Arch Linux Security Advisory ASA-202102-43 ========================================== Severity: Medium Date : 2021-02-27 CVE-ID : CVE-2020-13949 Package : thrift Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-1568 Summary ======= The package thrift before version 0.14.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 0.14.0-1. # pacman -Syu "thrift>=0.14.0-1" The problem has been fixed upstream in version 0.14.0. Workaround ========== None. Description =========== Applications using Thrift before version 0.14.0 would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. Impact ====== Malicious clients could send crafted messages crashing the server. References ========== https://www.openwall.com/lists/oss-security/2021/02/11/2 https://security.archlinux.org/CVE-2020-13949