Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Thrift | Apache | * | 0.24.0 (excluding) |
| Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 | RedHat | libthrift | * |
| Red Hat Hardened Images | RedHat | opentelemetry-collector-contrib-main-0.157.0-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | opentelemetry-collector-main-0.157.0-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | loki3-7-main-3.7.4-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | jaeger-main-2.20.0-0.4.hum1 | * |
| Red Hat Hardened Images | RedHat | jaeger-main-2.20.0-0.5.hum1 | * |
| Red Hat Hardened Images | RedHat | tempo2-10-main-2.10.7-0.2.hum1 | * |
| Red Hat Hardened Images | RedHat | tempo3-0-main-3.0.2-0.2.hum1 | * |