Improper Input Validation in Apache Thrift

🗓️ 17 Jan 2019 13:56:40Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 51 Views

Improper Input Validation in Apache Thrift Java client library version

Reporter	Title	Published	Views	Family All 44
IBM Security Bulletins	Security Bulletin: IBM Integration Bus is vulnerable to a remote attack & denial of service due to Apache Thrift & Apache Commons Codec (CVE-2018-1320, CVE-2019-0205, IBM X-Force ID: 177835)	22 Mar 202317:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Apache Thrift security bypass vulnerability[ CVE-2018-1320]	5 Aug 202420:54	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities.	15 Dec 202209:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	13 Apr 202120:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities in Apache Thrift	20 Jun 202216:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in libthrift affect IBM Application Performance Management products	13 Sep 202308:02	–	ibm
BDU FSTEC	The vulnerability of the org.apache.thrift.transport.TSaslTransport class in the Apache Thrift interface description allows a attacker to circumvent SASL protocols.	29 Oct 201900:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the org.apache.thrift.transport.TSaslTransport class in the Apache Thrift interface description allows a perpetrator to gain unauthorized access to protected information.	26 Nov 201900:00	–	bdu_fstec
Chainguard	CVE-2018-1320 vulnerabilities	15 Mar 202510:12	–	cgr
CNVD	Apache Thrift Java client library authorization issue vulnerability	8 Jan 201900:00	–	cnvd

Vulners

Node

org.apache.thrift libthriftRange0.10.0–0.12.0maven

OR

org.apache.thrift libthriftRange0.5.0–0.9.3-1maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-1320
access	www.access.redhat.com/errata/RHSA-2019:2413
lists	www.lists.apache.org/thread.html/07c3cd5a2953a4b253eee4437b1397b1603d0f886437e19b657d2c54@%3Ccommits.cassandra.apache.org%3E
lists	www.lists.apache.org/thread.html/187684ac8b94d55256253f5220cb55e8bd568afdf9a8a86e9bbb66c9@%3Cdevnull.infra.apache.org%3E
lists	www.lists.apache.org/thread.html/3d3b6849fcf4cd1e87703b3dde0d57aabeb9ba0193dc0cf3c97f545d@%3Ccommits.cassandra.apache.org%3E
lists	www.lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
lists	www.lists.apache.org/thread.html/6b07f6f618155c777191b4fad8ade0f0cf4ed4c12a1a746ce903d816@%3Ccommits.cassandra.apache.org%3E
lists	www.lists.apache.org/thread.html/8be5b16c02567fff61b1284e5df433a4e38617bc7de4804402bf62be@%3Ccommits.cassandra.apache.org%3E
lists	www.lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
lists	www.lists.apache.org/thread.html/da5234b5e78f1c99190407f791dfe1bf6c58de8d30d15974a9669be3@%3Cuser.thrift.apache.org%3E

04 Mar 2024 20:36Current

3.8Low risk

Vulners AI Score3.8

CVSS 25

CVSS 3.17.5

EPSS0.00092

apache thrift input validation java sasl negotiation tsasltransport production settings