CVE-2018-1320
published 2019-01-07CVE-2018-1320: Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
8.19%
94.2th percentile
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | thrift | 0.5.0 – 0.11.0 | — |
| apache_software_foundation | apache_thrift | — | — |
| debian | debian_linux | — | — |
| debian | libthrift-java | < libthrift-java 0.9.1-2.1 (bookworm) | libthrift-java 0.9.1-2.1 (bookworm) |
| f5 | traffix_signaling_delivery_controller | 5.0.0 – 5.1.0 | — |
| oracle | global_lifecycle_management_opatch | < 11.2.0.3.23 | 11.2.0.3.23 |
| oracle | global_lifecycle_management_opatch | >= 12.2.0.1.0 < 12.2.0.1.19 | 12.2.0.1.19 |
| oracle | global_lifecycle_management_opatch | >= 13.9.4.0.0 < 13.9.4.2.1 | 13.9.4.2.1 |
| oracle | nosql_database | < 19.3.12 | 19.3.12 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class
vendor_redhat·2018-03-05·CVSS 7.5
CVE-2018-1320 [HIGH] CWE-287 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class
thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Statement: OpenDaylight:
OpenDaylight includes libthrift, however does not use the vulnerable functionality. OpenDaylight should be considered not affected by this flaw.
Package: libthrift (Red Hat JBoss Data Virtualization 6) - Out of support scope
Package: libthrift (Red Hat JBoss Enterprise Application Platform 7) - Not affected
Package: libthrift (Red Hat
Debian
CVE-2018-1320: libthrift-java - Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL ...
vendor_debian·2018·CVSS 7.5
CVE-2018-1320 [HIGH] CVE-2018-1320: libthrift-java - Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL ...
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Scope: local
bookworm: resolved (fixed in 0.9.1-2.1)
forky: resolved (fixed in 0.9.1-2.1)
sid: resolved (fixed in 0.9.1-2.1)
trixie: resolved (fixed in 0.9.1-2.1)
OSV
Improper Input Validation in Apache Thrift
osv·2019-01-17
CVE-2018-1320 [HIGH] Improper Input Validation in Apache Thrift
Improper Input Validation in Apache Thrift
Apache Thrift Java client library versions 0.5.0 prior to 0.9.3-1 and 0.10.0 prior to 0.12.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
GHSA
Improper Input Validation in Apache Thrift
ghsa·2019-01-17
CVE-2018-1320 [HIGH] CWE-20 Improper Input Validation in Apache Thrift
Improper Input Validation in Apache Thrift
Apache Thrift Java client library versions 0.5.0 prior to 0.9.3-1 and 0.10.0 prior to 0.12.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
OSV
CVE-2018-1320: Apache Thrift Java client library versions 0
osv·2019-01-07·CVSS 7.5
CVE-2018-1320 [HIGH] CVE-2018-1320: Apache Thrift Java client library versions 0
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
No detection rules found.
Bugzilla
CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class [fedora-all]
bugzilla·2019-01-17·CVSS 7.5
CVE-2018-1320 [HIGH] CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class [fedora-all]
CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit mes
Bugzilla
CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class [epel-7]
bugzilla·2019-01-17·CVSS 7.5
CVE-2018-1320 [HIGH] CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class [epel-7]
CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Bugzilla
CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class
bugzilla·2019-01-17·CVSS 7.5
CVE-2018-1320 [HIGH] CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class
CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
References:
https://lists.apache.org/thread.html/da5234b5e78f1c99190407f791dfe1bf6c58de8d30d15974a9669be3@%3Cuser.thrift.apache.org%3E
Discussion:
Created thrift tracking bugs for this issue:
Affects: epel-7 [bug 1667205]
Affects: fedora-all [bug 1667206]
---
Statement:
OpenDaylight:
OpenDaylight includes libthrift, however does not use the v
Bugzilla
CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270
bugzilla·2018-04-09·CVSS 9.8
CVE-2018-1275 [CRITICAL] CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270
CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270
CVE-2018-1270, which permitted a malicious user to craft a STOMP message that could lead to remote code execution, was not fully addressed in the 4.3.x branch of the Spring Framework.
