diff --git a/SPECS/thrift/CVE-2025-48431.patch b/SPECS/thrift/CVE-2025-48431.patch deleted file mode 100644 index ebdee89fabf..00000000000 --- a/SPECS/thrift/CVE-2025-48431.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 2182a3ee3e3664b9a767da0da640361daab8b837 Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Mon, 4 May 2026 14:36:20 +0000 -Subject: [PATCH] c_glib: Fix parent class resolution in generated - dispatch_call by peeking class with processor type ID instead of runtime - class. Use g_type_class_peek(parent(g_type_class_peek())) pattern to - ensure correct dispatch when service inheritance is used. - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/0f8ec9c1014ed21acc324aaa421017fb164e9608.patch ---- - compiler/cpp/src/thrift/generate/t_c_glib_generator.cc | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/compiler/cpp/src/thrift/generate/t_c_glib_generator.cc b/compiler/cpp/src/thrift/generate/t_c_glib_generator.cc -index 8cb82c1..b5d73db 100644 ---- a/compiler/cpp/src/thrift/generate/t_c_glib_generator.cc -+++ b/compiler/cpp/src/thrift/generate/t_c_glib_generator.cc -@@ -2594,8 +2594,8 @@ void t_c_glib_generator::generate_service_processor(t_service* tservice) { - f_service_ << indent() << parent_class_name << "Class " - "*parent_class =" << endl; - indent_up(); -- f_service_ << indent() << "g_type_class_peek_parent (" << class_name_uc << "_GET_CLASS (self));" -- << endl; -+ f_service_ << indent() << "g_type_class_peek_parent (g_type_class_peek (" -+ << class_name_lc << "_get_type ()));" << endl; - indent_down(); - f_service_ << endl - << indent() << "process_function_def = " --- -2.45.4 - diff --git a/SPECS/thrift/CVE-2026-41602.patch b/SPECS/thrift/CVE-2026-41602.patch deleted file mode 100644 index a4cc58fdbb8..00000000000 --- a/SPECS/thrift/CVE-2026-41602.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 948a72f623ac1ffdc4da0233a9296057242b454d Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Mon, 4 May 2026 14:34:04 +0000 -Subject: [PATCH] backport: add int range checks to framed_transport.go (align - with upstream patch) - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/630d66c633a88bbae4a2a090fcb41f72dd1adc6a.patch ---- - lib/go/thrift/framed_transport.go | 11 ++++++++++- - 1 file changed, 10 insertions(+), 1 deletion(-) - -diff --git a/lib/go/thrift/framed_transport.go b/lib/go/thrift/framed_transport.go -index 2156dd7..8161d04 100644 ---- a/lib/go/thrift/framed_transport.go -+++ b/lib/go/thrift/framed_transport.go -@@ -26,6 +26,7 @@ import ( - "encoding/binary" - "fmt" - "io" -+ "math" - ) - - // Deprecated: Use DEFAULT_MAX_FRAME_SIZE instead. -@@ -60,8 +61,13 @@ func NewTFramedTransportFactory(factory TTransportFactory) TTransportFactory { - - // Deprecated: Use NewTFramedTransportFactoryConf instead. - func NewTFramedTransportFactoryMaxLength(factory TTransportFactory, maxLength uint32) TTransportFactory { -+ safeMax := maxLength -+ if safeMax > math.MaxInt32 { -+ safeMax = math.MaxInt32 -+ } -+ - return NewTFramedTransportFactoryConf(factory, &TConfiguration{ -- MaxFrameSize: int32(maxLength), -+ MaxFrameSize: int32(safeMax), - - noPropagation: