[SPARK-36994] Upgrade Apache Thrift

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.0.1
• Component/s: Security
• Assignee: Unassigned
• Reporter: kaja girish
• Created: 13/Oct/21 06:36
• Updated: 09/Feb/24 18:13
• Resolved: 20/Feb/22 20:37

Description

Image:

• spark:3.0.1

Components Affected: 

• Apache Thrift

Recommendation:

• upgrade Apache Thrift 

CVE:

 

Component Name	Component Version Name	Vulnerability	Fixed version
Apache Thrift	0.11.0-4.	CVE-2019-0205	0.13.0
Apache Thrift	0.11.0-4.	CVE-2019-0210	0.13.0
Apache Thrift	0.11.0-4.	CVE-2020-13949	0.14.1

Issue Links

• duplicates: SPARK-37090 Upgrade libthrift to resolve security vulnerabilities
• is related to: SPARK-47018 Upgrade built-in Hive to 2.3.10
• links to: [Github] Pull Request #34280 (HyukjinKwon)
• links to: [Github] Pull Request #34280 (HyukjinKwon)