NetSight
IP …
high7.5

CVE-2018-1320

Improper Input Validation in Apache Thrift

Impact

Apache Thrift Java client library versions 0.5.0 prior to 0.9.3-1 and 0.10.0 prior to 0.12.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.thrift:libthrift>= 0.5.0, < 0.9.3-10.9.3-1

Affected products

VendorProductAffected versions
ApacheThrift
from 0.5.0 through 0.11.0
DebianDebian Linux
Version 8.0
F5Traffix Signaling Delivery Controller
from 5.0.0 through 5.1.0
OracleGlobal Lifecycle Management Opatch
before 11.2.0.3.23
from 12.2.0.1.0 before 12.2.0.1.19
from 13.9.4.0.0 before 13.9.4.2.1
OracleNosql Database
before 19.3.12

Weakness classification

CWE-295CWE-20

References