[ https://issues.apache.org/jira/browse/HBASE-24148?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17085873#comment-17085873 ]
Michael Stack commented on HBASE-24148: --------------------------------------- I'm wrong. It was mis-committed... yesterday to branch-2. Leaving it in. Applying to other branches now. commit 66a329e4b731fa3d2ed007f5dfadd827b77d943a Author: Tamas Penzes <tam...@cloudera.com> Date: Thu Apr 9 00:24:31 2020 +0200 HBASE-24148: Upgrade Thrift to 0.13.0: 0.12.0 has outstanding CVEs. Upgrade thrift from 0.12 to 0.13. So, I got master, branch-2, and branch-2.3. You have the rest [~apurtell] ? Shout and I could do branch-2.2... > Upgrade Thrift to 0.13.0: 0.12.0 has outstanding CVEs. > ------------------------------------------------------ > > Key: HBASE-24148 > URL: https://issues.apache.org/jira/browse/HBASE-24148 > Project: HBase > Issue Type: Improvement > Components: Thrift > Affects Versions: 3.0.0 > Reporter: Tamas Penzes > Assignee: Tamas Penzes > Priority: Major > Fix For: 3.0.0, 2.3.0, 1.7.0, 2.4.0, 2.2.5 > > > In Apache Thrift all versions up to and including 0.12.0, a server or client > may run into an endless loop when feed with specific input data. Because the > issue had already been partially fixed in version 0.11.0, depending on the > installed version it affects only certain language bindings. > To be on the safe side, we could update to 0.13.0. -- This message was sent by Atlassian Jira (v8.3.4#803005)