QwikSec

Security Database

CVE

CWE

Training

CVE-2018-1320

Published: Jan 7, 2019

Modified: Aug 5, 2024

PUBLISHED

Description

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

Vendor	Product	Versions
Apache Software Foundation	Apache Thrift	affected `Apache Thrift 0.5.0 to 0.11.0`

References

https://lists.apache.org/thread.html/da5234b5e78f1c99190407f791dfe1bf6c58de8d30d15974a9669be3%40%3Cuser.thrift.apache.org%3E

x_refsource_MISC

vdb-entry

x_refsource_BID

[debian-lts-announce] 20190206 [SECURITY] [DLA 1662-1] libthrift-java security update

mailing-list

x_refsource_MLIST

[infra-devnull] 20190324 [GitHub] [thrift] luciferous opened pull request #1771: THRIFT-4506: fix use of assert for correctness in Java SASL negotiation

mailing-list

x_refsource_MLIST

https://support.f5.com/csp/article/K36361684

x_refsource_CONFIRM

[storm-dev] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version

mailing-list

x_refsource_MLIST

[storm-user] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version

mailing-list

x_refsource_MLIST

[announce] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version

mailing-list

x_refsource_MLIST

[oss-security] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_REDHAT

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

x_refsource_MISC

[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities

mailing-list

x_refsource_MLIST

[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities

mailing-list

x_refsource_MLIST

[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities

mailing-list

x_refsource_MLIST

[cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15422) CVE-2018-1320(The libthrift component is vulnerable to Improper Access Control) on Cassendra 3.11.4

mailing-list

x_refsource_MLIST

[cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control)

mailing-list

x_refsource_MLIST

[cassandra-commits] 20191119 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control)

mailing-list

x_refsource_MLIST

[cassandra-commits] 20191119 [jira] [Assigned] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control)

mailing-list

x_refsource_MLIST

https://www.oracle.com/security-alerts/cpuapr2020.html

x_refsource_MISC

[cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6

mailing-list

x_refsource_MLIST

[cassandra-commits] 20210323 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control)

mailing-list

x_refsource_MLIST

[cassandra-commits] 20210415 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control)

mailing-list

x_refsource_MLIST

[cassandra-commits] 20210415 [jira] [Comment Edited] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control)

mailing-list

x_refsource_MLIST

[cassandra-commits] 20210415 [jira] [Commented] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control)

mailing-list

x_refsource_MLIST

[cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control)

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.