[meta-oe,wrynose,0/4] thrift: fix multiple CVEs

Message ID	20260907102107.4007371-1-Abhishek.Bachiphale@windriver.com
Headers	show Return-Path: <abhishek.bachiphale@windriver.com> ip: 205.220.178.238, mailfrom: prvs=3710b275f7=abhishek.bachiphale@windriver.com) From: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com> To: openembedded-devel@lists.openembedded.org Cc: Randy.MacLeod@windriver.com Subject: [meta-oe][wrynose][PATCH 0/4] thrift: fix multiple CVEs Date: Mon, 7 Sep 2026 15:51:03 +0530 Message-Id: <20260907102107.4007371-1-Abhishek.Bachiphale@windriver.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain MIME-Version: 1.0
Series	thrift: fix multiple CVEs \| expand [meta-oe,wrynose,0/4] thrift: fix multiple CVEs [meta-oe,wrynose,1/4] thrift: fix CVE-2026-55969 [meta-oe,wrynose,2/4] thrift: fix CVE-2026-48586 [meta-oe,wrynose,3/4] thrift: fix CVE-2026-48145 [meta-oe,wrynose,4/4] thrift: fix CVE-2026-55970

Message ID

20260907102107.4007371-1-Abhishek.Bachiphale@windriver.com

Headers

From: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
To: openembedded-devel@lists.openembedded.org
Cc: Randy.MacLeod@windriver.com
Subject: [meta-oe][wrynose][PATCH 0/4] thrift: fix multiple CVEs
Date: Mon,  7 Sep 2026 15:51:03 +0530
Message-Id: <20260907102107.4007371-1-Abhishek.Bachiphale@windriver.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
 UwONNU/cp4pnqV7R2846MUHiIf37bExTjJUkvIEfpdoikOg20bzjvRd1WZcWTcWQF9YZ7P1rFM1fg71J7Q7mY0zpVaGiT5wBP4RFbKRxFmTXnwyESZ2Iw8NsmUHUelcugFwBn+T7OjszX2nh19oxx4EyKOK1W/KufqwhOyqbYjS49YhIkvUw+w/z5MhovmdfkQbJzJbe8FCaTPFyTGYTqCKThuIW33DYPdi9ZxXc+q+rNQOiFShIrQ4pVgDLDYgs6GNw7zC3MoGRLms9C5Ha4JHWatT5hF2Kqu2vrbC831yVAoiLRf50D+Izlo5ibQPRFfhEaDJEDJjKCs0Cu5d+7YRX8mBCxq9RPYfSDHUh8AbqjW3MUu7vJFrcLkv3rU0jiaybzoG+mMS+7nyvMNZCzqbuy/W1lc6tbFuxK7d9bYncemVLdqdfTPZxJPFeTudz+FVCHg2DbGQeW+3e4NXTYmKus5mv0l/KpAvQXE2vR82pQWPQWLU/Hm3wgQenvS60Tn2xSHOoE88UeZ9430gXr/+aeReBVPL4USgYLno5LEwJqw2nKI16Ib/URhmHxhqf52G9xJphUEUBaFX3AGobXG0o+vqNva7BRO9oaz8lD6SmjTHjdsjzGYHnqAhnEQZ+pl/ub7PrMIaoacW/CkCBwEItnBa7mdvuAmJT0I1sYiPf0I2P9Vou7B9keCaGi+2rkfU4WXE1pcFsnGdeMfhoZIx1Da3EavA7TP8S399MkPaL90HPPOiSTNJvUQEE5D2mg8Yp32iAdiSuUIiPhGDzXpFHyhHz8YE8HgeRoClwA3sMkX1StnEApdvFHZaVvLol4dLYiuBfg0MfpycK2CB9KkxFIO08abhZa6trNW6hBchOiPyVOppO2akq3MA4cNOxkY6H+WMUD0EyQu0fyKPhCJ5HTzrPpJhHyRulwfX/3O0VVD1vOxNg66lVLC57a1whPBzOPmEbLXBU9jozs0A4Xg3BZkksIKvPbOoaZbRUfWUu3X8pQw4gurrTMOvy7RoCTf8lvjYHe4xCu6C7xkdtMZ+HBUN5XL5jOOiU4mnleoFpTXErd8sxf1+R5QKeImXrdm0TPlnUfo1vBljbjJ0YR9yHJbFmGIBR6tArHwmXYPWsJ095aLDAeRp7cwapzg3Azd+mxbkVROnSvWTBygky5I/ro8sMTkS+/JQc5f4bbe4JzAwPgPotS2qzzab6LH5WP6LMTaDocOleM0jS8/TEoe+gr6mwfB1bOvcBt9pTzinwEJcnAbS++ry+E3twAAYw1EpJFs4m0WADnW2NEmd2Af/3UtUxstzthODbnho9Ie1SuUKp+kpM8Up1gEbpkp4AU5fDkGbzr7dR1tbHhJKboFyqMteczwH6ukCgg/QVYY+4UoZu5VwYklYAFvUM3QbVkVIN0taEaa0SMBRawApD1jWtC7yDn1Vztn/mjySmo1MkQKfAzOCGTX1FOlAb99NRUA6H25/nPX1cSzy0jMOBz4hLdh1IfL23R4C6mZN89lUkIO6zATmtj+fLS+d8yL3yVSCcug14q6rKR8PO3Edp1MInORXhpfq7I8L0uqb3TGfYnVxs6/nGL/fGMS5TcqB4zb7u3MUv3rpbxxiKH/dlD9p8MRaKujnpF2w78Ub9A/v1dvD/HaNhguepy0rHF6zH6cQIeDJSyytq6LGSoehawBGbkE0s3GMV5atrYKLOBsS8HEN8CkUgIO30KCymCttpVvwtz8U099KB6jsDhpVVONpp+nUamADJOP0QFMzUHgqCL9iB065RY7Trg0rZQZ9B
