CVE-2020-13949 - Uncontrolled Resource Consumption

[MGathier]

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages, which would allocate a large amount of memory, potentially leading to a denial of service.

Found in libthrift 0.11.0, resolved in 0.14.0

[MGathier]

This is a server-side vulnerability. As Axon Server only uses Apache Thrift as a client to send to Jaeger, this vulnerability does not apply to Axon Server.

Axon Server only uses libthrift when gRPC metrics are enabled and exported to Jaeger (axoniq.axonserver.metrics.grpc.jaeger-enabled=true). It is not possible to upgrade to a more recent version of libthrift, as this is not compatible with the jaeger client version.