CVE-2018-1320

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the…

published January 7, 2019

CVSS
—
EPSS
8%
Percentile
94.9
In the wild
Unconfirmed
What it is

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08188 · 94.9th percentile
Published
2019-01-07T18:00Z
EPSS history
Timeline
  • 07 JAN 18:00Z
    Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the…
    cvelistv5