This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-5397 →

DEBIAN-CVE-2016-5397

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affec...

Original description

The description as published by the source.

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 thrift

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-3"}]}]

Debian:13 thrift

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-3"}]}]

Debian:14 thrift

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-3"}]}]

References

advisory security-tracker.debian.org