Abhishek Singh created CASSANDRA-15424:
------------------------------------------
Summary: CVE-2018-1320 (The libthrift component is vulnerable to
Improper Access Control)
Key: CASSANDRA-15424
URL: https://issues.apache.org/jira/browse/CASSANDRA-15424
Project: Cassandra
Issue Type: Bug
Reporter: Abhishek Singh
*Description :**Description :* *Severity :* CVE CVSS 3.0: 7.5Sonatype CVSS 3.0:
8.2
*Weakness :* CVE CWE: 20
*Source :* National Vulnerability Database
*Categories :* Data
*Description from CVE :* Apache Thrift Java client library versions 0.5.0
through 0.11.0 can bypass SASL negotiation isComplete validation in the
org.apache.thrift.transport.TSaslTransport class. An assert used to determine
if the SASL handshake had successfully completed could be disabled in
production settings making the validation incomplete.
*Explanation :* The libthrift component is vulnerable to Improper Access
Control. The open() method of the TSaslTransport class incorrectly uses an
assertion to validate whether or not the SASL handshake has successfully
completed. In some cases, such as production builds, the assertion
functionality can be disabled rendering the validation incomplete. In such a
case, an attacker can exploit this by being able to login without actually
successfully completing the SASL handshake.
*Detection :* The application is vulnerable by using this component.
*Recommendation :* We recommend upgrading to a version of this component that
is not vulnerable to this specific issue.
*Root Cause :* Cassandra-2.2.5.nupkgTSaslTransport.class : [0.5.0, 0.12.0)
*Advisories :* Project:
https://lists.apache.org/thread.html/da5234b5e78f1c99190407f...
*CVSS Details :* CVE CVSS 3.0: 7.5
*Occurences (Paths) :* [" apache-cassandra.zip/bin/cassandra.in.bat" ; "
apache-cassandra.zip/bin/cassandra.in.sh" ; "
apache-cassandra.zip/bin/cqlsh.bat" ; " apache-cassandra.zip/bin/debug-cql.bat"
; " apache-cassandra.zip/bin/source-conf.ps1" ; "
apache-cassandra.zip/bin/sstableloader.bat" ; "
apache-cassandra.zip/bin/sstablescrub.bat" ; "
apache-cassandra.zip/bin/sstableupgrade.bat" ; "
apache-cassandra.zip/bin/sstableverify.bat" ; "
apache-cassandra.zip/bin/stop-server" ; "
apache-cassandra.zip/bin/stop-server.bat" ; "
apache-cassandra.zip/bin/stop-server.ps1" ; "
apache-cassandra.zip/conf/README.txt" ; "
apache-cassandra.zip/conf/cassandra-rackdc.properties" ; "
apache-cassandra.zip/conf/cassandra-topology.properties" ; "
apache-cassandra.zip/conf/commitlog_archiving.properties" ; "
apache-cassandra.zip/conf/triggers/README.txt" ; "
apache-cassandra.zip/lib/ST4-4.0.8.jar" ; "
apache-cassandra.zip/lib/airline-0.6.jar" ; "
apache-cassandra.zip/lib/antlr-runtime-3.5.2.jar" ; "
apache-cassandra.zip/lib/commons-cli-1.1.jar" ; "
apache-cassandra.zip/lib/commons-lang3-3.1.jar" ; "
apache-cassandra.zip/lib/commons-math3-3.2.jar" ; "
apache-cassandra.zip/lib/compress-lzf-0.8.4.jar" ; "
apache-cassandra.zip/lib/concurrentlinkedhashmap-lru-1.4.jar" ; "
apache-cassandra.zip/lib/disruptor-3.0.1.jar" ; "
apache-cassandra.zip/lib/ecj-4.4.2.jar" ; "
apache-cassandra.zip/lib/futures-2.1.6-py2.py3-none-any.zip" ; "
apache-cassandra.zip/lib/high-scale-lib-1.0.6.jar" ; "
apache-cassandra.zip/lib/jamm-0.3.0.jar" ; "
apache-cassandra.zip/lib/javax.inject.jar" ; "
apache-cassandra.zip/lib/jbcrypt-0.3m.jar" ; "
apache-cassandra.zip/lib/jcl-over-slf4j-1.7.7.jar" ; "
apache-cassandra.zip/lib/joda-time-2.4.jar" ; "
apache-cassandra.zip/lib/json-simple-1.1.jar" ; "
apache-cassandra.zip/lib/libthrift-0.9.2.jar" ; "
apache-cassandra.zip/lib/licenses/ST4-4.0.8.txt" ; "
apache-cassandra.zip/lib/licenses/antlr-runtime-3.5.2.txt" ; "
apache-cassandra.zip/lib/licenses/compress-lzf-0.8.4.txt" ; "
apache-cassandra.zip/lib/licenses/concurrent-trees-2.4.0.txt" ; "
apache-cassandra.zip/lib/licenses/ecj-4.4.2.txt" ; "
apache-cassandra.zip/lib/licenses/futures-2.1.6.txt" ; "
apache-cassandra.zip/lib/licenses/high-scale-lib-1.0.6.txt" ; "
apache-cassandra.zip/lib/licenses/jbcrypt-0.3m.txt" ; "
apache-cassandra.zip/lib/licenses/jcl-over-slf4j-1.7.7.txt" ; "
apache-cassandra.zip/lib/licenses/jna-4.2.2.txt" ; "
apache-cassandra.zip/lib/licenses/jstackjunit-0.0.1.txt" ; "
