[HBASE-25568] Upgrade Thrift jar to fix CVE-2020-13949

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.2.7, 2.5.0, 2.3.5, 2.4.3
• Component/s: Thrift
• Assignee: Pankaj Kumar
• Reporter: Pankaj Kumar
• Created: 12/Feb/21 05:57
• Updated: 15/Apr/21 22:07
• Resolved: 25/Mar/21 20:14

Description

There is potential DoS when processing untrusted Thrift payloads,
https://seclists.org/oss-sec/2021/q1/140

Issue Links

• relates to: HBASE-25755 Exclude tomcat-embed-core from libthrift
• links to: GitHub Pull Request #2958
• links to: GitHub Pull Request #3043
• links to: GitHub Pull Request #3083
• links to: GitHub Pull Request #3084
• links to: GitHub Pull Request #3085
• links to: GitHub Pull Request #3086