Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default

Summary

Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Remediation

1. Inventory every Apache Software Foundation Apache Thrift deployment, including staging.
2. Upgrade Apache Software Foundation Apache Thrift to 0.24.0.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9
• Advisoryhttps://lists.apache.org/thread/2zzkm3mfhfg79ohjo37pg1gms5nto588