Alexey Serbin has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24384 )
Change subject: KUDU-3781: upgrade Thrift from 0.21.0 to 0.23.0 with recent patches ...................................................................... KUDU-3781: upgrade Thrift from 0.21.0 to 0.23.0 with recent patches There were several CVEs with the Apache Thrift project published recently and addressed in version 0.23.0 [1]: * CVE-2026-43869 * CVE-2026-43868 * CVE-2026-43870 * CVE-2026-41603 * CVE-2026-41602 * CVE-2026-41604 * CVE-2026-41605 * CVE-2026-41606 * CVE-2026-41607 * CVE-2025-48431 * CVE-2026-41636 Even none of the CVEs above seem to affect the Thrift C++ client that Kudu uses for communication with HMS, it's a good idea to update the library and keep automated security scanners happy. I also picked up recent updates on the C++ library on top of 0.23.0 release from the Apache Thrift git repo that look related to security fixes: * https://github.com/apache/thrift/commit/e96bc4015 * https://github.com/apache/thrift/commit/c1457c69f * https://github.com/apache/thrift/commit/5748bbb6b * https://github.com/apache/thrift/commit/e3c8c534c c1457c69f is the only update that might be attributed to the JIRA item in the summary since it addresses an issue in TSSLSocket related to the wildcard name matching in TLS certificates. [1] https://app.opencve.io/cve/?product=thrift&vendor=apache Change-Id: Idc1e7e10f92f4a078878a6861c3448aea45453a9 Reviewed-on: http://gerrit.cloudera.org:8080/24384 Tested-by: Alexey Serbin <[email protected]> Reviewed-by: Marton Greber <[email protected]> Reviewed-by: Zoltan Chovan <[email protected]> --- M src/kudu/thrift/client.cc M thirdparty/download-thirdparty.sh A thirdparty/patches/thrift-5748bbb6b.patch A thirdparty/patches/thrift-c1457c69f.patch A thirdparty/patches/thrift-e3c8c534c.patch A thirdparty/patches/thrift-e96bc4015.patch M thirdparty/vars.sh 7 files changed, 367 insertions(+), 4 deletions(-) Approvals: Alexey Serbin: Verified Marton Greber: Looks good to me, approved Zoltan Chovan: Looks good to me, approved -- To view, visit http://gerrit.cloudera.org:8080/24384 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: Idc1e7e10f92f4a078878a6861c3448aea45453a9 Gerrit-Change-Number: 24384 Gerrit-PatchSet: 2 Gerrit-Owner: Alexey Serbin <[email protected]> Gerrit-Reviewer: Abhishek Chennaka <[email protected]> Gerrit-Reviewer: Alexey Serbin <[email protected]> Gerrit-Reviewer: Attila Bukor <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Reviewer: Marton Greber <[email protected]> Gerrit-Reviewer: Zoltan Chovan <[email protected]>
