mbox series

[meta-oe,scarthgap,0/3] thrift: backport security fixes

Message ID 20260803141716.853285-1-adarsh.jagadish.kamini@est.tech
Headers show
Series thrift: backport security fixes | expand

Message

Adarsh Jagadish Kamini Aug. 3, 2026, 2:17 p.m. UTC 
From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>

This series backports three security fixes for thrift 0.20.0 on the
scarthgap branch:

  - CVE-2026-55971: read the zlib transform result directly in
    THeaderTransport::untransform instead of copying the (larger)
    decompressed result back into the smaller receive buffer.
  - CVE-2026-58023: copy the buffered leftover from the GByteArray data
    member rather than the GByteArray struct itself in the c_glib
    buffered/framed transport read_slow paths.
  - CVE-2026-48144: validate the peer hostname (SSL_set1_host) before
    SSL_connect in the c_glib TLS client.

All three are backports from upstream apache/thrift with
Upstream-Status: Backport tags.

Testing: the recipe builds with -DBUILD_TESTING=OFF, so the C++ test
suite is not compiled during a normal build. To verify the
CVE-2026-55971 fix, the suite was built with BUILD_TESTING=ON (using the
native thrift compiler for codegen via THRIFT_COMPILER) and the
resulting UnitTests binary was executed against the qemux86-64 target
sysroot. test_theadertransport_zlib_roundtrip passed; the only failing
case (ToStringTest/locale_de_DE_floating_point_to_string) is unrelated
and caused by the de_DE locale being absent from the minimal test
sysroot.

Adarsh Jagadish Kamini (3):
  thrift: fix CVE-2026-55971
  thrift: fix CVE-2026-58023
  thrift: fix CVE-2026-48144

 .../thrift/thrift/CVE-2026-48144.patch        |  36 +++
 .../thrift/thrift/CVE-2026-55971.patch        |  98 ++++++++
 .../thrift/thrift/CVE-2026-58023.patch        | 231 ++++++++++++++++++
 .../thrift/thrift_0.20.0.bb                   |   3 +
 4 files changed, 368 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48144.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55971.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58023.patch