Not rated
CVE-2018-1320 Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the…
Description
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Thrift | Versions not published |
References
- lists.apache.org lists.apache.org
- 106551 www.securityfocus.com
- [debian-lts-announce] 20190206 [SECURITY] [DLA 1662-1] libthrift-java security update lists.debian.org
- [infra-devnull] 20190324 [GitHub] [thrift] luciferous opened pull request #1771: THRIFT-4506: fix use of assert for correctness in Java SASL negotiation lists.apache.org
- support.f5.com support.f5.com
- [storm-dev] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version lists.apache.org
- [storm-user] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version lists.apache.org
- [announce] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version lists.apache.org
- [oss-security] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version www.openwall.com
- RHSA-2019:2413 access.redhat.com
- www.oracle.com www.oracle.com
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities lists.apache.org
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15422) CVE-2018-1320(The libthrift component is vulnerable to Improper Access Control) on Cassendra 3.11.4 lists.apache.org
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20191119 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20191119 [jira] [Assigned] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- www.oracle.com www.oracle.com
- [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 lists.apache.org
- [cassandra-commits] 20210323 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20210415 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20210415 [jira] [Comment Edited] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20210415 [jira] [Commented] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Thrift
The 91 CVEs of Apache Thrift →
CVE-2026-120135
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings
8.2
High
CVE-2026-66054
Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification)…
6.9
Medium
CVE-2026-61374
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings
7.1
High
CVE-2026-63772
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings
8.7
High