CVE-2016-5397: Command Injection
Improper validation of the filepath argument in tgogenerator.cc:formatgooutput() of the Apache Thrift Go client library can allow an attacker to execute arbitrary commands.
The filepath parameter is derived from the service name. If an attacker can provide a service name to a framework invoking Thrift, the attacker could craft the name in a way leading to arbitrary commands being executed.
This affects versions before Apache Thrift 0.10.0.
Upstream Advisory:
http://mail-archives.apache.org/modmbox/thrift-user/201701.mbox/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E
Upstream Issue:
https://issues.apache.org/jira/browse/THRIFT-3893
Upstream Commit:
https://github.com/apache/thrift/commit/2007783e874d524a46b818598a45078448ecc53e
Other sources
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2016-5397?
CVE-2016-5397 is a vulnerability in the Apache Thrift Go client library that exposes the potential for command injection during code generation due to the use of an external formatting tool.
How severe is CVE-2016-5397?
CVE-2016-5397 has a severity rating of 8.8, which is considered critical.
Which versions of Apache Thrift are affected by CVE-2016-5397?
Apache Thrift 0.9.3 and older versions are affected by CVE-2016-5397.
How can I fix CVE-2016-5397?
To fix CVE-2016-5397, you should upgrade to Apache Thrift 0.10.0 or newer.
Where can I find more information about CVE-2016-5397?
You can find more information about CVE-2016-5397 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2016-5397), [Red Hat Advisory RHSA-2018:2669](https://access.redhat.com/errata/RHSA-2018:2669), [Red Hat Advisory RHSA-2019:3140](https://access.redhat.com/errata/RHSA-2019:3140).