This vulnerability in Apache Thrift (before version 0.23.0) is classified as CWE-297 (Improper Validation of Certificate with Host Mismatch) and related CWEs CWE-306 and CWE-295. It allows an attacker to exploit improper certificate validation when the hostname does not match, potentially compromising confidentiality and integrity of communications. The CVSS v3.1 base score is 7.4, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. The vendor advisory recommends upgrading to Apache Thrift version 0.23.0 where the issue is fixed. Red Hat has published multiple advisories referencing this CVE, indicating that patches are available in their distributions.

The vulnerability allows attackers to bypass proper certificate hostname validation, potentially enabling man-in-the-middle attacks that compromise confidentiality and integrity of data transmitted via Apache Thrift. There is no known exploitation in the wild at this time. The impact does not affect availability.

A fix is available by upgrading Apache Thrift to version 0.23.0 or later. Users should apply this official update to remediate the vulnerability. Red Hat has issued security advisories and errata that provide patches for affected Red Hat products. Users of Red Hat distributions should apply the relevant security updates as per the vendor advisories. No alternative mitigations or workarounds are specified.