CVE-2018-1320 (High) detected in libthrift-0.9.2.jar

[mend-for-github-com]

CVE-2018-1320 - High Severity Vulnerability

Vulnerable Library - libthrift-0.9.2.jar

Thrift is a software framework for scalable cross-language services development.

Library home page: http://thrift.apache.org

Path to dependency file: atlasdb/atlasdb-cassandra/build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.thrift/libthrift/0.9.2/9b067e2e2c5291e9f0d8b3561b1654286e6d81ee/libthrift-0.9.2.jar,canner/.gradle/caches/modules-2/files-2.1/org.apache.thrift/libthrift/0.9.2/9b067e2e2c5291e9f0d8b3561b1654286e6d81ee/libthrift-0.9.2.jar

Dependency Hierarchy:

• ❌ libthrift-0.9.2.jar (Vulnerable Library)

Found in HEAD commit: 8c390fb371cd05cd59ff7d2cd4e18016807af529

Vulnerability Details

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

Publish Date: 2019-01-07

URL: CVE-2018-1320

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1320

Release Date: 2019-01-07

Fix Resolution: 0.12.0

---

⛑️ Automatic Remediation is available for this issue