Discussion:
Upstream commit: https://github.com/spring-projects/spring-framework/commit/0009806debb578e884f6dc98bd1f2dc668020021
---
This issue has been addressed in the following products:
Red Hat Openshift Application Runtimes
Via RHSA-2018:1320 https://access.redhat.com/errata/RHSA-2018:1320
---
This issue has been addressed in the following products:
Red Hat Fuse Intergration Services 2.0 based on Fuse 6.3 R8
Via RHSA-2018:2939 https://access.redhat.com/errata/RHSA-2018:2939
http://www.openwall.com/lists/oss-security/2019/07/24/3http://www.securityfocus.com/bid/106551https://access.redhat.com/errata/RHSA-2019:2413https://lists.apache.org/thread.html/07c3cd5a2953a4b253eee4437b1397b1603d0f886437e19b657d2c54%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/187684ac8b94d55256253f5220cb55e8bd568afdf9a8a86e9bbb66c9%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/3d3b6849fcf4cd1e87703b3dde0d57aabeb9ba0193dc0cf3c97f545d%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/6b07f6f618155c777191b4fad8ade0f0cf4ed4c12a1a746ce903d816%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/8be5b16c02567fff61b1284e5df433a4e38617bc7de4804402bf62be%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/da5234b5e78f1c99190407f791dfe1bf6c58de8d30d15974a9669be3%40%3Cuser.thrift.apache.org%3Ehttps://lists.apache.org/thread.html/dbe3a39b48900318ad44494e8721f786901ba4520cd412c7698f534f%40%3Cdev.storm.apache.org%3Ehttps://lists.apache.org/thread.html/dfee89880c84874058c6a584d8128468f8d3c2ac25068ded91073adc%40%3Cuser.storm.apache.org%3Ehttps://lists.apache.org/thread.html/e825ff2f4e129c0ecdb6a19030b53c1ccdf810a8980667628d0c6a80%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/r09c3dcdccf4b74ad13bda79b354e6b793255ccfe245cca1b8cee23f5%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r1015eaadef8314daa9348aa423086a732cfeb998ceb5d42605c9b0b5%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r2278846f7ab06ec07a0aa31457235e0ded9191b216cba55f3f315f16%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r261972a3b14cf6f1dcd94b1b265e9ef644a38ccdf0d0238fa0c4d459%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r3d71a6dbb063aa61ba81278fe622b20bfe7501bb3821c27695641ac3%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/02/msg00008.htmlhttps://support.f5.com/csp/article/K36361684https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttp://www.openwall.com/lists/oss-security/2019/07/24/3http://www.securityfocus.com/bid/106551https://access.redhat.com/errata/RHSA-2019:2413https://lists.apache.org/thread.html/07c3cd5a2953a4b253eee4437b1397b1603d0f886437e19b657d2c54%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/187684ac8b94d55256253f5220cb55e8bd568afdf9a8a86e9bbb66c9%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/3d3b6849fcf4cd1e87703b3dde0d57aabeb9ba0193dc0cf3c97f545d%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/6b07f6f618155c777191b4fad8ade0f0cf4ed4c12a1a746ce903d816%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/8be5b16c02567fff61b1284e5df433a4e38617bc7de4804402bf62be%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3Ehttps://lists.apache.org/thread.html/da5234b5e78f1c99190407f791dfe1bf6c58de8d30d15974a9669be3%40%3Cuser.thrift.apache.org%3Ehttps://lists.apache.org/thread.html/dbe3a39b48900318ad44494e8721f786901ba4520cd412c7698f534f%40%3Cdev.storm.apache.org%3Ehttps://lists.apache.org/thread.html/dfee89880c84874058c6a584d8128468f8d3c2ac25068ded91073adc%40%3Cuser.storm.apache.org%3Ehttps://lists.apache.org/thread.html/e825ff2f4e129c0ecdb6a19030b53c1ccdf810a8980667628d0c6a80%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3Ehttps://lists.apache.org/thread.html/r09c3dcdccf4b74ad13bda79b354e6b793255ccfe245cca1b8cee23f5%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r1015eaadef8314daa9348aa423086a732cfeb998ceb5d42605c9b0b5%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r2278846f7ab06ec07a0aa31457235e0ded9191b216cba55f3f315f16%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r261972a3b14cf6f1dcd94b1b265e9ef644a38ccdf0d0238fa0c4d459%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r3d71a6dbb063aa61ba81278fe622b20bfe7501bb3821c27695641ac3%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2019/02/msg00008.htmlhttps://support.f5.com/csp/article/K36361684https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2019-01-07
Published