fishy commented on PR #3057: URL: https://github.com/apache/thrift/pull/3057#issuecomment-2442643024
Actually, reading https://nvd.nist.gov/vuln/detail/CVE-2019-11939 again, I think this implement is sill vulnerable to a very similar attack: bad actor can construct a very small message with a size of 10MiB-1, and the server will still be tricked to do those large allocations, and spamming those malicious messages can still result in denial of service. To mitigate against this attack, we need to make the read limit configurable. There are 3 ways to do it: 1. Add a new config to TConfiguration for this 2. Just reuse the current `MaxMessageSize` configurable (which would mean that we can mostly revert https://github.com/apache/thrift/pull/2292 I think?) 3. Define the read limit as something like 1/10 of configured `MaxMessageSize`, and that 1/10 can be either hardcoded or configurable (but if it's configurable that's mostly just 1). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
