[
https://issues.apache.org/jira/browse/HBASE-24148?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17083784#comment-17083784
]
Michael Stack commented on HBASE-24148:
---------------------------------------
Rereading HBASE-21791 , there is profile to generate/compile thrift. I applied
[~tamaas]'s patch which takes care of upping the thrift version in poms. I then
ran the special profile as follows (AFTER installing thrift 0.13 -- I used brew
as in 'brew install thrift' and then checked the install with 'thrift
--version' to make sure I was on version 0.13.0).
{code}
$ mvn -Pcompile-thrift clean install -DskipTests
{code}
I put together [~tamaas] 's patch and the generated files to make a new PR.
> Upgrade Thrift to 0.13.0: 0.12.0 has outstanding CVEs.
> ------------------------------------------------------
>
> Key: HBASE-24148
> URL: https://issues.apache.org/jira/browse/HBASE-24148
> Project: HBase
> Issue Type: Improvement
> Components: Thrift
> Affects Versions: 3.0.0
> Reporter: Tamas Penzes
> Assignee: Tamas Penzes
> Priority: Major
> Fix For: 3.0.0, 2.3.0
>
>
> In Apache Thrift all versions up to and including 0.12.0, a server or client
> may run into an endless loop when feed with specific input data. Because the
> issue had already been partially fixed in version 0.11.0, depending on the
> installed version it affects only certain language bindings.
> To be on the safe side, we could update to 0.13.0.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
