Bug 1182157 (CVE-2020-13949) - VUL-0: CVE-2020-13949: thrift: potential DoS when processing untrusted payloads
Summary: VUL-0: CVE-2020-13949: thrift: potential DoS when processing untrusted payloads
Status: RESOLVED FIXED
Alias: CVE-2020-13949
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Guang Yee
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/277831/
Whiteboard: CVSSv3.1:SUSE:CVE-2020-13949:4.3:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2021-02-12 08:14 UTC by Alexander Bergmann
Modified: 2024-07-26 18:52 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2021-02-12 08:14:21 UTC 
CVE-2020-13949: Apache Thrift: potential DoS when processing untrusted payloads

From: "Jens Geyer" 
Date: Thu, 11 Feb 2021 23:43:29 +0100

CVE-2020-13949: potential DoS when processing untrusted Thrift payloads

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Apache Thrift up to and including 0.13.0

Description:
Applications using Thrift would not error upon receiving messages declaring containers of sizes larger than the 
payload. As a result, malicious RPC clients could send short messages which would result in a large memory allocation, 
potentially leading to denial of service.

Mitigation:
Upgrade to version 0.14.0

Credit:
This issue was reported by Hasnain Lakhani of Facebook.

On behalf of the Apache Thrift PMC,
Jens Geyer


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13949
http://seclists.org/oss-sec/2021/q1/140
Comment 2 Guang Yee 2022-05-18 20:04:44 UTC 
Our investigation so far has not yield any evidence that the thrift (GO implementation where the CVE is applicable) package is being used by the product. We've combed through all the CI logs for the Cloud 9 gating jobs and found no evidence that the thrift RPM package was being used or even installed.

Since the thrift package is available in our product repo, there's a chance that a customer may unintentionally installed it.

We came up with the following options:

1) document the fact that the existing package have a vulnerability and it will not be supported by the product going forward. We will not be upgrading the existing
package to 0.14.2.

2) document the fact that the existing package have a vulnerability and it will not be supported by the product going forward. We can create a newer version of the package with nothing in it, which effectively disabling the package.

3) update the package to version 0.14.2 and keep supporting it till EOL.
Comment 3 Guang Yee 2022-05-19 19:24:16 UTC 
Please advice on the proposed options so we can proceed.
Comment 5 Alexander Bergmann 2023-01-09 13:41:22 UTC 
(In reply to Guang Yee from comment #2)
> We came up with the following options:
> 
> 1) document the fact that the existing package have a vulnerability and it
> will not be supported by the product going forward. We will not be upgrading
> the existing
> package to 0.14.2.
> 
> 2) document the fact that the existing package have a vulnerability and it
> will not be supported by the product going forward. We can create a newer
> version of the package with nothing in it, which effectively disabling the
> package.
> 
> 3) update the package to version 0.14.2 and keep supporting it till EOL.

Solution 1 or 2 sounds good. There is no need to put more effort into this then needed.