Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

According to the versions of the thrift packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In Apache Thrift 0.9.3 to 0.12.0, a server implemented     in Go using TJSONProtocol or TSimpleJSONProtocol may     panic when feed with invalid input data.(CVE-2019-0210)

  - In Apache Thrift all versions up to and including     0.12.0, a server or client may run into an endless loop     when feed with specific input data. Because the issue     had already been partially fixed in version 0.11.0,     depending on the installed version it affects only     certain language bindings.(CVE-2019-0205)

  - Apache Thrift Java client library versions 0.5.0     through 0.11.0 can bypass SASL negotiation isComplete     validation in the     org.apache.thrift.transport.TSaslTransport class. An     assert used to determine if the SASL handshake had     successfully completed could be disabled in production     settings making the validation     incomplete.(CVE-2018-1320)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the thrift packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The Apache Thrift Node.js static web server in versions     0.9.2 through 0.11.0 have been determined to contain a     security vulnerability in which a remote user has the     ability to access files outside the set webservers     docroot path.(CVE-2018-11798)

  - Apache Thrift Java client library versions 0.5.0     through 0.11.0 can bypass SASL negotiation isComplete     validation in the     org.apache.thrift.transport.TSaslTransport class. An     assert used to determine if the SASL handshake had     successfully completed could be disabled in production     settings making the validation     incomplete.(CVE-2018-1320)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that it was possible to bypass SASL negotiation isComplete validation in libthrift-java, Java language support for the Apache Thrift software framework. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

For Debian 8 'Jessie', this problem has been fixed in version 0.9.1-2+deb8u1.

We recommend that you upgrade your libthrift-java packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
147467	EulerOS Virtualization 3.0.6.6 : thrift (EulerOS-SA-2021-1457)	Nessus	Huawei Local Security Checks	high
124961	EulerOS Virtualization 3.0.1.0 : thrift (EulerOS-SA-2019-1458)	Nessus	Huawei Local Security Checks	high
121625	Debian DLA-1662-1 : libthrift-java security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-1320

high

Tenable Plugins

high

high

high