Описание
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings.
This issue affects Apache Thrift: before 0.23.0.
Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.
A flaw was found in Apache Thrift c_glib language bindings. A remote attacker could send specially crafted requests to a c_glib-based Thrift server, leading to a mismatched memory management routines vulnerability. This could cause the server to crash with a "free(): invalid pointer" error, resulting in a Denial of Service (DoS).
Отчет
This is an Important denial of service vulnerability affecting Apache Thrift c_glib language bindings. Remote attackers can exploit this flaw by sending specially crafted requests to a c_glib-based Thrift server, leading to a server crash and service disruption. This impact is considered Important due to the potential for unauthenticated remote denial of service in Red Hat products that deploy and expose such Thrift servers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Not affected | ||
| OpenShift Service Mesh 2 | openshift-service-mesh/istio-rhel8-operator | Not affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | redhat-user-workloads/grafana-acm-212 | Will not fix | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | redhat-user-workloads/grafana-acm-213 | Affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-cpu-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Will not fix | ||
| Red Hat Ceph Storage 5 | rhceph/snmp-notifier-rhel8 | Out of support scope | ||
| Red Hat Ceph Storage 6 | rhceph/rhceph-6-dashboard-rhel9 | Out of support scope | ||
| Red Hat Ceph Storage 6 | rhceph/snmp-notifier-rhel9 | Out of support scope | ||
| Red Hat Ceph Storage 8 | rhceph/grafana-rhel9 | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.
Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
Mismatched Memory Management Routines vulnerability in Apache Thrift c ...
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.
EPSS
7.5 High
CVSS3