Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2018-1320 - Improper Input Validation #4

Closed
MGathier opened this issue Dec 31, 2024 · 2 comments
Closed

CVE-2018-1320 - Improper Input Validation #4

MGathier opened this issue Dec 31, 2024 · 2 comments
Labels
CVSS: High Status: Won't Fix Use to signal that the issue is acknowledged, but it’s decided that the work will not be performed. Type: Security

Comments

@MGathier
Copy link
Contributor

MGathier commented Dec 31, 2024 •
edited
Loading

Apache Thrift Java client library versions 0.5.0 prior to 0.9.3-1 and 0.10.0 prior to 0.12.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class.

Found in libthrift 0.11.0, resolved in 0.12.0
@MGathier MGathier added CVSS: High Status: Won't Fix Use to signal that the issue is acknowledged, but it’s decided that the work will not be performed. Type: Security labels Dec 31, 2024
@MGathier
Copy link
Contributor Author

MGathier commented Dec 31, 2024 •
edited
Loading

This is a server-side vulnerability. As Axon Server only uses Apache Thrift as a client to send to Jaeger, this vulnerability does not apply to Axon Server.

Axon Server only uses libthrift when gRPC metrics are enabled and exported to Jaeger (axoniq.axonserver.metrics.grpc.jaeger-enabled=true). It is not possible to upgrade to a more recent version of libthrift, as this is not compatible with the jaeger client version.

@MGathier
Copy link
Contributor Author

MGathier commented Feb 7, 2025

As of AS 2024.2.2 exporting to Jaeger is moved to an extension. Base code no longer contains the thrift library.

@MGathier MGathier closed this as completed Feb 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
CVSS: High Status: Won't Fix Use to signal that the issue is acknowledged, but it’s decided that the work will not be performed. Type: Security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@MGathier