[SPARK-24229] Upgrade to the latest Apache Thrift 0.10.0 release

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Not A Problem
• Affects Version/s: 2.3.0
• Component/s: Java API
• Assignee: Unassigned
• Reporter: Ray Donnelly
• Created: 09/May/18 22:39
• Updated: 10/Nov/18 01:40
• Resolved: 10/Nov/18 01:38

Description

According to https://www.cvedetails.com/cve/CVE-2016-5397/

 

.. there are critical vulnerabilities in libthrift 0.9.3 currently vendored in Apache Spark (and then, for us, into PySpark).

 

Can anyone help to assess the seriousness of this and what should be done about it?

 

Issue Links

• links to: [Github] Pull Request #22992 (Fokko)