfCGA-qqrm-xcj3-5fpvCGA-r2g6-5xwg-hp8xCGA-r4mp-r72p-6423CGA-r4vf-q3rh-w9pfCGA-r563-8crj-jj9cCGA-r7m3-wxhj-4g5cCGA-r9xx-r22j-2r38CGA-rx9c-4gx8-v6rhCGA-v288-g566-8w9vCGA-v2xj-xh4j-fwv8CGA-vfwq-23jv-xwm2CGA-vgw8-2957-7jp9CGA-vhvp-7vwh-55c7CGA-vrhc-h8gh-78p3CGA-w4wf-75hp-p8q6CGA-wc5v-g768-9hc3CGA-wvv5-35ww-mrhjCGA-x2x6-mp8c-fwg4CGA-x8j3-f2jq-jr6gCGA-xfw8-674m-rj82CGA-xxf2-vg62-jpph
Advisory lineage Upstream: 0 Downstream: 5
Modified
Published: 12 Feb 2021, 19:39
Last modified:04 Aug 2024, 12:32

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
6.78% LOW
7% probability +5.96%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

12 Feb 2021, 19:39
Published
Vulnerability first disclosed
04 Aug 2024, 12:32
Last Modified
Vulnerability information updated

Description

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 6.78%• Percentile: 94%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • apache•hive

    < 4.0.0

  • apache•thrift

    ≥ 0.9.3, ≤ 0.13.0

  • chainguard•druid

    < 34.0.0-r6 | all

  • chainguard•spark-3.5-scala-2.12

    all

  • chainguard•spark-3.5-scala-2.13

    all

  • chainguard•spark-fips-3.5-scala-2.12

    all

  • chainguard•spark-fips-3.5-scala-2.13

    all

  • chainguard•trino

    < 440-r0

  • chainguard•trino-config

    < 440-r0

  • chainguard•trino-oci-entrypoint

    < 440-r0

  • chainguard•trino-plugin-ai-functions

    < 440-r0

  • chainguard•trino-plugin-bigquery

    < 440-r0

  • chainguard•trino-plugin-blackhole

    < 440-r0

  • chainguard•trino-plugin-cassandra

    < 440-r0

  • chainguard•trino-plugin-clickhouse

    < 440-r0

  • chainguard•trino-plugin-delta-lake

    < 440-r0

  • chainguard•trino-plugin-druid

    < 440-r0

  • chainguard•trino-plugin-duckdb

    < 440-r0

  • chainguard•trino-plugin-elasticsearch

    < 440-r0

  • chainguard•trino-plugin-exasol

    < 440-r0

  • chainguard•trino-plugin-exchange-filesystem

    < 440-r0

  • chainguard•trino-plugin-exchange-hdfs

    < 440-r0

  • chainguard•trino-plugin-faker

    < 440-r0

  • chainguard•trino-plugin-functions-python

    < 440-r0

  • chainguard•trino-plugin-geospatial

    < 440-r0

  • chainguard•trino-plugin-google-sheets

    < 440-r0

  • chainguard•trino-plugin-hive

    < 440-r0

  • chainguard•trino-plugin-http-event-listener

    < 440-r0

  • chainguard•trino-plugin-http-server-event-listener

    < 440-r0

  • chainguard•trino-plugin-hudi

    < 440-r0

  • chainguard•trino-plugin-iceberg

    < 440-r0

  • chainguard•trino-plugin-ignite

    < 440-r0

  • chainguard•trino-plugin-jmx

    < 440-r0

  • chainguard•trino-plugin-kafka

    < 440-r0

  • chainguard•trino-plugin-kafka-event-listener

    < 440-r0

  • chainguard•trino-plugin-lakehouse

    < 440-r0

  • chainguard•trino-plugin-ldap-group-provider

    < 440-r0

  • chainguard•trino-plugin-loki

    < 440-r0

  • chainguard•trino-plugin-mariadb

    < 440-r0

  • chainguard•trino-plugin-memory

    < 440-r0

  • chainguard•trino-plugin-ml

    < 440-r0

  • chainguard•trino-plugin-mongodb

    < 440-r0

  • chainguard•trino-plugin-mysql

    < 440-r0

  • chainguard•trino-plugin-mysql-event-listener

    < 440-r0

  • chainguard•trino-plugin-opa

    < 440-r0

  • chainguard•trino-plugin-openlineage

    < 440-r0

  • chainguard•trino-plugin-opensearch

    < 440-r0

  • chainguard•trino-plugin-oracle

    < 440-r0

  • chainguard•trino-plugin-password-authenticators

    < 440-r0

  • chainguard•trino-plugin-pinot

    < 440-r0

Showing first 50 affected entries in server-rendered view.

References (216)