SASL Handshake Bypass in Apache Thrift Java Client Library (CVE-2018-1320)
Summary
CVE-2018-1320: Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. Affects libthrift-java versions < 0.9.1-2.1. Fixed in 0.9.1-2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Thrift is a software framework for scalable cross-language services development. It combines a software stack with a code generation engine to build services that can communicate seamlessly across different programming languages. The library is widely used for building high-performance applications. However, certain versions of the Apache Thrift Java client library are vulnerable to a security issue that can compromise the integrity of SASL (Simple Authentication and Security Layer) negotiations.
Vulnerability Detail
The vulnerability identified as CVE-2018-1320 affects Apache Thrift Java client library versions 0.5.0 through 0.11.0. It allows for the bypass of SASL negotiation isComplete validation in the TSaslTransport class. In production environments, an assert that checks if the SASL handshake has successfully completed can be disabled, leading to incomplete validation. This can potentially allow unauthorized access or manipulation of data, as the security mechanisms intended to protect the communication may not be effectively enforced.
How To Fix
Minimum fixed version
0.9.1-2.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libthrift-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, consider implementing additional security measures such as using a VPN or secure tunneling to protect the data in transit. However, this is not a substitute for patching the vulnerability.
Conclusion
CVE-2018-1320 is a significant vulnerability in the Apache Thrift Java client library that can compromise the security of applications using affected versions. It is crucial to upgrade to a patched version to ensure the integrity of SASL negotiations and protect against unauthorized access.
See every vulnerability recorded for libthrift-java →
FAQ
CVE-2018-1320 is a vulnerability in the Apache Thrift Java client library that allows for the bypass of SASL negotiation validation, potentially leading to unauthorized access.
The affected versions are Apache Thrift Java client library versions 0.5.0 through 0.11.0.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to monitor and alert for open-source vulnerabilities.
The CVSS score for CVE-2018-1320 is 7.5, indicating a high severity level.
If an immediate upgrade is not possible, consider implementing additional security measures such as using a VPN or secure tunneling to protect data in transit.
Related vulnerabilities
Recent vulnerabilities recorded for libthrift-java.
