Alexey Serbin has uploaded this change for review. ( http://gerrit.cloudera.org:8080/24384
Change subject: KUDU-3781: upgrade Thrift from 0.21.0 to 0.23.0 with recent patches ...................................................................... KUDU-3781: upgrade Thrift from 0.21.0 to 0.23.0 with recent patches There were several CVEs with the Apache Thrift project published recently and addressed in version 0.23.0 [1]: * CVE-2026-43869 * CVE-2026-43868 * CVE-2026-43870 * CVE-2026-41603 * CVE-2026-41602 * CVE-2026-41604 * CVE-2026-41605 * CVE-2026-41606 * CVE-2026-41607 * CVE-2025-48431 * CVE-2026-41636 Even none of the CVEs above seem to affect the Thrift C++ client that Kudu uses for communication with HMS, it's a good idea to update the library and keep automated security scanners happy. I also picked up recent updates on the C++ library on top of 0.23.0 release from the Apache Thrift git repo that look related to security fixes: * https://github.com/apache/thrift/commit/e96bc4015 * https://github.com/apache/thrift/commit/c1457c69f * https://github.com/apache/thrift/commit/5748bbb6b * https://github.com/apache/thrift/commit/e3c8c534c c1457c69f is the only update that might be attributed to the JIRA item in the summary since it addresses an issue in TSSLSocket related to the wildcard name matching in TLS certificates. [1] https://app.opencve.io/cve/?product=thrift&vendor=apache Change-Id: Idc1e7e10f92f4a078878a6861c3448aea45453a9 --- M src/kudu/thrift/client.cc M thirdparty/download-thirdparty.sh A thirdparty/patches/thrift-5748bbb6b.patch A thirdparty/patches/thrift-c1457c69f.patch A thirdparty/patches/thrift-e3c8c534c.patch A thirdparty/patches/thrift-e96bc4015.patch M thirdparty/vars.sh 7 files changed, 367 insertions(+), 4 deletions(-) git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/84/24384/1 -- To view, visit http://gerrit.cloudera.org:8080/24384 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: Idc1e7e10f92f4a078878a6861c3448aea45453a9 Gerrit-Change-Number: 24384 Gerrit-PatchSet: 1 Gerrit-Owner: Alexey Serbin <[email protected]>