true, - }) -@@ -177,6 +183,9 @@ func (p *TFramedTransport) WriteString(s string) (n int, err error) { - - func (p *TFramedTransport) Flush(ctx context.Context) error { - size := p.writeBuf.Len() -+ if size > math.MaxUint32 { -+ return NewTTransportException(UNKNOWN_TRANSPORT_EXCEPTION, fmt.Sprintf("frame too large: %d bytes exceeds uint32 max",size)) -+ } - buf := p.buffer[:4] - binary.BigEndian.PutUint32(buf, uint32(size)) - _, err := p.transport.Write(buf) --- -2.45.4 - diff --git a/SPECS/thrift/CVE-2026-41603.patch b/SPECS/thrift/CVE-2026-41603.patch deleted file mode 100644 index 6c7b5d8c41a..00000000000 --- a/SPECS/thrift/CVE-2026-41603.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 088417023686d16b96da23c9259269baf129c42c Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Mon, 4 May 2026 14:30:23 +0000 -Subject: [PATCH] Enable TLS hostname verification in TSSLTransportFactory - Client: java - -Set EndpointIdentificationAlgorithm to HTTPS on SSLSocket parameters -in createClient() so that the server certificate CN/SAN is validated -against the target hostname during TLS handshake. - -(03) - -Co-Authored-By: Claude Opus 4.6 -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/68ac8e935ef440c3e22d0e1a30e7211b9bf1d441.patch https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66.patch ---- - .../org/apache/thrift/transport/TSSLTransportFactory.java | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/lib/java/src/org/apache/thrift/transport/TSSLTransportFactory.java b/lib/java/src/org/apache/thrift/transport/TSSLTransportFactory.java -index 3389e4d..5d127bb 100644 ---- a/lib/java/src/org/apache/thrift/transport/TSSLTransportFactory.java -+++ b/lib/java/src/org/apache/thrift/transport/TSSLTransportFactory.java -@@ -31,6 +31,7 @@ import java.util.Arrays; - - import javax.net.ssl.KeyManagerFactory; - import javax.net.ssl.SSLContext; -+import javax.net.ssl.SSLParameters; - import javax.net.ssl.SSLServerSocket; - import javax.net.ssl.SSLServerSocketFactory; - import javax.net.ssl.SSLSocket; -@@ -274,6 +275,10 @@ public class TSSLTransportFactory { - try { - SSLSocket socket = (SSLSocket) factory.createSocket(host, port); - socket.setSoTimeout(timeout); -+ // Enable TLS hostname verification (CN/SAN vs target hostname) -+ SSLParameters sslParams = socket.getSSLParameters(); -+ sslParams.setEndpointIdentificationAlgorithm("HTTPS"); -+ socket.setSSLParameters(sslParams); - return new TSocket(socket); - } catch (TTransportException tte) { - throw tte; --- -2.45.4 - diff --git a/SPECS/thrift/CVE-2026-41605.patch b/SPECS/thrift/CVE-2026-41605.patch deleted file mode 100644 index caeda954718..00000000000 --- a/SPECS/thrift/CVE-2026-41605.patch +++ /dev/null @@ -1,128 +0,0 @@ -From 8ee1357487936e2a184f02f49475e0f2658ec6e3 Mon Sep 17 00:00:00 2001 -From: AllSpark -Date: Mon, 4 May 2026 14:28:38 +0000 -Subject: [PATCH] Add input validation to Swift protocol layer Client: swift - -- Add recursion depth limit (64) and negative size checks to - - skip() in TProtocol for map, set, and list types - -- Add range validation for fieldId before UInt8 cast in - - TCompactProtocol.readFieldBegin() - -(07, 