CVE-2016-5397

HIGH

Apache Thrift < 0.10.0 - Command Injection via Code Generation

Title source: llm
STIX 2.1

Description

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/103025
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2669
Vendor Advisory x_refsource_confirm
https://issues.apache.org/jira/browse/THRIFT-3893
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3140

Scores

CVSS v3 8.8
EPSS 0.2257
EPSS Percentile 95.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-77
Status published
Products (2)
apache/thrift < 0.9.3
apache/thrift 0 - 0.10.0Go
Published Feb 12, 2018
Tracked Since Feb 18, 2026