[ https://issues.apache.org/jira/browse/HBASE-24148?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17085208#comment-17085208 ]
Hudson commented on HBASE-24148: -------------------------------- Results for branch branch-2 [build #2611 on builds.a.o|https://builds.apache.org/job/HBase%20Nightly/job/branch-2/2611/]: (x) *{color:red}-1 overall{color}* ---- details (if available): (/) {color:green}+1 general checks{color} -- For more information [see general report|https://builds.apache.org/job/HBase%20Nightly/job/branch-2/2611/General_20Nightly_20Build_20Report/] (x) {color:red}-1 jdk8 hadoop2 checks{color} -- For more information [see jdk8 (hadoop2) report|https://builds.apache.org/job/HBase%20Nightly/job/branch-2/2611/JDK8_20Nightly_20Build_20Report_20_28Hadoop2_29/] (/) {color:green}+1 jdk8 hadoop3 checks{color} -- For more information [see jdk8 (hadoop3) report|https://builds.apache.org/job/HBase%20Nightly/job/branch-2/2611/JDK8_20Nightly_20Build_20Report_20_28Hadoop3_29/] (/) {color:green}+1 jdk11 hadoop3 checks{color} -- For more information [see jdk11 report|https://builds.apache.org/job/HBase%20Nightly/job/branch-2/2611/JDK11_20Nightly_20Build_20Report_20_28Hadoop3_29/] (/) {color:green}+1 source release artifact{color} -- See build output for details. (/) {color:green}+1 client integration test{color} > Upgrade Thrift to 0.13.0: 0.12.0 has outstanding CVEs. > ------------------------------------------------------ > > Key: HBASE-24148 > URL: https://issues.apache.org/jira/browse/HBASE-24148 > Project: HBase > Issue Type: Improvement > Components: Thrift > Affects Versions: 3.0.0 > Reporter: Tamas Penzes > Assignee: Tamas Penzes > Priority: Major > Fix For: 3.0.0, 2.3.0, 1.7.0, 2.4.0, 2.2.5 > > > In Apache Thrift all versions up to and including 0.12.0, a server or client > may run into an endless loop when feed with specific input data. Because the > issue had already been partially fixed in version 0.11.0, depending on the > installed version it affects only certain language bindings. > To be on the safe side, we could update to 0.13.0. -- This message was sent by Atlassian Jira (v8.3.4#803005)