X-Exchange-RoutingPolicyChecked: 
	VfzQHhMHvE2PTbdXHobv6wudAUUmCDpO5Hf99hHnCwIzECQRbD1quCcQuM0vHq5MJdLfDpgwD/KKpzjaKjJK6Akjsi7wIATZjJX7KiEnIg/ye7qN5/gBy/g1JZY4yTlM5rh0cWo3O5a4ut5IrHyytPrlDrTpEolvGBA8iCLJlXpOTWEcED52XmUKm4exsda5vSXJOwHiJJiPEa4jWhgL2RD5JFqakQZxSNaOacP5Pm8wzEJkI5/RFjQAihKTpSG6cwJRcpKKq4jhUcd1xlA/dNkc7augLkPCGgTegVcKQXCgyaLHGsUin3NgqjAulTJmtA09BHgKTqrphzhK6Fp+8Q==
X-OriginatorOrg: windriver.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 f870489c-d864-4569-89d4-08df0cc9cbcd
X-MS-Exchange-CrossTenant-AuthSource: SJ2PR11MB8402.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 10:21:36.6227
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 
 gcNmsB0m7bxtVw5lDIniqidyvD4KyZvb1yOzAs4kFpn2rduYX52mTsJnQrZjrjsiuTvpDXqs7KzR2Has/9L27bxjBU3xKwJoArBN+xbJ8nrhOtp5ScL/pGO/2o9czAFe
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR11MB7179
X-Authority-Analysis: v=2.4 cv=IqAutr/g c=1 sm=1 tr=0 ts=6a9e9034 cx=c_pps
 a=Ms9fQC66fVli3+vYcCKl2w==:117 a=6eWqkTHjU83fiwn7nKZWdM+Sl24=:19
 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19
 a=xqWC_Br6kY4A:10 a=VdqzKS8jKosA:10 a=VkNPw1HP01LnGYTKEx00:22
 a=bi6dqmuHe4P4UrxVR6um:22 a=fTW__CHxibyLmBMfj2wP:22 a=60T_7M9bhg8Sl00-iZsA:9
X-Proofpoint-ORIG-GUID: HA7XIXsZCw6TedBtyaWM9R_DpgoCLbpq
X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwOTA3MDExMSBTYWx0ZWRfX9H0JqSTsSwQW
 eQbsOowljpzUtP5CgewVlhHYiu/o+O+BclN1/zgv4J7O4Fy5JwOOA70YEkTXSHg/bFZue+XuWJ3
 KeHhdGCaf1WRNvGIpjDPuahu4st4A0wM6AJGQD1G8YIvLwbFSQQxnZSmd9WxHuFcSYiXz63rPDq
 v27IHFuT6kdnMA4ITp0sni0CaA0VZSwF8CwgF8ZtVsO/OTPNQiGgXNKW4bBSsNum1DTtDbV3Lyf
 LB2VL8bg9mRtAtG97Drb2yhEPE6X43nTLgQU1H9swMlgYGi/J1SzZQAzk6Muxtxq08AgQ03eOD/
 efzlRXg0YUaAnTfjRXNZ3V16wU0kl0uJK/ZQAplQaN7XHsTukyP1jJKEf3G9Vf/EsCvJvxpUV7Z
 XwWUpbyh+o+EA0ViaYhBjxhNp7n0Qsb3KrNvycbD33u0F0hea5D8YnzP8SfOZ/rFdOtYOZRIr4E
 yj9z4rY7zP160/pDaFw==
X-Proofpoint-Spam-Info: AW1haW4tMjYwOTA3MDExMSBTYWx0ZWRfX6NPs30wbkER9
 G9or8hnJvugKAt6AhdSYYt+wtXQuP7hSkUM+qQxW1cY8HwlA8vZj3fZ6kaEPKcWZpta8KZE1RT4
 3vzadiloDmHEmvFbHJ6QSHPz22Td2/Kj8x5YmQgq8Vz6MRzQITsx
X-Proofpoint-GUID: HA7XIXsZCw6TedBtyaWM9R_DpgoCLbpq
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49
 definitions=2026-09-07_02,2026-09-07_01,2025-10-01_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0
 impostorscore=0 suspectscore=0 spamscore=0 lowpriorityscore=0
 priorityscore=1501 clxscore=1011 bulkscore=0 malwarescore=0 adultscore=0
 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc=
 route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000
 definitions=main-2609070111
List-Id: <openembedded-devel.lists.openembedded.org>
X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com
 [45.33.107.173] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <openembedded-devel@lists.openembedded.org>; Mon, 07 Sep 2026 10:21:48 -0000
X-Groupsio-URL: 
 https://lists.openembedded.org/g/openembedded-devel/message/129809

