mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-01 21:23:51 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/thrift: security bump version to 0.23.0

Browse Source 
https://github.com/apache/thrift/blob/v0.23.0/CHANGES.md

Fixes the following CVEs:

CVE-2026-41636: https://seclists.org/oss-sec/2026/q2/236
CVE-2026-41607: https://seclists.org/oss-sec/2026/q2/237
CVE-2026-41606: https://seclists.org/oss-sec/2026/q2/238
CVE-2026-41605: https://seclists.org/oss-sec/2026/q2/239
CVE-2026-41604: https://seclists.org/oss-sec/2026/q2/240
CVE-2026-41602: https://seclists.org/oss-sec/2026/q2/241
CVE-2026-41603: https://seclists.org/oss-sec/2026/q2/242
CVE-2025-48431: https://seclists.org/oss-sec/2026/q2/243

This commit also adds "Public Domain" in THRIFT_LICENSE, after
upstream commit [1] added a new sha256 implementation with that
license. The LICENSE file hash is also updated accordingly.

[1] 1e5fa4b9b3

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6935bc7412)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Bernd Kuhls
2026-04-30 20:56:35 +02:00
committed by Thomas Perale
parent 770b3996ed
commit bef8aefcde
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
package/thrift/thrift.hash
View File

@@ -1,4 +1,4 @@
# From https://downloads.apache.org/thrift/0.22.0/thrift-0.22.0.tar.gz.sha256
sha256 794a0e455787960d9f27ab92c38e34da27e8deeda7a5db0e59dc64a00df8a1e5 thrift-0.22.0.tar.gz
# From https://downloads.apache.org/thrift/0.23.0/thrift-0.23.0.tar.gz.sha256
sha256 1859d932d2ae1f13d16c5a196931208c116310a5ff50f2bfd11d3db03be8f46f thrift-0.23.0.tar.gz
# License files, locally calculated
sha256 d315e6cdedc07c478de6992027bfb66f220886c6216fd7e9885ced30c3703646 LICENSE
sha256 89aa7b27868669299bd8a6c53b72ec4beadce42dad6c8336797cc26e1e8df98d LICENSE

4
package/thrift/thrift.mk
View File

@@ -4,9 +4,9 @@
#
################################################################################
THRIFT_VERSION = 0.22.0
THRIFT_VERSION = 0.23.0
THRIFT_SITE = https://downloads.apache.org/thrift/$(THRIFT_VERSION)
THRIFT_LICENSE = Apache-2.0
THRIFT_LICENSE = Apache-2.0, Public Domain (sha256.h)
THRIFT_LICENSE_FILES = LICENSE
THRIFT_CPE_ID_VENDOR = apache