CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
93.2%
IBM Security Guardium has fixed these vulnerabilities by updating the Apache Thrift component.
CVEID:CVE-2016-5397
**DESCRIPTION:**Apache Thrift could allow a remote attacker to execute arbitrary commands on the system, caused by the use of an external formatting tool during code generation in the Go client library. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/139426 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID:CVE-2018-11798
**DESCRIPTION:**Apache Thrift could allow a remote attacker to obtain sensitive information, caused by improper access control in the Node.js static file server. An attacker could send a specially crafted request to access arbitrary files that are stored outside the set webservers docroot path.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/155198 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVEID:CVE-2018-1320
**DESCRIPTION:**Apache Thrift could allow a remote attacker to bypass security restrictions, caused by the disablement of an assert used to determine if the SASL handshake had successfully completed. An attacker could exploit this vulnerability to bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/155199 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID:CVE-2019-0205
**DESCRIPTION:**Apache Thrift is vulnerable to a denial of service, caused by an error when processing untrusted Thrift payload. A remote attacker could exploit this vulnerability to cause the application to enter into an infinite loop.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/169460 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2019-0210
**DESCRIPTION:**Apache Thrift is vulnerable to a denial of service, caused by an out-of-bounds read in a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol. A remote attacker could exploit this vulnerability to cause the application to panic.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/169459 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID:CVE-2020-13949
**DESCRIPTION:**Apache Thrift is vulnerable to a denial of service, caused by improper input validation. By sending specially-crafted messages, a remote attacker could exploit this vulnerability to cause a large memory allocation.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/196738 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Product(s) | Version(s) |
---|---|
IBM Security Guardium | 10.5 |
IBM Security Guardium | 10.6 |
IBM Security Guardium | 11.0 |
IBM Security Guardium | 11.1 |
IBM Security Guardium | 11.2 |
IBM Security Guardium | 11.3 |
IBM Security Guardium | 11.4 |
IBM strongly recommends addressing these vulnerabilities now by updating your systems.
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | security_guardium | 10.5 | cpe:2.3:a:ibm:security_guardium:10.5:*:*:*:*:*:*:* |
ibm | security_guardium | 10.6 | cpe:2.3:a:ibm:security_guardium:10.6:*:*:*:*:*:*:* |
ibm | security_guardium | 11.0 | cpe:2.3:a:ibm:security_guardium:11.0:*:*:*:*:*:*:* |
ibm | security_guardium | 11.1 | cpe:2.3:a:ibm:security_guardium:11.1:*:*:*:*:*:*:* |
ibm | security_guardium | 11.2 | cpe:2.3:a:ibm:security_guardium:11.2:*:*:*:*:*:*:* |
ibm | security_guardium | 11.3 | cpe:2.3:a:ibm:security_guardium:11.3:*:*:*:*:*:*:* |
ibm | security_guardium | 11.4 | cpe:2.3:a:ibm:security_guardium:11.4:*:*:*:*:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
93.2%