Series

thrift: fix multiple CVEs | expand

Message

Abhishek Bachiphale Sept. 7, 2026, 10:21 a.m. UTC

This series backports fixes for four Apache Thrift C++ CVEs to the
wrynose branch (thrift 0.22.0), all fixed upstream in Apache Thrift 0.24.0:

  CVE-2026-55969 - integer overflow in TProtocol::checkReadBytesAvailable()
  CVE-2026-48586 - TZlibTransport decompression size limit (data amplification)
  CVE-2026-48145 - TSSLSocket matchName() RFC 6125 wildcard bypass
  CVE-2026-55970 - heap out-of-bounds read in THeaderTransport::readHeaderFormat()

This series applies on top of the previously-submitted patch:
  "[meta-oe][wrynose] thrift: fix CVE-2026-58662"
Please apply that patch first.

Abhishek Bachiphale (4):
  thrift: fix CVE-2026-55969
  thrift: fix CVE-2026-48586
  thrift: fix CVE-2026-48145
  thrift: fix CVE-2026-55970

 .../thrift/thrift/CVE-2026-48145.patch        | 137 ++++++++
 .../thrift/thrift/CVE-2026-48586-01.patch     | 109 +++++++
 .../thrift/thrift/CVE-2026-48586-02.patch     |  78 +++++
 .../thrift/thrift/CVE-2026-55969.patch        | 292 ++++++++++++++++++
 .../thrift/thrift/CVE-2026-55970.patch        |  64 ++++
 .../thrift/thrift_0.22.0.bb                   |   5 +
 6 files changed, 685 insertions(+)
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48145.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48586-01.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-48586-02.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55969.patch
 create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-55970.patch