Bug 770145 – <dev-python/thrift-0.14.1: potential DoS when processing untrusted Thrift payloads (CVE-2020-13949)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description John Helmert III 2021-02-12 01:11:11 UTC]

CVE-2020-13949:

Applications using Thrift would not error upon receiving messages
declaring containers of sizes larger than the payload. As a result,
malicious RPC clients could send short messages which would result in a
large memory allocation, potentially leading to denial of service.


Fixed in 0.14.0, please bump.

[Comment 1 Thomas Deutschmann (RETIRED) 2021-05-31 20:50:34 UTC]

ping

[Comment 2 Larry the Git Cow 2021-06-01 06:39:05 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3d737b9a8a8e0fa201ed4f9ecf529e5699d3b3bb

commit 3d737b9a8a8e0fa201ed4f9ecf529e5699d3b3bb
Author:     Fabian Groffen <[e-mail]>
AuthorDate: 2021-06-01 06:38:48 +0000
Commit:     Fabian Groffen <[e-mail]>
CommitDate: 2021-06-01 06:39:03 +0000

    dev-python/thrift-0.14.1: version bump
    
    Bug: https://bugs.gentoo.org/770145
    Package-Manager: Portage-3.0.18, Repoman-3.0.2
    Signed-off-by: Fabian Groffen <[e-mail]>

 dev-python/thrift/Manifest             |  1 +
 dev-python/thrift/thrift-0.14.1.ebuild | 27 +++++++++++++++++++++++++++
 2 files changed, 28 insertions(+)

[Comment 3 John Helmert III 2021-06-02 01:19:28 UTC]

Please proceed with stabilization when ready.

[Comment 4 Sam James 2021-06-16 20:45:30 UTC]

(In reply to John Helmert III from comment #3)
> Please proceed with stabilization when ready.

ping

[Comment 5 Fabian Groffen 2021-06-17 08:09:11 UTC]

arches, please stabilise =dev-python/thrift-0.14.1 thanks

[Comment 6 Agostino Sarubbo 2021-06-18 06:27:11 UTC]

amd64 stable

[addCollapseLink(7, 1, 'Toggle comment display'); Comment 7 NATTkA bot 2021-06-18 06:32:40 UTC Comment hidden (obsolete)]

Resetting sanity check; package list is empty or all packages are done.

[Comment 8 John Helmert III 2021-06-18 13:51:17 UTC]

I guess arm wasn't supposed to be CCd? Don't forget to use nattka to handle arches trivially!

https://archives.gentoo.org/gentoo-dev/message/cd62f6be924f6a0f76b68a07d33b256a

[Comment 9 Fabian Groffen 2021-06-18 18:17:53 UTC]

nattka didn't work, so I wanted to add the archs x86 and amd64 manually myself, apparently I accidentially added arm instead.

[Comment 10 Agostino Sarubbo 2021-06-19 10:01:35 UTC]

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 11 Larry the Git Cow 2021-06-19 19:06:50 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=72e4790572c52c37f876509da179b24b4ae83734

commit 72e4790572c52c37f876509da179b24b4ae83734
Author:     Fabian Groffen <[e-mail]>
AuthorDate: 2021-06-19 19:06:44 +0000
Commit:     Fabian Groffen <[e-mail]>
CommitDate: 2021-06-19 19:06:44 +0000

    dev-python/thrift: cleanup old
    
    Bug: https://bugs.gentoo.org/770145
    Package-Manager: Portage-3.0.18, Repoman-3.0.2
    Signed-off-by: Fabian Groffen <[e-mail]>

 dev-python/thrift/Manifest             |  1 -
 dev-python/thrift/thrift-0.13.0.ebuild | 25 -------------------------
 2 files changed, 26 deletions(-)

[Comment 12 John Helmert III 2021-06-19 21:34:12 UTC]

Thanks!

[Comment 13 John Helmert III 2021-07-08 01:13:31 UTC]

GLSA request filed.

[Comment 14 GLSAMaker/CVETool Bot 2021-07-14 03:13:50 UTC]

This issue was resolved and addressed in
 GLSA 202107-32 at https://security.gentoo.org/glsa/202107-32
by GLSA coordinator John Helmert III (ajak).