Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/facebook/fbthrift < 0.31.1-0.20200311080807-483ed864d69f
Fixed in
0.31.1-0.20200311080807-483ed864d69f· Vendor fix available
Issue
Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00. Specific Go Packages Affected github.com/facebook/fbthrift/thrift/lib/go/thrift
Recommended action: Upgrade to 0.31.1-0.20200311080807-483ed864d69f (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/facebook/fbthrift < 0.31.1-0.20190225164308-c461c1bd1a3e
Fixed in
0.31.1-0.20190225164308-c461c1bd1a3e· Vendor fix available
Issue
Go Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.03.04.00.
Recommended action: Upgrade to 0.31.1-0.20190225164308-c461c1bd1a3e (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.