CVEvulnerability

CVE-2018-1320

7.5 HIGH Published 2019-01-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-01-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-295

Description

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

Affected configurations

• apache thrift (>= 0.5.0 <= 0.11.0) • debian debian linux 8.0 • f5 traffix signaling delivery controller (>= 5.0.0 <= 5.1.0) • oracle global lifecycle management opatch (< 11.2.0.3.23) • oracle global lifecycle management opatch (>= 12.2.0.1.0 < 12.2.0.1.19) • oracle global lifecycle management opatch (>= 13.9.4.0.0 < 13.9.4.2.1) • oracle nosql database (< 19.3.12)

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References