mbox series

[meta-oe,wrynose,0/4] thrift: multiple CVE fixes

Message ID 20260803125927.831690-1-adarsh.jagadish.kamini@est.tech
Headers show
Series thrift: multiple CVE fixes | expand

Message

Adarsh Jagadish Kamini Aug. 3, 2026, 12:59 p.m. UTC 
From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>

Backport upstream fixes for four CVEs in thrift 0.22.0:

- CVE-2026-55971: OOB read in the C++ THeaderTransport zlib untransform path.
- CVE-2026-58023: heap over-read in the c_glib buffered/framed transports.
- CVE-2026-48144: missing peer hostname validation in the c_glib TLS client.
- CVE-2026-58389: max_string_size not enforced on non-strict binary message
  names (Rust).

Tested on qemux86-64 by building with BUILD_TESTING=ON:

- CVE-2026-55971: new test_theadertransport_zlib_roundtrip passed.
- CVE-2026-58023: new ReadAcrossBuffer and ReadAcrossFrames tests passed,
  and fail without the fix.

CVE-2026-48144 ships no test; CVE-2026-58389 is in the Rust library, which
this recipe does not build. Neither was run.

Adarsh Jagadish Kamini (4):
  thrift: fix CVE-2026-55971
  thrift: fix CVE-2026-58023
  thrift: fix CVE-2026-48144
  thrift: fix CVE-2026-58389

 .../thrift/thrift/CVE-2026-48144.patch        |  36 +++
 .../thrift/thrift/CVE-2026-55971.patch        |  92 +++++++
 .../thrift/thrift/CVE-2026-58023.patch        | 231 ++++++++++++++++++
 .../thrift/thrift/CVE-2026-58389.patch        |  93 +++++++
 .../thrift/thrift_0.22.0.bb                   |   4 +
 5 files changed, 456 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55971.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58023.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch