ALT-PU-2020-2981

Высокий

ALT-PU-2020-2981: package thrift update to version 0.13.0-alt1_9

Источник

errata.altlinux.org

Дата публикации

09.10.2020

Дата обновления

04.02.2026

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades thrift to version 0.13.0-alt1_9.

Устраненные уязвимости7

BDU:2019-03809

Высокий 7.5

Дата публикации: 29.10.2019

Уязвимость класса org.apache.thrift.transport.TSaslTransport языка описания интерфейсов Apache Thrift, позволяющая нарушителю обойти SASL-согласования

CVSS 3.1

Высокий 7.5

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

CVSS 2.0

Высокий 7.8

AV:N/AC:L/Au:N/C:N/I:C/A:N

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: None
Integrity: Complete
Availability: None

Ссылки

BDU:2019-03809 https://bdu.fstec.ru/vul/2019-03809

Ссылки4

ALT-PU-2020-2981 https://errata.altlinux.org/ALT-PU-2020-2981

GHSA-jq7p-26h5-w78r

https://github.com/advisories/GHSA-jq7p-26h5-w78r

GHSA-rj7p-rfgp-852x

https://github.com/advisories/GHSA-rj7p-rfgp-852x

GHSA-wjxj-f8rg-99wx

https://github.com/advisories/GHSA-wjxj-f8rg-99wx

Связанные уязвимости

CVE-2018-1320

CVSS3: 7.5

ubuntu

почти 8 лет назад

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.