GitHub Advisoryadvisory · Go

GHSA-r4m4-pmvw-m6j5 Apache Thrift Go Library Command Injection

HIGH Published 2022-05-13 Modified 2023-07-31 Official page ↗
Aliases
CVE-2016-5397
Ecosystem
Go
Packages
github.com/apache/thrift
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2023-07-31

Affected packages

• Go github.com/apache/thrift: < 0.10.0 → fixed in 0.10.0

Description

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

Related

Alias · CVE (1)

  • CVE-2016-5397 The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References