Read the docs
TI-2018-01223 Aliases CVE-2018-1320GHSA-wjxj-f8rg-99wx

Improper certificate validation in Apache Thrift

Priority MEDIUM 44CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 1 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.

Why it matters now

EPSS 0.08188 94th percentileScored 2026-11-07
Fix Partial org.apache.thrift:libthrift (Maven): 0.9.3-1, 0.12.0Red Hat: 1 advisoryRed Hat: 1 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache ThriftApache Thrift 0.5.0 to 0.11.0—No fix listedCNA
—org.apache.thrift:libthrift (Maven)0.5.0 to before 0.9.3-10.9.3-1Patch availableGHSA-wjxj-f8rg-99wx
—org.apache.thrift:libthrift (Maven)0.10.0 to before 0.12.00.12.0Patch availableGHSA-wjxj-f8rg-99wx
  • Apache Thrift VendorApache Affected Apache Thrift 0.5.0 to 0.11.0 Fixed in — No fix listed CNA
  • org.apache.thrift:libthrift (Maven) Vendor— Affected 0.5.0 to before 0.9.3-1 Fixed in 0.9.3-1 Patch available GHSA-wjxj-f8rg-99wx
  • org.apache.thrift:libthrift (Maven) Vendor— Affected 0.10.0 to before 0.12.0 Fixed in 0.12.0 Patch available GHSA-wjxj-f8rg-99wx

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*0.5.0 – 0.11.0VulnerableApache
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:*5.0.0 – 5.1.0VulnerableF5
cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:*before 11.2.0.3.23; 12.2.0.1.0 to before 12.2.0.1.19; 13.9.4.0.0 to before 13.9.4.2.1VulnerableOracle
cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:*before 19.3.12VulnerableOracle
  • cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:* Versions 0.5.0 – 0.11.0 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:a:f5:traffix_signaling_delivery_controller:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.1.0 Vulnerable ·F5
  • cpe:2.3:a:oracle:global_lifecycle_management_opatch:*:*:*:*:*:*:*:* Versions before 11.2.0.3.23; 12.2.0.1.0 to before 12.2.0.1.19; 13.9.4.0.0 to before 13.9.4.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:nosql_database:*:*:*:*:*:*:*:* Versions before 19.3.12 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-wjxj-f8rg-99wx org.apache.thrift:libthrift (Maven) Fixed in 0.9.3-1 Advisory →
  • Fix · GHSA-wjxj-f8rg-99wx org.apache.thrift:libthrift (Maven) Fixed in 0.12.0 Advisory →

Red Hat 1 advisory

  • RHSA-2019:2413 Released 2019-08-08 · Red Hat rating Important
    Red Hat Fuse 7.4.0 security update
    • Red Hat Fuse 7.4.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix yet
Red Hat Fuse 7.4.0Fixed RHSA-2019:2413
Not affected: 5 products
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • Red Hat JBoss Operations Network 3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Enterprise 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1320
  2. 2026-10-03 Alias added: GHSA-wjxj-f8rg-99wx

References

Patch 1

Advisory 6

Other 42

  • TI-2026-40373 Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() CVSS 4.0CRITICAL 9.3
  • TI-2016-04675 Command injection in Apache Thrift CVSS 3.0HIGH 8.8
  • TI-2026-42227 Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass CVSS 4.0HIGH 8.7
  • TI-2026-42014 Apache Thrift: Rust binary protocol non-strict path missing string size limit CVSS 4.0HIGH 8.7
  • TI-2026-40371 Integer overflow in Apache Thrift CVSS 4.0HIGH 8.7
  • TI-2026-40370 Apache Thrift: Node.js quadratic-time DoS in server receive transports CVSS 4.0HIGH 8.7
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences