{"api_version":"1","generated_at":"2026-07-23T20:30:44+00:00","cve":"CVE-2016-5397","urls":{"html":"https://cve.report/CVE-2016-5397","api":"https://cve.report/api/cve/CVE-2016-5397.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-5397","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-5397"},"summary":{"title":"CVE-2016-5397","description":"The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.","state":"PUBLIC","assigner":"security@apache.org","published_at":"2018-02-12 17:29:00","updated_at":"2023-11-07 02:33:00"},"problem_types":["CWE-77"],"metrics":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2019:3140","name":"RHSA-2019:3140","refsource":"REDHAT","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E","name":"[cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6","refsource":"MLIST","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E","name":"[user] 20170113 [NOTICE]: Apache Thrift Security Vulnerability CVE-2016-5397","refsource":"MLIST","tags":["Mailing List","Vendor Advisory"],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/103025","name":"103025","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"Apache Thrift CVE-2016-5397 Remote Command Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3%40%3Ccommits.cassandra.apache.org%3E","name":"[cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6","refsource":"","tags":[],"title":"Pony Mail!","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://issues.apache.org/jira/browse/THRIFT-3893","name":"https://issues.apache.org/jira/browse/THRIFT-3893","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"[THRIFT-3893] Command injection in format_go_output - ASF JIRA","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2018:2669","name":"RHSA-2018:2669","refsource":"REDHAT","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5397","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5397","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"5397","vulnerable":"1","versionEndIncluding":"0.9.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apache","cpe5":"thrift","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@apache.org","DATE_PUBLIC":"2017-01-13T00:00:00","ID":"CVE-2016-5397","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Apache Thrift","version":{"version_data":[{"version_value":"versions prior to 0.10.0"}]}}]},"vendor_name":"Apache Software Foundation"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Command Injection"}]}]},"references":{"reference_data":[{"name":"103025","refsource":"BID","url":"http://www.securityfocus.com/bid/103025"},{"name":"RHSA-2018:2669","refsource":"REDHAT","url":"https://access.redhat.com/errata/RHSA-2018:2669"},{"name":"https://issues.apache.org/jira/browse/THRIFT-3893","refsource":"CONFIRM","url":"https://issues.apache.org/jira/browse/THRIFT-3893"},{"name":"[user] 20170113 [NOTICE]: Apache Thrift Security Vulnerability CVE-2016-5397","refsource":"MLIST","url":"http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E"},{"refsource":"REDHAT","name":"RHSA-2019:3140","url":"https://access.redhat.com/errata/RHSA-2019:3140"},{"refsource":"MLIST","name":"[cassandra-commits] 20200604 [jira] [Created] (CASSANDRA-15856) Security vulnerabilities with dependency jars of Cassandra 3.11.6","url":"https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E"}]}},"nvd":{"publishedDate":"2018-02-12 17:29:00","lastModifiedDate":"2023-11-07 02:33:00","problem_types":["CWE-77"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":9},"severity":"HIGH","exploitabilityScore":8,"impactScore":10,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*","versionEndIncluding":"0.9.3","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"5397","Ordinal":"91479","Title":"CVE-2016-5397","CVE":"CVE-2016-5397","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"5397","Ordinal":"1","NoteData":"The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.","Type":"Description","Title":null},{"CveYear":"2016","CveId":"5397","Ordinal":"2","NoteData":"2018-02-12","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"5397","Ordinal":"3","NoteData":"2020-06-04","Type":"Other","Title":"Modified"}]}}}