CVE-2018-11798

Fixed in a distro release EPSS 5%

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

Published 2019-01-07 · CVE record · OSV

Products: Apache Software Foundation Apache Thrift

Fixed upstream

Ecosystem	Package	Fixed in
Maven	org.apache.thrift:libthrift	0.12.0

Distro releases

Release	Package	Fixed in
Chainguard	automq	no fix
Chainguard	automq	0
Chainguard	automq-fips	1.7.4-r1
Chainguard	automq-fips	0
Chainguard	druid	no fix
Chainguard	druid	35.0.1-r1
Chainguard	trino	440-r0
Chainguard	trino-config	440-r0
Chainguard	trino-oci-entrypoint	440-r0
Chainguard	trino-plugin-accumulo	440-r0
Chainguard	trino-plugin-ai-functions	440-r0
Chainguard	trino-plugin-atop	440-r0
Chainguard	trino-plugin-bigquery	440-r0
Chainguard	trino-plugin-blackhole	440-r0
Chainguard	trino-plugin-cassandra	440-r0
Chainguard	trino-plugin-clickhouse	440-r0
Chainguard	trino-plugin-delta-lake	440-r0
Chainguard	trino-plugin-druid	440-r0
Chainguard	trino-plugin-duckdb	440-r0
Chainguard	trino-plugin-elasticsearch	440-r0
Chainguard	trino-plugin-example-http	440-r0
Chainguard	trino-plugin-exasol	440-r0
Chainguard	trino-plugin-exchange-filesystem	440-r0
Chainguard	trino-plugin-exchange-hdfs	440-r0
Chainguard	trino-plugin-faker	440-r0
Chainguard	trino-plugin-functions-python	440-r0
Chainguard	trino-plugin-geospatial	440-r0
Chainguard	trino-plugin-google-sheets	440-r0
Chainguard	trino-plugin-hive	440-r0
Chainguard	trino-plugin-http-event-listener	440-r0
Chainguard	trino-plugin-http-server-event-listener	440-r0
Chainguard	trino-plugin-hudi	440-r0
Chainguard	trino-plugin-iceberg	440-r0
Chainguard	trino-plugin-ignite	440-r0
Chainguard	trino-plugin-jmx	440-r0
Chainguard	trino-plugin-kafka	440-r0
Chainguard	trino-plugin-kafka-event-listener	440-r0
Chainguard	trino-plugin-kinesis	440-r0
Chainguard	trino-plugin-kudu	440-r0
Chainguard	trino-plugin-lakehouse	440-r0
Chainguard	trino-plugin-ldap-group-provider	440-r0
Chainguard	trino-plugin-local-file	440-r0
Chainguard	trino-plugin-loki	440-r0
Chainguard	trino-plugin-mariadb	440-r0
Chainguard	trino-plugin-memory	440-r0
Chainguard	trino-plugin-ml	440-r0
Chainguard	trino-plugin-mongodb	440-r0
Chainguard	trino-plugin-mysql	440-r0
Chainguard	trino-plugin-mysql-event-listener	440-r0
Chainguard	trino-plugin-opa	440-r0
Chainguard	trino-plugin-openlineage	440-r0
Chainguard	trino-plugin-opensearch	440-r0
Chainguard	trino-plugin-oracle	440-r0
Chainguard	trino-plugin-password-authenticators	440-r0
Chainguard	trino-plugin-phoenix5	440-r0
Chainguard	trino-plugin-pinot	440-r0
Chainguard	trino-plugin-postgresql	440-r0
Chainguard	trino-plugin-prometheus	440-r0
Chainguard	trino-plugin-ranger	440-r0
Chainguard	trino-plugin-raptor-legacy	440-r0
Chainguard	trino-plugin-redis	440-r0
Chainguard	trino-plugin-redshift	440-r0
Chainguard	trino-plugin-resource-group-managers	440-r0
Chainguard	trino-plugin-session-property-managers	440-r0
Chainguard	trino-plugin-singlestore	440-r0
