PT-2019-3599 · Apache+1 · Apache Thrift Java Client Library+1

Published 2019-01-06 · Updated 2026-05-18 · CVE-2018-1320

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Thrift Java client library versions 0.5.0 through 0.11.0

Description The issue is related to insufficient input validation in the org.apache.thrift.transport.TSaslTransport class, allowing a remote attacker to bypass SASL negotiation validation. This can be exploited to gain unauthorized access to protected information by circumventing SASL negotiation. The problem arises because an assert used to determine if the SASL handshake had successfully completed could be disabled in production settings, making the validation incomplete.

Recommendations For Apache Thrift Java client library versions 0.5.0 through 0.11.0, consider disabling the org.apache.thrift.transport.TSaslTransport class or restricting its use until a patch is available to prevent bypassing SASL negotiation validation. Ensure that asserts are not disabled in production settings to maintain the integrity of the SASL handshake validation.

Fix

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-20

CWE-295

Related Identifiers

ALT-PU-2020-2981

BDU:2019-03809

BDU:2019-04255

CLEANSTART-2026-KU61465

CLEANSTART-2026-LE11246

CLEANSTART-2026-RN56220

CVE-2018-1320

DLA-1662-1

GHSA-WJXJ-F8RG-99WX

ROSA-SA-2023-2270

Affected Products

Alt Linux

Apache Thrift Java Client Library

References · 242

• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-0341 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1320 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-6763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-41973 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-55163 · Security Note
• https://osv.dev/vulnerability/GHSA-wjxj-f8rg-99wx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46120 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42587 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-67735 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-20200 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13009 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-2976 · Security Note