Hi, Please ignore this, I have now sent the patch again to the correct mailing list.
Thanks! ________________________________________ From: Adarsh Jagadish Kamini Sent: Wednesday, August 5, 2026 12:08 To: [email protected] Subject: [meta-oe][scarthgap][PATCH] thrift: fix CVE-2026-58389 Backport patch to fix CVE-2026-58389. References: https://nvd.nist.gov/vuln/detail/CVE-2026-58389 Upstream fix: https://github.com/apache/thrift/commit/0ab16e3a83637711f4e0f788c205f66576fd0a55 Signed-off-by: Adarsh Jagadish Kamini <[email protected]> --- - Note on CVE relationship: The patch series that was submitted (https://patchwork.yoctoproject.org/project/oe/list/?series=48481) contains CVE-2026-43868 fix, that introduces the preliminary container/object size checks in the Rust client, which CVE-2026-58389 further enhances. --- .../thrift/thrift/CVE-2026-58389.patch | 93 +++++++++++++++++++ .../thrift/thrift_0.20.0.bb | 1 + 2 files changed, 94 insertions(+) create mode 100644 meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch diff --git a/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch new file mode 100644 index 0000000000..558969f9ce --- /dev/null +++ b/meta-oe/recipes-connectivity/thrift/thrift/CVE-2026-58389.patch @@ -0,0 +1,93 @@ +From 0a95520b91c1da608e5530f4299c3b4ffb4b550c Mon Sep 17 00:00:00 2001 +From: Javid Khan <[email protected]> +Date: Mon, 29 Jun 2026 19:51:49 +0530 +Subject: [PATCH] enforce max_string_size on non-strict binary message name + + +CVE: CVE-2026-58389 +Upstream-Status: Backport [https://github.com/apache/thrift/commit/0ab16e3a83637711f4e0f788c205f66576fd0a55] + +Signed-off-by: Adarsh Jagadish Kamini <[email protected]> +--- + lib/rs/src/protocol/binary.rs | 61 +++++++++++++++++++++++++++++++++++ + 1 file changed, 61 insertions(+) + +diff --git a/lib/rs/src/protocol/binary.rs b/lib/rs/src/protocol/binary.rs +index 596285fb9..38f528571 100644 +--- a/lib/rs/src/protocol/binary.rs ++++ b/lib/rs/src/protocol/binary.rs +@@ -137,6 +137,17 @@ where + // is the message name. strings (byte arrays) are length-prefixed, + // so we've just read the length in the first 4 bytes + let name_size = BigEndian::read_i32(&first_bytes) as usize; ++ if let Some(max_size) = self.config.max_string_size() { ++ if name_size > max_size { ++ return Err(crate::Error::Protocol(ProtocolError::new( ++ ProtocolErrorKind::SizeLimit, ++ format!( ++ "Message name size {} exceeds maximum allowed size of {}", ++ name_size, max_size ++ ), ++ ))); ++ } ++ } + let mut name_buf: Vec<u8> = vec![0; name_size]; + self.transport.read_exact(&mut name_buf)?; + let name = String::from_utf8(name_buf)?; +@@ -1227,6 +1238,56 @@ mod tests { + } + } + ++ #[test] ++ fn must_enforce_string_size_limit_on_non_strict_message_name() { ++ let mem = TBufferChannel::with_capacity(100, 100); ++ let (r_mem, mut w_mem) = mem.split().unwrap(); ++ ++ let config = TConfiguration::builder() ++ .max_string_size(Some(1000)) ++ .build() ++ .unwrap(); ++ // non-strict: the first 4 bytes are the (positive) message-name length ++ let mut i_prot = TBinaryInputProtocol::with_config(r_mem, false, config); ++ ++ w_mem.set_readable_bytes(&[0x00, 0x00, 0x07, 0xD0]); ++ ++ let result = i_prot.read_message_begin(); ++ assert!(result.is_err()); ++ match result { ++ Err(crate::Error::Protocol(e)) => { ++ assert_eq!(e.kind, ProtocolErrorKind::SizeLimit); ++ assert!(e ++ .message ++ .contains("Message name size 2000 exceeds maximum allowed size of 1000")); ++ } ++ _ => panic!("Expected protocol error with SizeLimit"), ++ } ++ } ++ ++ #[test] ++ fn must_allow_non_strict_message_name_at_limit() { ++ let mem = TBufferChannel::with_capacity(100, 100); ++ let (r_mem, mut w_mem) = mem.split().unwrap(); ++ ++ let config = TConfiguration::builder() ++ .max_string_size(Some(5)) ++ .build() ++ .unwrap(); ++ // non-strict: the first 4 bytes are the (positive) message-name length ++ let mut i_prot = TBinaryInputProtocol::with_config(r_mem, false, config); ++ ++ // name length 5 (== limit), name "hello", message type Call, sequence 0 ++ w_mem.set_readable_bytes(&[ ++ 0x00, 0x00, 0x00, 0x05, b'h', b'e', b'l', b'l', b'o', 0x01, 0x00, 0x00, 0x00, 0x00, ++ ]); ++ ++ let ident = i_prot.read_message_begin().unwrap(); ++ assert_eq!(ident.name, "hello"); ++ assert_eq!(ident.message_type, TMessageType::Call); ++ assert_eq!(ident.sequence_number, 0); ++ } ++ + #[test] + fn must_allow_strings_within_limit() { + let mem = TBufferChannel::with_capacity(100, 100); diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb index ded6800bbb..fa01e72ab4 100644 --- a/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb +++ b/meta-oe/recipes-connectivity/thrift/thrift_0.20.0.bb @@ -17,6 +17,7 @@ SRC_URI = "https://archive.apache.org/dist/${BPN}/${PV}/${BP}.tar.gz \ file://CVE-2026-48144.patch \ file://CVE-2026-43868.patch \ file://CVE-2026-43870.patch \ + file://CVE-2026-58389.patch \ " SRC_URI[sha256sum] = "b5d8311a779470e1502c027f428a1db542f5c051c8e1280ccd2163fa935ff2d6"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242860): https://lists.openembedded.org/g/openembedded-core/message/242860 Mute This Topic: https://lists.openembedded.org/mt/120608002/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
