[THRIFT-4506] [CVE-2018-1320] Remove assertion in Java SASL code that would be ignored in release builds

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 0.5
• Fix Version/s: 0.9.3.1, 0.12.0
• Component/s: Java - Library
• Labels: SASL security
• Assignee: James E. King III
• Reporter: James E. King III
• Created: 05/Mar/18 16:30
• Updated: 12/May/19 11:40
• Resolved: 09/Mar/19 15:16

Description

There is an assertion in the SASL transport for Java that will only be processed in debug builds, at https://github.com/apache/thrift/blob/master/lib/java/src/org/apache/thrift/transport/TSaslTransport.java#L298. The preceeding while loop can be changed to guarantee this assertion in all builds.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1320

Issue Links

• is related to: HIVE-21207 Use 0.12.0 libthrift version in Hive
• links to: GitHub Pull Request #1771
• links to: Link to commit that resolved this issue