CVE-2016-5397 — Apache Thrift Go Library Command Injection

Description

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Thrift	versions prior to 0.10.0	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	thrift	0.11.0-3	—
Debian 13	thrift	0.11.0-3	—
Debian 12	thrift	0.11.0-3	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 18.04 LTS	thrift-compiler	No fix yet	—
Ubuntu 16.04 LTS	thrift-compiler	No fix yet	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Go	github.com/apache/thrift	< 0.10.0	0.10.0	GHSA-r4m4-pmvw-m6j5

References

103025 vdb-entry
RHSA-2018:2669 vendor-advisory
https://issues.apache.org/jira/browse/THRIFT-3893
[user] 20170113 [NOTICE]: Apache Thrift Security Vulnerability CVE-2016-5397 mailing-list
RHSA-2019:3140 vendor-advisory
[cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6 mailing-list