Vulnerability Details CVE-2016-5397
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.082
EPSS Ranking 91.8%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 9.0
References
- http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E
- http://www.securityfocus.com/bid/103025
- https://access.redhat.com/errata/RHSA-2018:2669
- https://access.redhat.com/errata/RHSA-2019:3140
- https://issues.apache.org/jira/browse/THRIFT-3893
- https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E
- http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E
- http://www.securityfocus.com/bid/103025
- https://access.redhat.com/errata/RHSA-2018:2669
- https://access.redhat.com/errata/RHSA-2019:3140
- https://issues.apache.org/jira/browse/THRIFT-3893
- https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E
Products affected by CVE-2016-5397
-
cpe:2.3:a:apache:thrift:0.2.0
-
cpe:2.3:a:apache:thrift:0.3.0
-
cpe:2.3:a:apache:thrift:0.4.0
-
cpe:2.3:a:apache:thrift:0.5.0
-
cpe:2.3:a:apache:thrift:0.6.0
-
cpe:2.3:a:apache:thrift:0.6.1
-
cpe:2.3:a:apache:thrift:0.7.0
-
cpe:2.3:a:apache:thrift:0.8.0
-
cpe:2.3:a:apache:thrift:0.9.0
-
cpe:2.3:a:apache:thrift:0.9.1
-
cpe:2.3:a:apache:thrift:0.9.2
-
cpe:2.3:a:apache:thrift:0.9.3