<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">CVE-2019-0205</DocumentTitle>
  <DocumentType>SUSE CVE</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE CVE-2019-0205</ID>
    </Identification>
    <Status>Interim</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>23</Number>
        <Date>2025-02-17T02:26:00Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2021-05-30T14:21:03Z</InitialReleaseDate>
    <CurrentReleaseDate>2025-02-17T02:26:00Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf-cve.pl</Engine>
      <Date>2020-12-27T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="CVE" Type="Summary" Ordinal="1" xml:lang="en">CVE-2019-0205</Note>
    <Note Title="Mitre CVE Description" Type="Description" Ordinal="2" xml:lang="en">In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="4" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="HPE Helion OpenStack 8">
      <Branch Type="Product Name" Name="HPE Helion OpenStack 8">
        <FullProductName ProductID="HPE Helion OpenStack 8" CPE="cpe:/o:suse:hpe-helion-openstack:8">HPE Helion OpenStack 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="HPE Helion OpenStack Cloud 8">
      <Branch Type="Product Name" Name="HPE Helion OpenStack Cloud 8">
        <FullProductName ProductID="HPE Helion OpenStack Cloud 8">HPE Helion OpenStack Cloud 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 8">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 8">
        <FullProductName ProductID="SUSE OpenStack Cloud 8" CPE="cpe:/o:suse:suse-openstack-cloud:8">SUSE OpenStack Cloud 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 9">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 9">
        <FullProductName ProductID="SUSE OpenStack Cloud 9" CPE="cpe:/o:suse:suse-openstack-cloud:9">SUSE OpenStack Cloud 9</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud Crowbar 8">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud Crowbar 8">
        <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 8" CPE="cpe:/o:suse:suse-openstack-cloud-crowbar:8">SUSE OpenStack Cloud Crowbar 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud Crowbar 9">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud Crowbar 9">
        <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 9" CPE="cpe:/o:suse:suse-openstack-cloud-crowbar:9">SUSE OpenStack Cloud Crowbar 9</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="python-thrift">
      <FullProductName ProductID="python-thrift">python-thrift</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="thrift">
      <FullProductName ProductID="thrift" CPE="cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*">thrift</FullProductName>
    </Branch>
    <Relationship ProductReference="python-thrift" RelationType="Default Component Of" RelatesToProductReference="HPE Helion OpenStack 8">
      <FullProductName ProductID="HPE Helion OpenStack 8:python-thrift">python-thrift as a component of HPE Helion OpenStack 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="thrift" RelationType="Default Component Of" RelatesToProductReference="HPE Helion OpenStack 8">
      <FullProductName ProductID="HPE Helion OpenStack 8:thrift">thrift as a component of HPE Helion OpenStack 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="thrift" RelationType="Default Component Of" RelatesToProductReference="HPE Helion OpenStack Cloud 8">
      <FullProductName ProductID="HPE Helion OpenStack Cloud 8:thrift">thrift as a component of HPE Helion OpenStack Cloud 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-thrift" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 8">
      <FullProductName ProductID="SUSE OpenStack Cloud 8:python-thrift">python-thrift as a component of SUSE OpenStack Cloud 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="thrift" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 8">
      <FullProductName ProductID="SUSE OpenStack Cloud 8:thrift">thrift as a component of SUSE OpenStack Cloud 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-thrift" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 9">
      <FullProductName ProductID="SUSE OpenStack Cloud 9:python-thrift">python-thrift as a component of SUSE OpenStack Cloud 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="thrift" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 9">
      <FullProductName ProductID="SUSE OpenStack Cloud 9:thrift">thrift as a component of SUSE OpenStack Cloud 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-thrift" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 8">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 8:python-thrift">python-thrift as a component of SUSE OpenStack Cloud Crowbar 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="thrift" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 8">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 8:thrift">thrift as a component of SUSE OpenStack Cloud Crowbar 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-thrift" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 9">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 9:python-thrift">python-thrift as a component of SUSE OpenStack Cloud Crowbar 9</FullProductName>
    </Relationship>
    <Relationship ProductReference="thrift" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud Crowbar 9">
      <FullProductName ProductID="SUSE OpenStack Cloud Crowbar 9:thrift">thrift as a component of SUSE OpenStack Cloud Crowbar 9</FullProductName>
    </Relationship>
  </ProductTree>
  <Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.</Note>
    </Notes>
    <CVE>CVE-2019-0205</CVE>
    <ProductStatuses>
      <Status Type="Known Not Affected">
        <ProductID>HPE Helion OpenStack 8:python-thrift</ProductID>
        <ProductID>HPE Helion OpenStack 8:thrift</ProductID>
        <ProductID>HPE Helion OpenStack Cloud 8:thrift</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:python-thrift</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:thrift</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:python-thrift</ProductID>
        <ProductID>SUSE OpenStack Cloud 9:thrift</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 8:python-thrift</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 8:thrift</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:python-thrift</ProductID>
        <ProductID>SUSE OpenStack Cloud Crowbar 9:thrift</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.8</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
  </Vulnerability>
</cvrfdoc>
