CVE-2016-5397: Command Injection
First published: Mon Feb 12 2018(Updated: )
Improper validation of the file_path argument in t_go_generator.cc:format_go_output() of the Apache Thrift Go client library can allow an attacker to execute arbitrary commands. The file_path parameter is derived from the service name. If an attacker can provide a service name to a framework invoking Thrift, the attacker could craft the name in a way leading to arbitrary commands being executed. This affects versions before Apache Thrift 0.10.0. Upstream Advisory: <a href="http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E">http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E</a> Upstream Issue: <a href="https://issues.apache.org/jira/browse/THRIFT-3893">https://issues.apache.org/jira/browse/THRIFT-3893</a> Upstream Commit: <a href="https://github.com/apache/thrift/commit/2007783e874d524a46b818598a45078448ecc53e">https://github.com/apache/thrift/commit/2007783e874d524a46b818598a45078448ecc53e</a>
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Thrift | <=0.9.3 | |
| go/github.com/apache/thrift | <=0.9.3 | 0.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2016-5397
- https://access.redhat.com/errata/RHSA-2018:2669
- https://access.redhat.com/errata/RHSA-2019:3140
- https://issues.apache.org/jira/browse/THRIFT-3893
- https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E
- http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E
- https://web.archive.org/web/20210124141102/http://www.securityfocus.com/bid/103025
- https://github.com/advisories/GHSA-r4m4-pmvw-m6j5 (Advisory)
- http://www.securityfocus.com/bid/103025
- http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E
- https://github.com/apache/thrift/commit/2007783e874d524a46b818598a45078448ecc53e
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1544621
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1560778
- https://bugzilla.redhat.com/show_bug.cgi?id=1544620
- https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E
Frequently Asked Questions
What is CVE-2016-5397?
CVE-2016-5397 is a vulnerability in the Apache Thrift Go client library that exposes the potential for command injection during code generation due to the use of an external formatting tool.
How severe is CVE-2016-5397?
CVE-2016-5397 has a severity rating of 8.8, which is considered critical.
Which versions of Apache Thrift are affected by CVE-2016-5397?
Apache Thrift 0.9.3 and older versions are affected by CVE-2016-5397.
How can I fix CVE-2016-5397?
To fix CVE-2016-5397, you should upgrade to Apache Thrift 0.10.0 or newer.
Where can I find more information about CVE-2016-5397?
You can find more information about CVE-2016-5397 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-5397), [Red Hat Advisory RHSA-2018:2669](https://access.redhat.com/errata/RHSA-2018:2669), [Red Hat Advisory RHSA-2019:3140](https://access.redhat.com/errata/RHSA-2019:3140).
- collector/github-advisory
- alias/GHSA-r4m4-pmvw-m6j5
- alias/CVE-2016-5397
- collector/github-advisory-latest
- collector/nvd-index
- collector/nvd-cve
- agent/author
- agent/type
- agent/softwarecombine
- agent/severity
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/tags
- agent/source
- package-manager/go
- vendor/apache
- canonical/apache thrift
- version/apache thrift/0.9.3
- package-manager/redhat