[
https://issues.apache.org/jira/browse/KUDU-3781?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18085370#comment-18085370
]
ASF subversion and git services commented on KUDU-3781:
-------------------------------------------------------
Commit fc27ecbedf0481c7ed77b0c2cd295b9f0af8efea in kudu's branch
refs/heads/master from Alexey Serbin
[ https://gitbox.apache.org/repos/asf?p=kudu.git;h=fc27ecbed ]
KUDU-3781: upgrade Thrift from 0.21.0 to 0.23.0 with recent patches
There were several CVEs with the Apache Thrift project published
recently and addressed in version 0.23.0 [1]:
* CVE-2026-43869
* CVE-2026-43868
* CVE-2026-43870
* CVE-2026-41603
* CVE-2026-41602
* CVE-2026-41604
* CVE-2026-41605
* CVE-2026-41606
* CVE-2026-41607
* CVE-2025-48431
* CVE-2026-41636
Even none of the CVEs above seem to affect the Thrift C++ client
that Kudu uses for communication with HMS, it's a good idea to update
the library and keep automated security scanners happy.
I also picked up recent updates on the C++ library on top of 0.23.0
release from the Apache Thrift git repo that look related to security
fixes:
* https://github.com/apache/thrift/commit/e96bc4015
* https://github.com/apache/thrift/commit/c1457c69f
* https://github.com/apache/thrift/commit/5748bbb6b
* https://github.com/apache/thrift/commit/e3c8c534c
c1457c69f is the only update that might be attributed to the JIRA item
in the summary since it addresses an issue in TSSLSocket related to
the wildcard name matching in TLS certificates.
[1] https://app.opencve.io/cve/?product=thrift&vendor=apache
Change-Id: Idc1e7e10f92f4a078878a6861c3448aea45453a9
Reviewed-on: http://gerrit.cloudera.org:8080/24384
Tested-by: Alexey Serbin <[email protected]>
Reviewed-by: Marton Greber <[email protected]>
Reviewed-by: Zoltan Chovan <[email protected]>
> Add TLS transport option for Thrift client used to communicate with HMS
> catalog
> -------------------------------------------------------------------------------
>
> Key: KUDU-3781
> URL: https://issues.apache.org/jira/browse/KUDU-3781
> Project: Kudu
> Issue Type: Improvement
> Reporter: Alexey Serbin
> Assignee: Alexey Serbin
> Priority: Major
>
> As of time of writing, the Thrift client that Kudu masters use to communicate
> with HMS catalog doesn't support TLS transport.
> The HMS catalog allows for configuring TLS protection for connections to HMS
> clients speaking the Apache Thrift protocol. From the Kudu side, it's
> necessary to add TLS transport support to the HMS catalog client used by Kudu
> masters.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
