Patchwire CVEs, their patch status, and feeds to follow them

CVE-2016-5397

Fixed in a distro release EPSS 7%

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

Published 2018-02-12 · CVE record · OSV

Products: Apache Software Foundation Apache Thrift

Fixed upstream

EcosystemPackageFixed in
Gogithub.com/apache/thrift0.10.0

Distro releases

ReleasePackageFixed in
Chainguardcadence1.4.0-r3
Chainguardcadence1.3.6-r0
Chainguardcadence-cassandra-tool1.4.0-r3
Chainguardcadence-fips1.4.0-r3
Chainguardcadence-fips1.3.6-r0
Chainguardcadence-fips-cassandra-tool1.4.0-r3
Chainguardcadence-fips-server1.4.0-r3
Chainguardcadence-fips-sql-tool1.4.0-r3
Chainguardcadence-server1.4.0-r3
Chainguardcadence-sql-tool1.4.0-r3
Debian 12thrift0.11.0-3
Debian 13thrift0.11.0-3
Debian 14thrift0.11.0-3
Ubuntu 16.04 LTSthrift-compilerno fix
Ubuntu 18.04 LTSthrift-compilerno fix