Indianguy5 commented on PR #58479: URL: https://github.com/apache/spark/pull/58479#issuecomment-6409780947
Revisiting this with a security angle: `libthrift` 0.16.0 (the version currently pinned on `master`) carries two unpatched **HIGH** severity CVEs, both affecting `sql/hive-thriftserver` which depends on it: - **CVE-2026-43869** ([GHSA-7pwc-h2j2-rjgj](https://github.com/advisories/GHSA-7pwc-h2j2-rjgj)) — Improper Validation of Certificate with Host Mismatch (CWE-297), affects Thrift before 0.23.0. - **CVE-2026-43871** ([GHSA-8wv5-x4w7-5gww](https://github.com/advisories/GHSA-8wv5-x4w7-5gww)) — Infinite Loop / DoS (CWE-835) in Thrift's Java bindings, affects versions before 0.24.0. So 0.24.0 (what this PR proposed) is in fact the minimum version needed to clear both, not just a routine bump. This PR and its predecessor (#56305, → 0.23.0) were both auto-closed by Dependabot without a human follow-up, and (per `pom.xml` on current `master`) the version is still pinned at 0.16.0. Given every *successful* historical libthrift bump here (#34878, #47971, #34362/#35646/#35647) needed real changes in `sql/hive-thriftserver`'s Thrift-generated service code to track API changes across major Thrift versions, a plain `pom.xml` edit reopening this PR is likely to fail CI the same way — but given the CVEs, I think this is worth a committer picking back up with that migration work in mind. Happy to help validate a reopened attempt against a local build if useful. No live exploitation of any Spark deployment was performed — this came out of a static dependency audit (OSV.dev cross-reference) that first checked SECURITY.md's documented threat model to confirm this is in-scope. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
