{
  "cveId": "CVE-2018-1320",
  "url": "https://patchblox.com/security/cve/CVE-2018-1320",
  "summary": "CVE-2018-1320 is fixed in libthrift-java on 1 platform by libthrift-java 0.9.1-2.1~build0.18.04.1 (version 0.9.1-2.1~build0.18.04.1), released January 7, 2019. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libthrift-java: Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in...",
  "description": "Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.",
  "published": "2019-01-07T09:29:00Z",
  "severity": "Medium",
  "epss": 0.08188,
  "epssPercentile": 0.94902,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libthrift-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "0.9.1-2.1~build0.18.04.1",
      "fix": "libthrift-java 0.9.1-2.1~build0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libthrift-java-0.9.1-2.1-build0.18.04.1",
      "released": "2019-01-07T09:29:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}