08) - -Co-Authored-By: Claude Opus 4.6 - -This closes #3392 - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/e242889231df48f8791372598052862c28f5be83.patch ---- - lib/swift/Sources/TCompactProtocol.swift | 4 +++ - lib/swift/Sources/TProtocol.swift | 41 +++++++++++++++++------- - 2 files changed, 33 insertions(+), 12 deletions(-) - -diff --git a/lib/swift/Sources/TCompactProtocol.swift b/lib/swift/Sources/TCompactProtocol.swift -index 81a51f5..cc9bd32 100644 ---- a/lib/swift/Sources/TCompactProtocol.swift -+++ b/lib/swift/Sources/TCompactProtocol.swift -@@ -311,6 +311,10 @@ public class TCompactProtocol: TProtocol { - booleanValue = type == .boolean_TRUE - } - -+ guard fieldId >= 0 && fieldId <= Int16(UInt8.max) else { -+ throw TProtocolError(error: .invalidData, -+ message: "Field id out of range: \(fieldId)") -+ } - // push the new field onto the field stack so we can keep the deltas going - lastFieldId = UInt8(fieldId) - return ("", fieldType, Int32(fieldId)) -diff --git a/lib/swift/Sources/TProtocol.swift b/lib/swift/Sources/TProtocol.swift -index b4e5dbe..d3e188b 100644 ---- a/lib/swift/Sources/TProtocol.swift -+++ b/lib/swift/Sources/TProtocol.swift -@@ -130,6 +130,14 @@ public extension TProtocol { - } - - func skip(type: TType) throws { -+ try skip(type: type, depth: 0) -+ } -+ -+ private func skip(type: TType, depth: Int) throws { -+ let nextDepth = depth + 1 -+ if nextDepth > 64 { -+ throw TProtocolError(error: .depthLimit, message: "Maximum skip depth exceeded") -+ } - switch type { - case .bool: _ = try read() as Bool - case .i8: _ = try read() as UInt8 -@@ -138,7 +146,7 @@ public extension TProtocol { - case .i64: _ = try read() as Int64 - case .double: _ = try read() as Double - case .string: _ = try read() as String -- -+ - case .struct: - _ = try readStructBegin() - while true { -@@ -146,35 +154,44 @@ public extension TProtocol { - if fieldType == .stop { - break - } -- try skip(type: fieldType) -+ try skip(type: fieldType, depth: nextDepth) - try readFieldEnd() - } - try readStructEnd() -- -- -+ -+ - case .map: - let (keyType, valueType, size) = try readMapBegin() -+ if size < 0 { -+ throw TProtocolError(error: .negativeSize, message: "Negative map size: \(size)") -+ } - for _ in 0.. -Date: Mon, 4 May 2026 14:31:02 +0000 -Subject: [PATCH] nodejs: Add recursion depth limit to protocol skip() to avoid - stack exhaustion; limit 64 matching C++/Java - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/4af8c7c8768cb687b182c1839a39d4beb4f35a5d.patch ---- - lib/nodejs/lib/thrift/binary_protocol.js | 19 +++++++++++++------ - lib/nodejs/lib/thrift/compact_protocol.js | 19 +++++++++++++------ - lib/nodejs/lib/thrift/json_protocol.js | 19 +++++++++++++------ - 3 files changed, 39 insertions(+), 18 deletions(-) - -diff --git a/lib/nodejs/lib/thrift/binary_protocol.js b/lib/nodejs/lib/thrift/binary_protocol.js -index af8836c..5f1f4e5 100644 ---- a/lib/nodejs/lib/thrift/binary_protocol.js -+++ b/lib/nodejs/lib/thrift/binary_protocol.js -@@ -304,7 +304,14 @@ TBinaryProtocol.prototype.getTransport = function() { - return this.trans; - }; - --TBinaryProtocol.prototype.skip = function(type) { -+TBinaryProtocol.prototype.skip = function (type, depth) { -+ depth = (depth || 0) + 1; -+ if (depth > 64) { -+ throw new Thrift.TProtocolException( -+ Thrift.TProtocolExceptionType.DEPTH_LIMIT, -+ "Maximum skip depth exceeded" -+ ); -+ } - switch (type) { - case Type.BOOL: - this.readBool(); -@@ -334,7 +341,7 @@ TBinaryProtocol.prototype.skip = function(type) { - if (r.ftype === Type.STOP) { - break; - } -- this.skip(r.ftype); -+ this.skip(r.ftype, depth); - this.readFieldEnd(); - } - this.readStructEnd(); -@@ -342,22 +349,22 @@ TBinaryProtocol.prototype.skip = function(type) { - case Type.MAP: - var mapBegin = this.readMapBegin(); - for (var i = 0; i < mapBegin.size; ++i) { -- this.skip(mapBegin.ktype); -- this.skip(mapBegin.vtype); -+ this.skip(mapBegin.ktype, depth); -+ this.skip(mapBegin.vtype, depth); - } - this.readMapEnd(); - break; - case Type.SET: - var setBegin = this.readSetBegin(); - for (var i2 = 0; i2 < setBegin.size; ++i2) { -- this.skip(setBegin.etype); -+ this.skip(setBegin.etype, depth); - } - this.readSetEnd(); - break; - case Type.LIST: - var listBegin = this.readListBegin(); - for (var i3 = 0; i3 < listBegin.size; ++i3) { -- this.skip(listBegin.etype); -+ this.skip(listBegin.etype, depth); - } - this.readListEnd(); - break; -diff --git a/lib/nodejs/lib/thrift/compact_protocol.js b/lib/nodejs/lib/thrift/compact_protocol.js -index 302a88d..ec3c60d 100644 ---- a/lib/nodejs/lib/thrift/compact_protocol.js -+++ b/lib/nodejs/lib/thrift/compact_protocol.js -@@ -852,7 +852,14 @@ TCompactProtocol.prototype.zigzagToI64 = function(n) { - return new Int64(hi, lo); - }; - --TCompactProtocol.prototype.skip = function(type) { -+TCompactProtocol.prototype.skip = function (type, depth) { -+ depth = (depth || 0) + 1; -+ if (depth > 64) { -+ throw new Thrift.TProtocolException( -+ Thrift.TProtocolExceptionType.DEPTH_LIMIT, -+ "Maximum skip depth exceeded" -+ ); -+ } - switch (type) { - case Type.BOOL: - this.readBool(); -@@ -882,7 +889,7 @@ TCompactProtocol.prototype.skip = function(type) { - if (r.ftype === Type.STOP) { - break; - } -- this.skip(r.ftype); -+ this.skip(r.ftype, depth); - this.readFieldEnd(); - } - this.readStructEnd(); -@@ -890,22 +897,22 @@ TCompactProtocol.prototype.skip = function(type) { - case Type.MAP: - var mapBegin = this.readMapBegin(); - for (var i = 0; i < mapBegin.size; ++i) { -- this.skip(mapBegin.ktype); -- this.skip(mapBegin.vtype); -+ this.skip(mapBegin.ktype, depth); -+ this.skip(mapBegin.vtype, depth); - } - this.readMapEnd(); - break; - case Type.SET: - var setBegin = this.readSetBegin(); - for (var i2 = 0; i2 < setBegin.size; ++i2) { -- this.skip(setBegin.etype); -+ this.skip(setBegin.etype, depth); - } - this.readSetEnd(); - break; - case Type.LIST: - var listBegin = this.readListBegin(); - for (var i3 = 0; i3 < listBegin.size; ++i3) { -- this.skip(listBegin.etype); -+ this.skip(listBegin.etype, depth); - } - this.readListEnd(); - break; -diff --git a/lib/nodejs/lib/thrift/json_protocol.js b/lib/nodejs/lib/thrift/json_protocol.js -index 7e2b7c9..7308981 100644 ---- a/lib/nodejs/lib/thrift/json_protocol.js -+++ b/lib/nodejs/lib/thrift/json_protocol.js -@@ -736,7 +736,14 @@ TJSONProtocol.prototype.getTransport = function() { - /** - * Method to arbitrarily skip over data - */ --TJSONProtocol.prototype.skip = function(type) { -+TJSONProtocol.prototype.skip = function (type, depth) { -+ depth = (depth || 0) + 1; -+ if (depth > 64) { -+ throw new Thrift.TProtocolException( -+ Thrift.TProtocolExceptionType.DEPTH_LIMIT, -+ "Maximum skip depth exceeded" -+ ); -+ } - switch (type) { - case Type.BOOL: - this.readBool(); -@@ -766,7 +773,7 @@ TJSONProtocol.prototype.skip = function(type) { - if (r.ftype === Type.STOP) { - break; - } -- this.skip(r.ftype); -+ this.skip(r.ftype, depth); - this.readFieldEnd(); - } - this.readStructEnd(); -@@ -774,22 +781,22 @@ TJSONProtocol.prototype.skip = function(type) { - case Type.MAP: - var mapBegin = this.readMapBegin(); - for (var i = 0; i < mapBegin.size; ++i) { -- this.skip(mapBegin.ktype); -- this.skip(mapBegin.vtype); -+ this.skip(mapBegin.ktype, depth); -+ this.skip(mapBegin.vtype, depth); - } - this.readMapEnd(); - break; - case Type.SET: - var setBegin = this.readSetBegin(); - for (var i2 = 0; i2 < setBegin.size; ++i2) { -- this.skip(setBegin.etype); -+ this.skip(setBegin.etype, depth); - } - this.readSetEnd(); - break; - case Type.LIST: - var listBegin = this.readListBegin(); - for (var i3 = 0; i3 < listBegin.size; ++i3) { -- this.skip(listBegin.etype); -+ this.skip(listBegin.etype, depth); - } - this.readListEnd(); - break; --- -2.45.4 - diff --git a/SPECS/thrift/thrift.signatures.json b/SPECS/thrift/thrift.signatures.json index 30193859a43..ef505cb087a 100644 --- a/SPECS/thrift/thrift.signatures.json +++ b/SPECS/thrift/thrift.signatures.json @@ -1,8 +1,7 @@ { "Signatures": { "bootstrap.sh": "ad4d6eb9fcd1bdc068dd98966516a32db760223a2b9ec9527bc6ac50240d6de5", - "libthrift-0.15.0.pom": "18975af7be5790578a9570f5716fce49c769bff05fab8ad6829c768c2120208b", - "thrift-0.15.0.tar.gz": "d5883566d161f8f6ddd4e21f3a9e3e6b8272799d054820f1c25b11e86718f86b" - } + "libthrift-0.24.0.pom": "3b45f4709da98e7c9331ce5f23c54dd17740d36cb6e32355af8f9da491cf2ffd", + "thrift-0.24.0.tar.gz": "e0fa5839a4c5c1d631b0931cf2c554ebbfa4e2fee3a9fb3ffd4f82ce4396c6e4" + } } - \ No newline at end of file diff --git a/SPECS/thrift/thrift.spec b/SPECS/thrift/thrift.spec index e976dc406c9..e9b2dd82b6e 100644 --- a/SPECS/thrift/thrift.spec +++ b/SPECS/thrift/thrift.spec @@ -65,8 +65,8 @@ # change is a SONAME change and dependencies need to be rebuilt Summary: Software framework for cross-language services development Name: thrift -Version: 0.15.0 -Release: 6%{?dist} +Version: 0.24.0 +Release: 1%{?dist} # Parts of the source are used under the BSD and zlib licenses, but # these are OK for inclusion in an Apache 2.0-licensed whole: @@ -87,12 +87,6 @@ Source2: https://raw.github.com/apache/%{name}/%{version}/bootstrap.sh # fix configure.ac insistence on using /usr/local/lib for JAVA_PREFIX Patch1: configure-java-prefix.patch -Patch2: CVE-2025-48431.patch -Patch3: CVE-2026-41602.patch -Patch4: CVE-2026-41603.patch -Patch5: CVE-2026-41605.patch -Patch6: CVE-2026-41636.patch - # BuildRequires for language-specific bindings are listed under these # subpackages, to facilitate enabling or disabling individual language @@ -100,6 +94,8 @@ Patch6: CVE-2026-41636.patch BuildRequires: pkgconfig(libcrypto) BuildRequires: python3-six +BuildRequires: python3-pip +BuildRequires: python3-wheel %if 0%{?want_java} > 0 BuildRequires: ant >= 1.7 %endif @@ -325,7 +321,9 @@ sed -i -e 's/ -shared / -Wl,--as-needed\0/g' libtool %make_build %install -%make_install +# Disable pip build isolation and network access so the Python bindings build +# offline using the pre-installed python3-setuptools and python3-wheel. +%make_install PYTHON_SETUPUTIL_ARGS="--no-build-isolation --no-index" find %{buildroot} -name '*.la' -exec rm -f {} ';' find %{buildroot} -name fastbinary.so | xargs -r chmod 755 find %{buildroot} -name \*.erl -or -name \*.hrl -or -name \*.app | xargs -r chmod 644 @@ -363,7 +361,7 @@ find %{buildroot} -name \*.py -exec grep -q /usr/bin/env {} \; -print | xargs -r %files -%doc LICENSE NOTICE +%license LICENSE NOTICE %{_bindir}/thrift %{_libdir}/libthrift-%{version}.so %{_libdir}/libthriftz-%{version}.so @@ -379,7 +377,7 @@ find %{buildroot} -name \*.py -exec grep -q /usr/bin/env {} \; -print | xargs -r %{_libdir}/pkgconfig/thrift-nb.pc %{_libdir}/pkgconfig/thrift.pc %{_libdir}/pkgconfig/thrift_c_glib.pc -%doc LICENSE NOTICE +%license LICENSE NOTICE %if 0%{?want_php} != 0 @@ -387,30 +385,34 @@ find %{buildroot} -name \*.py -exec grep -q /usr/bin/env {} \; -print | xargs -r %config(noreplace) /etc/php.d/thrift_protocol.ini %{_datadir}/php/Thrift/ %{php_extdir}/thrift_protocol.so -%doc LICENSE NOTICE +%license LICENSE NOTICE %endif %if %{?want_erlang} > 0 %files -n erlang-%{name} %{_libdir}/erlang/lib/%{name}-%{version}/ -%doc LICENSE NOTICE +%license LICENSE NOTICE %endif %files -n python3-%{name} %{python3_sitearch}/%{name} -%{python3_sitearch}/%{name}-%{version}-py%{python3_version}.egg-info -%doc LICENSE NOTICE +%{python3_sitearch}/%{name}-%{version}.dist-info/ +%license LICENSE NOTICE %if 0%{?want_java} > 0 %files -n lib%{name}-javadoc %{_javadocdir}/%{name} -%doc LICENSE NOTICE +%license LICENSE NOTICE %files -n lib%{name}-java -f .mfiles -%doc LICENSE NOTICE +%license LICENSE NOTICE %endif %changelog +* Tue Jul 28 2026 Jyoti Kanase - 0.24.0-1 +- Upgrade to 0.24.0 for CVE-2026-48144, CVE-2026-49158, CVE-2026-58023, CVE-2026-58662, CVE-2026-66053, CVE-2026-55970, CVE-2026-41608, CVE-2026-55969, CVE-2026-43871, CVE-2026-48586, CVE-2026-48145, CVE-2026-55971, CVE-2026-41606, CVE-2026-41607 +- Removed CVE patches fixed in upstream: CVE-2025-48431, CVE-2026-41602, CVE-2026-41603, CVE-2026-41605, CVE-2026-41636 + * Mon May 04 2026 Azure Linux Security Servicing Account - 0.15.0-6 - Patch for CVE-2026-41636, CVE-2026-41605, CVE-2026-41603, CVE-2026-41602, CVE-2025-48431 diff --git a/cgmanifest.json b/cgmanifest.json index ad607f8aec2..d97bd3b01ac 100644 --- a/cgmanifest.json +++ b/cgmanifest.json @@ -29366,8 +29366,8 @@ "type": "other", "other": { "name": "thrift", - "version": "0.15.0", - "downloadUrl": "https://archive.apache.org/dist/thrift/0.15.0/thrift-0.15.0.tar.gz" + "version": "0.24.0", + "downloadUrl": "https://archive.apache.org/dist/thrift/0.24.0/thrift-0.24.0.tar.gz" } } },