CVE-2016-5397
Apache Thrift Go Library Command Injection
Summary
Apache Thrift Go Library Command Injection
Original description
The description as published by the source.
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
github.com/apache/thrift
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.10.0"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2016-5397 thrift Fixed in: 0.11.0-3
References
- advisory nvd.nist.gov
- web access.redhat.com
- web access.redhat.com
- web issues.apache.org
- web lists.apache.org
- web web.archive.org
- web mail-archives.apache.org