The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
CVSS Score
8.8
EPSS Score
0.226
Published
2018-02-12
The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
CVSS Score
6.5
EPSS Score
0.018
Published
2017-06-16
Page 2