The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
CVSS Score
8.8
EPSS Score
0.069
Published
2018-02-12
The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
CVSS Score
6.5
EPSS Score
0.053
Published
2017-06-16
Page 4