thrift-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "James E. King III (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (THRIFT-4506) [CVE-2018-1320] Remove assertion in Java SASL code that would be ignored in release builds
Date Sat, 09 Mar 2019 16:21:00 GMT

    [ https://issues.apache.org/jira/browse/THRIFT-4506?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16788724#comment-16788724
] 

James E. King III commented on THRIFT-4506:
-------------------------------------------

Vote on 0.9.3.1 is out now, release candidate uploaded.

Content is identical to what is on Maven Central, so I'm not sure an unrelease is necessary. 
Situation will be resolved on Tuesday when votes are tallied, assuming all are positive, and
I will update the CVE appropriately after the official release.  Sorry for the trouble I've
caused.

> [CVE-2018-1320] Remove assertion in Java SASL code that would be ignored in release builds
> ------------------------------------------------------------------------------------------
>
>                 Key: THRIFT-4506
>                 URL: https://issues.apache.org/jira/browse/THRIFT-4506
>             Project: Thrift
>          Issue Type: Bug
>          Components: Java - Library
>    Affects Versions: 0.5
>            Reporter: James E. King III
>            Assignee: James E. King III
>            Priority: Minor
>              Labels: SASL, security
>             Fix For: 0.9.3.1, 0.12.0
>
>
> There is an assertion in the SASL transport for Java that will only be processed in debug
builds, at https://github.com/apache/thrift/blob/master/lib/java/src/org/apache/thrift/transport/TSaslTransport.java#L298.
 The preceeding while loop can be changed to guarantee this assertion in all builds.
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1320



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message