x/vulndb: potential Go vuln in github.com/apache/thrift: GHSA-r4m4-pmvw-m6j5

[GoVulnBot]

In GitHub Security Advisory GHSA-r4m4-pmvw-m6j5, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/apache/thrift	0.10.0	<= 0.9.3

Cross references:

• Module github.com/apache/thrift appears in issue dummy issue #101

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/apache/thrift
      versions:
        - introduced: TODO (earliest fixed "0.10.0", vuln range "<= 0.9.3")
      vulnerable_at: 0.18.1
      packages:
        - package: github.com/apache/thrift
summary: Apache Thrift Go Library Command Injection
description: |-
    The Apache Thrift Go client library exposed the potential during code generation
    for command injection due to using an external formatting tool. Affected Apache
    Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
cves:
    - CVE-2016-5397
ghsas:
    - GHSA-r4m4-pmvw-m6j5
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2016-5397
    - web: https://access.redhat.com/errata/RHSA-2018:2669
    - web: https://access.redhat.com/errata/RHSA-2019:3140
    - web: https://issues.apache.org/jira/browse/THRIFT-3893
    - web: https://lists.apache.org/thread.html/r4d3f1d3e333d9c2b2f6e6ae8ed8750d4de03410ac294bcd12c7eefa3@%3Ccommits.cassandra.apache.org%3E
    - web: http://mail-archives.apache.org/mod_mbox/thrift-user/201701.mbox/raw/%3CCANyrgvc3W%3DMJ9S-hMZecPNzxkyfgNmuSgVfW2hdDSz5ke%2BOPhQ%40mail.gmail.com%3E
    - web: https://web.archive.org/web/20210124141102/http://www.securityfocus.com/bid/103025
    - advisory: https://github.com/advisories/GHSA-r4m4-pmvw-m6j5

[gopherbot]

Change https://go.dev/cl/516117 mentions this issue: data/reports: add GO-2023-1984.yaml

[tatianab]

This seems to be a tool vulnerability (in the code generator), not a library one. The tool is in C++, not Go (apache/thrift#1061)

[gopherbot]

Change https://go.dev/cl/522555 mentions this issue: data/excluded: batch add 11 excluded reports