Non notée
CVE-2018-1320 Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the…
Description
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Thrift | Versions non publiées |
Références
- lists.apache.org lists.apache.org
- 106551 www.securityfocus.com
- [debian-lts-announce] 20190206 [SECURITY] [DLA 1662-1] libthrift-java security update lists.debian.org
- [infra-devnull] 20190324 [GitHub] [thrift] luciferous opened pull request #1771: THRIFT-4506: fix use of assert for correctness in Java SASL negotiation lists.apache.org
- support.f5.com support.f5.com
- [storm-dev] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version lists.apache.org
- [storm-user] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version lists.apache.org
- [announce] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version lists.apache.org
- [oss-security] 20190724 [CVE-2018-1320] Apache Storm vulnerable Thrift version www.openwall.com
- RHSA-2019:2413 access.redhat.com
- www.oracle.com www.oracle.com
- [drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities lists.apache.org
- [drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- [drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities lists.apache.org
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15422) CVE-2018-1320(The libthrift component is vulnerable to Improper Access Control) on Cassendra 3.11.4 lists.apache.org
- [cassandra-commits] 20191113 [jira] [Created] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20191119 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20191119 [jira] [Assigned] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- www.oracle.com www.oracle.com
- [cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 lists.apache.org
- [cassandra-commits] 20210323 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20210415 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20210415 [jira] [Comment Edited] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20210415 [jira] [Commented] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
- [cassandra-commits] 20210924 [jira] [Updated] (CASSANDRA-15424) CVE-2018-1320 (The libthrift component is vulnerable to Improper Access Control) lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Thrift
Les 91 CVE de Apache Thrift →
CVE-2026-120135
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings
8.2
Élevée
CVE-2026-66054
Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification)…
6.9
Moyenne
CVE-2026-61374
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings
7.1
Élevée
CVE-2026-63772
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings
8.7
Élevée