CVE-2018-1320
Improper Input Validation in Apache Thrift
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
- Record
CVE-2018-1320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
- Record
CVE-2018-1320- Updated
- 2026-11-02
EUVDEUVD-2019-0196 No score
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
- Record
EUVD-2019-0196- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wjxj-f8rg-99wx
Improper Input Validation in Apache Thrift
Apache Thrift Java client library versions 0.5.0 prior to 0.9.3-1 and 0.10.0 prior to 0.12.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
- Record
GHSA-wjxj-f8rg-99wx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20, CWE-295
- Updated
- 2026-11-02
OSV
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
- Record
CVE-2018-1320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1320
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
- Record
DEBIAN-CVE-2018-1320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-wjxj-f8rg-99wx
Improper Input Validation in Apache Thrift
Apache Thrift Java client library versions 0.5.0 prior to 0.9.3-1 and 0.10.0 prior to 0.12.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
- Record
GHSA-wjxj-f8rg-99wx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20, CWE-295
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1320
Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
- Record
UBUNTU-CVE-2018-1320- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1772669612 No score
TuxCare security update for org.apache.thrift:libthrift (1 CVE)
TuxCare rebuilt org.apache.thrift:libthrift to address 1 CVE. Fixed in 0.9.1-tuxcare.2.
- Record
CLSA-2026-1772669612- Updated
- 2026-11-02
OSVCLSA-2026-1772756024 No score
TuxCare security update for org.apache.thrift (4 CVEs)
TuxCare rebuilt 2 org.apache.thrift packages to address 4 CVEs. Fixed in 0.9.3-tuxcare.2.
- Record
CLSA-2026-1772756024- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.thrift:libthriftMaven |
0.5.0 up to 0.9.3-1 | 0.9.3-1 |
org.apache.thrift:libthriftMaven |
0.10.0 up to 0.12.0 | 0.12.0 |
org.apache.thrift:libthriftTuxCare:Maven |
0.9.1 up to 0.9.1-tuxcare.2, plus listed versions 0.9.1-tuxcare.1 |
0.9.1-tuxcare.2 |
org.apache.thrift:libfb303TuxCare:Maven |
0.9.3 up to 0.9.3-tuxcare.2, plus listed versions 0.9.3.tuxcare.1 |
0.9.3-tuxcare.2 |
org.apache.thrift:libthriftTuxCare:Maven |
0.9.3 up to 0.9.3-tuxcare.2, plus listed versions 0.9.3.tuxcare.1 |
0.9.3-tuxcare.2 |
libthrift-javaDebian:12 |
before 0.9.1-2.1 | 0.9.1-2.1 |
libthrift-javaDebian:13 |
before 0.9.1-2.1 | 0.9.1-2.1 |
libthrift-javaDebian:14 |
before 0.9.1-2.1 | 0.9.1-2.1 |
libthrift-javaDebian:8 |
before 0.9.1-2+deb8u1, plus listed versions 0.9.1-2 |
0.9.1-2+deb8u1 |
org.apache.thrift:libthriftMaven |
0.5.0 up to 0.9.3-1, plus listed versions 0.6.10.7.00.8.00.9.00.9.10.9.20.9.3 |
0.9.3-1 |
org.apache.thrift:libthriftMaven |
0.10.0 up to 0.12.0, plus listed versions 0.11.0 |
0.12.0 |
libthrift-javaUbuntu:16.04:LTS |
before 0.9.1-2.1~build0.16.04.1, plus listed versions 0.9.1-2 |
0.9.1-2.1~build0.16.04.1 |
libthrift-javaUbuntu:18.04:LTS |
before 0.9.1-2.1~build0.18.04.1, plus listed versions 0.9.1-2 |
0.9.1-2.1~build0.18.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1320 is a high vulnerability (CVSS 7.5) in Apache Thrift, published January 7, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.19%, the 94th percentile. Fixed in org.apache.thrift:libthrift 0.9.3-1.
References
lists.apache.org/thread.html/da5234b5e78f1c99190407f791dfe1bf6c58de8d30d15974a9669be3%40%3Cuser.thrift.apache.org%3E
securityfocus.com/bid/106551
lists.debian.org/debian-lts-announce/2019/02/msg00008.html
support.f5.com/csp/article/K36361684
Show 48 moreShow less
openwall.com/lists/oss-security/2019/07/24/3
access.redhat.com/errata/RHSA-2019:2413
oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
nvd.nist.gov/vuln/detail/CVE-2018-1320
github.com/apache/thrift/releases/tag/0.9.3.1
issues.apache.org/jira/browse/THRIFT-4506
web.archive.org/web/20200227094237/http://www.securityfocus.com/bid/106551
security-tracker.debian.org/tracker/CVE-2018-1320
ubuntu.com/security/CVE-2018-1320
cve.org/CVERecord?id=CVE-2018-1320