In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

The remote host is affected by the vulnerability described in GLSA-202107-32 (Apache Thrift: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache Thrift. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the version of the isula-sec package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients     could send short messages which would result in a large     memory allocation, potentially leading to denial of     service.(CVE-2020-13949)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
157019	GLSA-202107-32 : Apache Thrift: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
150189	EulerOS 2.0 SP9 : isula-sec (EulerOS-SA-2021-1928)	Nessus	Huawei Local Security Checks	high
150169	EulerOS 2.0 SP9 : isula-sec (EulerOS-SA-2021-1949)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2020-13949

high

Tenable Plugins

high

high

high