Input validation error in Thrift - CVE-2020-13949

Vulnerability identifier: #VU50684

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-13949

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted messages and perform a denial of service (DoS) attack.

Thrift
Gentoo Linux
Arch Linux
Log Analysis
IBM Security Guardium Insights
Netcool Operations Insight
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
Oracle Communications Cloud Native Core Policy
Red Hat OpenShift Jaeger
IBM Qradar SIEM
IBM Security Guardium
Gitlab Community Edition
GitLab Enterprise Edition
IBM Cloud Pak for Watson AIOps
Fuse

Install updates from vendor's website.

Thrift - update to 0.14.0
Log Analysis - update to 1.3.7.2 FP2
Red Hat OpenShift Jaeger - update to 1.20.4
IBM Security Guardium Insights - update to 3.0
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 8, 7.4.3 Fix Pack 1
Gitlab Community Edition - addressed in versions 13.7.8, 13.8.5, 13.9.2
GitLab Enterprise Edition - addressed in versions 13.7.8, 13.8.5, 13.9.2
Netcool Operations Insight - update to 1.6.6
IBM Cloud Pak for Watson AIOps - update to 3.6.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.0.1
Fuse - update to 7.10.0

• https://lists.apache.org/thread.html/r43dc2b2e928e9d845b07ac075634cb759d91bb852421dc282f87a74a%40%3Cdev.thrift.apache.org%3E

• Denial of service in Apache Thrift
• Arch Linux update for thrift
• Gitlab update for Apache Thrift
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Gentoo update for Apache Thrift
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• IBM Security Guardium update for Apache Thrift
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Input validation error in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in Fuse 7.10
• Multiple vulnerabilities in IBM Security Guardium Insights
• IBM Log Analysis update for Apache Thrift