apache-cassandra.zip/lib/licenses/log4j-over-slf4j-1.7.7.txt" ; "
apache-cassandra.zip/lib/licenses/logback-classic-1.1.3.txt" ; "
apache-cassandra.zip/lib/licenses/logback-core-1.1.3.txt" ; "
apache-cassandra.zip/lib/licenses/lz4-1.3.0.txt" ; "
apache-cassandra.zip/lib/licenses/metrics-core-3.1.0.txt" ; "
apache-cassandra.zip/lib/licenses/metrics-jvm-3.1.0.txt" ; "
apache-cassandra.zip/lib/licenses/ohc-0.4.4.txt" ; "
apache-cassandra.zip/lib/licenses/reporter-config-base-3.0.3.txt" ; "
apache-cassandra.zip/lib/licenses/reporter-config3-3.0.3.txt" ; "
apache-cassandra.zip/lib/licenses/sigar-1.6.4.txt" ; "
apache-cassandra.zip/lib/licenses/six-1.7.3.txt" ; "
apache-cassandra.zip/lib/licenses/slf4j-api-1.7.7.txt" ; "
apache-cassandra.zip/lib/licenses/stream-2.5.2.txt" ; "
apache-cassandra.zip/lib/log4j-over-slf4j-1.7.7.jar" ; "
apache-cassandra.zip/lib/logback-classic-1.1.3.jar" ; "
apache-cassandra.zip/lib/logback-core-1.1.3.jar" ; "
apache-cassandra.zip/lib/lz4-1.3.0.jar" ; "
apache-cassandra.zip/lib/metrics-core-3.1.0.jar" ; "
apache-cassandra.zip/lib/metrics-logback-3.1.0.jar" ; "
apache-cassandra.zip/lib/sigar-1.6.4.jar" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-amd64-freebsd-6.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-amd64-linux.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-amd64-solaris.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-ia64-hpux-11.sl" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-ia64-linux.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-pa-hpux-11.sl" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-ppc-aix-5.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-ppc-linux.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-ppc64-aix-5.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-ppc64-linux.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-s390x-linux.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-sparc-solaris.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-sparc64-solaris.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-universal-macosx.dylib" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-universal64-macosx.dylib" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-x86-freebsd-5.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-x86-freebsd-6.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-x86-linux.so" ; "
apache-cassandra.zip/lib/sigar-bin/libsigar-x86-solaris.so" ; "
apache-cassandra.zip/lib/sigar-bin/sigar-amd64-winnt.dll" ; "
apache-cassandra.zip/lib/sigar-bin/sigar-x86-winnt.dll" ; "
apache-cassandra.zip/lib/sigar-bin/sigar-x86-winnt.lib" ; "
apache-cassandra.zip/lib/six-1.7.3-py2.py3-none-any.zip" ; "
apache-cassandra.zip/lib/slf4j-api-1.7.7.jar" ; "
apache-cassandra.zip/lib/snakeyaml-1.11.jar" ; "
apache-cassandra.zip/lib/snappy-java-1.1.1.7.jar" ; "
apache-cassandra.zip/lib/stream-2.5.2.jar" ; "
apache-cassandra.zip/lib/thrift-server-0.3.7.jar" ; "
apache-cassandra.zip/pylib/cqlshlib/__init__.py" ; "
apache-cassandra.zip/pylib/cqlshlib/saferscanner.py" ; "
apache-cassandra.zip/pylib/cqlshlib/sslhandling.py" ; "
apache-cassandra.zip/pylib/cqlshlib/test/ansi_colors.py" ; "
apache-cassandra.zip/pylib/cqlshlib/test/basecase.py" ; "
apache-cassandra.zip/pylib/cqlshlib/test/test_cql_parsing.py" ; "
apache-cassandra.zip/pylib/cqlshlib/test/test_cqlsh_commands.py" ; "
apache-cassandra.zip/pylib/cqlshlib/test/test_cqlsh_invocation.py" ; "
apache-cassandra.zip/pylib/cqlshlib/test/test_cqlsh_parsing.py" ; "
apache-cassandra.zip/pylib/cqlshlib/test/winpty.py" ; "
apache-cassandra.zip/tools/bin/cassandra-stress.bat" ; "
apache-cassandra.zip/tools/bin/cassandra.in.bat" ; "
apache-cassandra.zip/tools/bin/cassandra.in.sh" ; "
apache-cassandra.zip/tools/bin/sstableexpiredblockers.bat" ; "
apache-cassandra.zip/tools/bin/sstablelevelreset.bat" ; "
apache-cassandra.zip/tools/bin/sstablemetadata.bat" ; "
apache-cassandra.zip/tools/bin/sstableofflinerelevel.bat" ; "
apache-cassandra.zip/tools/bin/sstablerepairedset.bat" ; "
apache-cassandra.zip/tools/bin/sstablesplit.bat"]
*CVE :* CVE-2018-1320
*URL :* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1320
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
