This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.2
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.2 by this push:
new d87990d87d0 branch-4.2: [fix](thirdparty) Upgrade Brotli to 1.0.10 for
CVE-2026-111497 #69906 (#69937)
d87990d87d0 is described below
commit d87990d87d09f44c18d0886088c4e3b26496a042
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Tue Nov 3 09:50:41 2026 +0800
branch-4.2: [fix](thirdparty) Upgrade Brotli to 1.0.10 for CVE-2026-111497
#69906 (#69937)
Cherry-picked from #69906
Co-authored-by: Gabriel <[email protected]>
---
thirdparty/download-thirdparty.sh | 6 ++++++
thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch | 13 +++++++++++++
thirdparty/vars.sh | 10 ++++++----
3 files changed, 25 insertions(+), 4 deletions(-)
diff --git a/thirdparty/download-thirdparty.sh
b/thirdparty/download-thirdparty.sh
index 175c9b0df05..6b9c734a093 100755
--- a/thirdparty/download-thirdparty.sh
+++ b/thirdparty/download-thirdparty.sh
@@ -458,6 +458,12 @@ if [[ " ${TP_ARCHIVES[*]} " =~ " ARROW " ]]; then
patch -p1 <"${TP_PATCH_DIR}/apache-arrow-24.0.0-lzo.patch"
touch "${PATCHED_MARK}"
fi
+ # Arrow also verifies the overridden Brotli archive against its own
SHA256.
+ # A separate marker updates sources that already have the other Arrow
patches.
+ if [[ ! -f "${PATCHED_MARK}_brotli_1_0_10" ]]; then
+ patch -p1
<"${TP_PATCH_DIR}/apache-arrow-24.0.0-brotli-1.0.10.patch"
+ touch "${PATCHED_MARK}_brotli_1_0_10"
+ fi
cd -
fi
echo "Finished patching ${ARROW_SOURCE}"
diff --git a/thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch
b/thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch
new file mode 100644
index 00000000000..ca7b7c82ae0
--- /dev/null
+++ b/thirdparty/patches/apache-arrow-24.0.0-brotli-1.0.10.patch
@@ -0,0 +1,13 @@
+--- a/cpp/thirdparty/versions.txt
++++ b/cpp/thirdparty/versions.txt
+@@ -58,8 +58,8 @@
+
ARROW_AZURE_SDK_BUILD_SHA256_CHECKSUM=97065bfc971ac8df450853ce805f820f52b59457bd7556510186a1569502e4a1
+ ARROW_BOOST_BUILD_VERSION=1.88.0
+
ARROW_BOOST_BUILD_SHA256_CHECKSUM=dcea50f40ba1ecfc448fdf886c0165cf3e525fef2c9e3e080b9804e8117b9694
+-ARROW_BROTLI_BUILD_VERSION=v1.0.9
+-ARROW_BROTLI_BUILD_SHA256_CHECKSUM=f9e8d81d0405ba66d181529af42a3354f838c939095ff99930da6aa9cdf6fe46
++ARROW_BROTLI_BUILD_VERSION=v1.0.10
++ARROW_BROTLI_BUILD_SHA256_CHECKSUM=b517ebdb5266b963d28d6e639b973479874ec72086deb6ee4a2d639e1b13606b
+ ARROW_BZIP2_BUILD_VERSION=1.0.8
+
ARROW_BZIP2_BUILD_SHA256_CHECKSUM=ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269
+ ARROW_CARES_BUILD_VERSION=1.17.2
diff --git a/thirdparty/vars.sh b/thirdparty/vars.sh
index 26b83f7dcc2..03a37512c24 100644
--- a/thirdparty/vars.sh
+++ b/thirdparty/vars.sh
@@ -235,10 +235,12 @@ ZSTD_SOURCE=zstd-1.5.7
ZSTD_MD5SUM="780fc1896922b1bc52a4e90980cdda48"
# brotli
-BROTLI_DOWNLOAD="https://github.com/google/brotli/archive/v1.0.9.tar.gz";
-BROTLI_NAME="brotli-1.0.9.tar.gz"
-BROTLI_SOURCE="brotli-1.0.9"
-BROTLI_MD5SUM="c2274f0c7af8470ad514637c35bcee7d"
+# Arrow builds and BE statically links this decoder, so a system library update
+# cannot replace the vulnerable code fixed in 1.0.10 (CVE-2026-111497).
+BROTLI_DOWNLOAD="https://github.com/google/brotli/archive/v1.0.10.tar.gz";
+BROTLI_NAME="brotli-1.0.10.tar.gz"
+BROTLI_SOURCE="brotli-1.0.10"
+BROTLI_MD5SUM="830ce41562b2ec8cbdfe3f70111db0fa"
# flatbuffers
FLATBUFFERS_DOWNLOAD="https://github.com/google/flatbuffers/archive/v23.5.26.tar.gz";
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