Chainguard	trino-plugin-snowflake	440-r0
Chainguard	trino-plugin-spooling-filesystem	440-r0
Chainguard	trino-plugin-sqlserver	440-r0
Chainguard	trino-plugin-teradata-functions	440-r0
Chainguard	trino-plugin-thrift	440-r0
Chainguard	trino-plugin-tpcds	440-r0
Chainguard	trino-plugin-tpch	440-r0
Chainguard	trino-plugin-vertica	440-r0
Debian 12	thrift	0.11.0-4
Debian 13	thrift	0.11.0-4
Debian 14	thrift	0.11.0-4
Wolfi	druid	no fix
Wolfi	druid	35.0.1-r1
Wolfi	trino	440-r0
Wolfi	trino-config	440-r0
Wolfi	trino-oci-entrypoint	440-r0
Wolfi	trino-plugin-accumulo	440-r0
Wolfi	trino-plugin-ai-functions	440-r0
Wolfi	trino-plugin-atop	440-r0
Wolfi	trino-plugin-bigquery	440-r0
Wolfi	trino-plugin-blackhole	440-r0
Wolfi	trino-plugin-cassandra	440-r0
Wolfi	trino-plugin-clickhouse	440-r0
Wolfi	trino-plugin-delta-lake	440-r0
Wolfi	trino-plugin-druid	440-r0
Wolfi	trino-plugin-duckdb	440-r0
Wolfi	trino-plugin-elasticsearch	440-r0
Wolfi	trino-plugin-example-http	440-r0
Wolfi	trino-plugin-exasol	440-r0
Wolfi	trino-plugin-exchange-filesystem	440-r0
Wolfi	trino-plugin-exchange-hdfs	440-r0
Wolfi	trino-plugin-faker	440-r0
Wolfi	trino-plugin-functions-python	440-r0
Wolfi	trino-plugin-geospatial	440-r0
Wolfi	trino-plugin-google-sheets	440-r0
Wolfi	trino-plugin-hive	440-r0
Wolfi	trino-plugin-http-event-listener	440-r0
Wolfi	trino-plugin-http-server-event-listener	440-r0
Wolfi	trino-plugin-hudi	440-r0
Wolfi	trino-plugin-iceberg	440-r0
Wolfi	trino-plugin-ignite	440-r0
Wolfi	trino-plugin-jmx	440-r0
Wolfi	trino-plugin-kafka	440-r0
Wolfi	trino-plugin-kafka-event-listener	440-r0
Wolfi	trino-plugin-kinesis	440-r0
Wolfi	trino-plugin-kudu	440-r0
Wolfi	trino-plugin-lakehouse	440-r0
Wolfi	trino-plugin-ldap-group-provider	440-r0
Wolfi	trino-plugin-local-file	440-r0
Wolfi	trino-plugin-loki	440-r0
Wolfi	trino-plugin-mariadb	440-r0
Wolfi	trino-plugin-memory	440-r0
Wolfi	trino-plugin-ml	440-r0
Wolfi	trino-plugin-mongodb	440-r0
Wolfi	trino-plugin-mysql	440-r0
Wolfi	trino-plugin-mysql-event-listener	440-r0
Wolfi	trino-plugin-opa	440-r0
Wolfi	trino-plugin-openlineage	440-r0
Wolfi	trino-plugin-opensearch	440-r0
Wolfi	trino-plugin-oracle	440-r0
Wolfi	trino-plugin-password-authenticators	440-r0
Wolfi	trino-plugin-phoenix5	440-r0
Wolfi	trino-plugin-pinot	440-r0
Wolfi	trino-plugin-postgresql	440-r0
Wolfi	trino-plugin-prometheus	440-r0
Wolfi	trino-plugin-ranger	440-r0
Wolfi	trino-plugin-raptor-legacy	440-r0
Wolfi	trino-plugin-redis	440-r0
Wolfi	trino-plugin-redshift	440-r0
Wolfi	trino-plugin-resource-group-managers	440-r0
Wolfi	trino-plugin-session-property-managers	440-r0
Wolfi	trino-plugin-singlestore	440-r0
Wolfi	trino-plugin-snowflake	440-r0
Wolfi	trino-plugin-spooling-filesystem	440-r0
Wolfi	trino-plugin-sqlserver	440-r0
Wolfi	trino-plugin-teradata-functions	440-r0
Wolfi	trino-plugin-thrift	440-r0
Wolfi	trino-plugin-tpcds	440-r0
Wolfi	trino-plugin-tpch	440-r0
Wolfi	trino-plugin-vertica	440-r0