chainguard/trino-plugin-thrift

Vulnerabilities (79)

• CVE-2023-44981Oct 11, 2023
  affected < 478-r2fixed 478-r2

  Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.c

• CVE-2023-42503Sep 14, 2023
  affected < 444-r0fixed 444-r0

  Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue. A third party can

• CVE-2023-38647Jul 26, 2023
  affected < 449-r0fixed 449-r0

  An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. Th

• CVE-2023-3635Jul 12, 2023
  affected < 469-r0fixed 469-r0

  GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class.

• CVE-2023-2976Jun 14, 2023
  affected < 439-r0fixed 439-r0

  Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to

• CVE-2022-3510Nov 11, 2022
  affected < 439-r0fixed 439-r0

  A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeat

• CVE-2022-3509Nov 1, 2022
  affected < 439-r0fixed 439-r0

  A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown

• CVE-2022-3171Oct 12, 2022
  affected < 439-r0fixed 439-r0

  A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be

• CVE-2022-39135Sep 11, 2022
  affected < 453-r2fixed 453-r2

  Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposin

• CVE-2022-36364Jul 28, 2022
  affected < 453-r2fixed 453-r2

  Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution l

• CVE-2022-25647May 1, 2022
  affected < 439-r0fixed 439-r0

  The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.

• CVE-2021-22569Jan 7, 2022
  affected < 439-r0fixed 439-r0

  An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause fre

• CVE-2020-13949Feb 12, 2021
  affected < 440-r0fixed 440-r0

  In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

• CVE-2020-8908Dec 10, 2020
  affected < 439-r0fixed 439-r0

  A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the

• CVE-2020-13956Dec 2, 2020
  affected < 440-r0fixed 440-r0

  Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

• CVE-2019-0205Oct 28, 2019
  affected < 440-r0fixed 440-r0

  In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language

• CVE-2019-10086Aug 20, 2019
  affected < 439-r0fixed 439-r0

  In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the Prop

• CVE-2018-11798Jan 7, 2019
  affected < 440-r0fixed 440-r0

  The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

• CVE-2012-5783Nov 4, 2012
  affected < 445-r0fixed 445-r0

  Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows m