p PatchFirst

CVE-2016-5397

CVE-2016-5397

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

CVSS 8.8 · High · EPSS 6.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache thrift

    Versions
    • versions prior to 0.10.0: Affected

    No fix published

  • thrift Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.11.0-3

    Update to 0.11.0-3

  • thrift Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.11.0-3

    Update to 0.11.0-3

  • thrift Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.11.0-3

    Update to 0.11.0-3

  • thrift-compiler Ubuntu:16.04:LTS

    Versions
    • 0.9.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • thrift-compiler Ubuntu:18.04:LTS

    Versions
    • 0.9.1-2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →