| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.thrift:libthrift | ≥ 0.10.0, < 0.12.0≥ 0.5.0, < 0.9.3-1 | 0.12.00.9.3-1 |
| thrift | ≥ 0.5.0, ≤ 0.11.0 | |
| traffix signaling delivery controller | ≥ 5.0.0, ≤ 5.1.0 | |
| global lifecycle management opatch | ≥ 12.2.0.1.0, < 12.2.0.1.19≥ 13.9.4.0.0, < 13.9.4.2.1< 11.2.0.3.23 | 12.2.0.1.1913.9.4.2.111.2.0.3.23 |
| nosql database | < 19.3.12 | 19.3.12 |
Apache Thrift Java client library versions 0.5.0 prior to 0.9.3-1 and 0.10.0 prior to 0.12.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free