Apache Software Foundation Apache Thrift vulnerabilities

3 known vulnerabilities affecting apache_software_foundation/apache_thrift.

Total CVEs

3

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH2MEDIUM1

Vulnerabilities

Page 1 of 1

CVE-2018-1320HIGHCVSS 7.5vApache Thrift 0.5.0 to 0.11.02019-01-07

CVE-2018-1320 [HIGH] CWE-295 CVE-2018-1320: Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComple Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

CVE-2018-11798MEDIUMCVSS 6.5vApache Thrift 0.9.2 to 0.11.02019-01-07

CVE-2018-11798 [MEDIUM] CWE-538 CVE-2018-11798: The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

CVE-2016-5397HIGHCVSS 8.8vversions prior to 0.10.02018-02-12

CVE-2016-5397 [HIGH] CWE-77 CVE-2016-5397: The Apache Thrift Go client library exposed the potential during code generation for command injecti The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.