Package
spark-fips-3.5-scala-2.12
Component
libthrift
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
GHSA-g2fg-mr77-6vrm (CVE-2020-13949) is fixed in libthrift 0.14.0. libthrift 0.14.0 and later cannot be used with the Hive 2.3.9 thrift classes this release line ships: 0.14.0 adds the abstract method TTransport.checkReadBytesAvailable(long), which Hive 2.3.9's TUGIAssumingTransport does not implement, and removes the TThreadPoolServer.Args requestTimeout and beBackoffSlotLength settings that the thrift server module calls. Upstream raised libthrift to 0.16.0 for this CVE (SPARK-37090) and reverted it because of the resulting regression (apache/spark pull 35646); the work was superseded by upgrading the built-in Hive to 2.3.10 (SPARK-47018), released in Spark 4.0.0. This remains pending an upstream move to a compatible Hive release.
Status