CVE-2018-1320

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-1320
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1320.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2018-1320
Aliases
Downstream
Published
2019-01-07T17:29:00.360Z
Modified
2026-07-17T21:14:07.260076300Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:*"
            ],
            "vendor_product": "f5:traffix_signaling_delivery_controller",
            "extracted_events": [
                {
                    "introduced": "5.0.0"
                },
                {
                    "last_affected": "5.1.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE",
            "vendor_product": "oracle:global_lifecycle_management_opatch",
            "extracted_events": [
                {
                    "fixed": "11.2.0.3.23"
                },
                {
                    "introduced": "12.2.0.1.0"
                },
                {
                    "fixed": "12.2.0.1.19"
                },
                {
                    "introduced": "13.9.4.0.0"
                },
                {
                    "fixed": "13.9.4.2.1"
                }
            ]
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE",
            "vendor_product": "oracle:nosql_database",
            "extracted_events": [
                {
                    "fixed": "19.3.12"
                }
            ]
        },
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "vendor_product": "debian:debian_linux",
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/thrift

Affected ranges

Type
GIT
Repo
https://github.com/apache/thrift
Events
Introduced
8de1e90b4b5e4cccfd8f0534d9c141cff938c833
Last affected
327ebb6c2b6df8bf075da02ef45a2a034e9b79ba
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.5.0"
        },
        {
            "last_affected": "0.11.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1320.json"