PT-2019-3599 · Apache+1 · Apache Thrift Java Client Library+1

Publicado 2019-01-06 · Atualizado 2026-05-18 · CVE-2018-1320

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Thrift Java client library versions 0.5.0 through 0.11.0

Description The issue is related to insufficient input validation in the org.apache.thrift.transport.TSaslTransport class, allowing a remote attacker to bypass SASL negotiation validation. This can be exploited to gain unauthorized access to protected information by circumventing SASL negotiation. The problem arises because an assert used to determine if the SASL handshake had successfully completed could be disabled in production settings, making the validation incomplete.

Recommendations For Apache Thrift Java client library versions 0.5.0 through 0.11.0, consider disabling the org.apache.thrift.transport.TSaslTransport class or restricting its use until a patch is available to prevent bypassing SASL negotiation validation. Ensure that asserts are not disabled in production settings to maintain the integrity of the SASL handshake validation.

Correção

RCE

Improper Certificate Validation

Enumeração de Fraquezas

CWE-20

CWE-295

Identificadores relacionados

ALT-PU-2020-2981

BDU:2019-03809

BDU:2019-04255

CLEANSTART-2026-KU61465

CLEANSTART-2026-LE11246

CLEANSTART-2026-RN56220

CVE-2018-1320

DLA-1662-1

GHSA-WJXJ-F8RG-99WX

ROSA-SA-2023-2270

Produtos afetados

Alt Linux

Apache Thrift Java Client Library

Referências · 242

• https://github.com/apache/thrift · Nota
• https://github.com/apache/thrift/releases/tag/0.9.3.1 · Nota
• https://github.com/apache/thrift/commit/7489ed6ac8bad64e72fa83ec9d53e1eeddca6c23 · Nota
• https://github.com/apache/thrift/commit/d973409661f820d80d72c0034d06a12348c8705e · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RN56220.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LE11246.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KU61465.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-fghv-69vj-qj49 · Nota
• https://lists.apache.org/thread.html/r3d71a6dbb063aa61ba81278fe622b20bfe7501bb3821c27695641ac3%40%3Ccommits.cassandra.apache.org%3E · Nota
• https://osv.dev/vulnerability/ghsa-xq3w-v528-46rv · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-0341 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-42585 · Nota
• https://lists.apache.org/thread.html/r261972a3b14cf6f1dcd94b1b265e9ef644a38ccdf0d0238fa0c4d459%40%3Ccommits.cassandra.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1320 · Nota de Segurança