The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to
    contain a security vulnerability in which a remote user has the ability to access files outside the set
    webservers docroot path. (CVE-2018-11798)

According to the versions of the thrift packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The Apache Thrift Node.js static web server in versions     0.9.2 through 0.11.0 have been determined to contain a     security vulnerability in which a remote user has the     ability to access files outside the set webservers     docroot path.(CVE-2018-11798)

  - Apache Thrift Java client library versions 0.5.0     through 0.11.0 can bypass SASL negotiation isComplete     validation in the     org.apache.thrift.transport.TSaslTransport class. An     assert used to determine if the SASL handshake had     successfully completed could be disabled in production     settings making the validation     incomplete.(CVE-2018-1320)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
473607	Chainguard: multiple automq packages: security update to 1.7.4-r1	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
473607	Chainguard: multiple automq packages: security update to 1.7.4-r1	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
459178	Echo: org.apache.thrift:libthrift: security update to 0.12.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459178	Echo: org.apache.thrift:libthrift: security update to 0.12.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
422842	SCA: security update for org.apache.thrift:libthrift (GHSA-vx85-mj8c-4qm6)	Tenable Cloud Security	SCA Checks	Local	medium
422842	SCA: security update for org.apache.thrift:libthrift (GHSA-vx85-mj8c-4qm6)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
124961	EulerOS Virtualization 3.0.1.0 : thrift (EulerOS-SA-2019-1458)	Nessus	Huawei Local Security Checks	Local	high

Detections

Analytics

CVE-2018-11798

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high