PT-2018-4929 · Apache+1 · Apache Thrift+1

Felix Groebert · Published 2017-11-23 · Updated 2022-05-13 · CVE-2016-5397

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Thrift versions 0.9.3 and older

Description The issue arises from the use of an external formatting tool during code generation, potentially exposing the system to command injection.

Recommendations For Apache Thrift versions 0.9.3 and older, update to Apache Thrift 0.10.0 to resolve the issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

ALT-PU-2017-2692

CVE-2016-5397

GHSA-R4M4-PMVW-M6J5

Affected Products

Alt Linux

Apache Thrift

References · 21

• http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-5397 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3140 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r4m4-pmvw-m6j5 · Vendor Advisory
• https://issues.apache.org/jira/browse/THRIFT-3893 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3254 · Security Note
• https://ubuntu.com/security/CVE-2016-5397 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-5397 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2669 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5397 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5397 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5397 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-2692 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5397 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5397 · Vendor Advisory