Reported By: Asger Feldthaus Vendor: The Apache Software Foundation Product: Apache Thrift Problem Type: Improper Access Control Versions Affected: Apache Thrift versions 0.9.2 through 0.11.0 Mitigation: Upgrading to the latest 0.12.0 release
Description: The Apache Thrift Node.js static file server has been determined to have a security vulnerability in it which a remote user has the ability to access files outside the set webservers docroot path. Resolution: The code which sets the visible path for the static files to be served will now verify that the requested path is within the specified webservers docroot path and not allow a malicious user to escape out of the configured path. Jira issue: - https://issues.apache.org/jira/browse/THRIFT-4647 Mitre issue: - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11798 Committed resolution: - *https://github.com/apache/thrift/commit/2a2b72f6c8aef200ecee4984f011e06052288ff2 <https://github.com/apache/thrift/commit/2a2b72f6c8aef200ecee4984f011e06052288ff2>* On behalf of the Apache Thrift PMC, Thank you
