Skip to content

Commit 37debbe

Browse files
richardyu-msrichardyu-ms
authored
[CG-Fix-CVE-2021-44906] Patching on thrift.0.14.1 for package minimist (#10555)
* [CG-Fix-CVE-2021-44906] Patching on thrift.0.14.1 for package minimist Signed-off-by: richardyu-ms <[email protected]> * add more information in patch Signed-off-by: richardyu-ms <[email protected]> * Update 0003-Remove-minimist-packages.patch * change the thrift 0.14.1 to package download Signed-off-by: richardyu-ms <[email protected]> * use the series file for patching * fix a code defect
1 parent ea38864 commit 37debbe

File tree

6 files changed

+299
-6
lines changed

6 files changed

+299
-6
lines changed

‎.gitmodules

-3
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,3 @@
103103
[submodule "src/sonic-p4rt/sonic-pins"]
104104
path = src/sonic-p4rt/sonic-pins
105105
url = https://github.com/Azure/sonic-pins.git
106-
[submodule "src/thrift_0_14_1/thrift"]
107-
path = src/thrift_0_14_1/thrift
108-
url = https://github.com/apache/thrift.git

‎rules/thrift_0_14_1.mk

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ THRIFT_0_14_1_VERSION = 0.14.1
44
THRIFT_0_14_1_VERSION_FULL = $(THRIFT_0_14_1_VERSION)
55

66
LIBTHRIFT_0_14_1 = libthrift0_$(THRIFT_0_14_1_VERSION)_$(CONFIGURED_ARCH).deb
7-
$(LIBTHRIFT_0_14_1)_SRC_PATH = $(SRC_PATH)/thrift_0_14_1/thrift
8-
SONIC_DPKG_DEBS += $(LIBTHRIFT_0_14_1)
7+
$(LIBTHRIFT_0_14_1)_SRC_PATH = $(SRC_PATH)/thrift_0_14_1
8+
SONIC_MAKE_DEBS += $(LIBTHRIFT_0_14_1)
99

1010
LIBTHRIFT_0_14_1_DEV = libthrift-dev_$(THRIFT_0_14_1_VERSION)_$(CONFIGURED_ARCH).deb
1111
$(eval $(call add_derived_package,$(LIBTHRIFT_0_14_1),$(LIBTHRIFT_0_14_1_DEV)))

‎src/thrift_0_14_1/Makefile

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
SHELL = /bin/bash
2+
.ONESHELL:
3+
.SHELLFLAGS += -e -x
4+
5+
THRIFT_VERSION = 0.14.1
6+
7+
MAIN_TARGET = libthrift0_$(THRIFT_VERSION)_$(CONFIGURED_ARCH).deb
8+
DERIVED_TARGETS = libthrift-dev_$(THRIFT_VERSION)_$(CONFIGURED_ARCH).deb \
9+
python3-thrift_$(THRIFT_VERSION)_$(CONFIGURED_ARCH).deb \
10+
thrift-compiler_$(THRIFT_VERSION)_$(CONFIGURED_ARCH).deb
11+
12+
THRIFT_LINK_PRE = https://archive.apache.org/dist/thrift
13+
14+
$(addprefix $(DEST)/, $(MAIN_TARGET)): $(DEST)/% :
15+
rm -rf thrift-$(THRIFT_VERSION)
16+
17+
wget -O "thrift_$(THRIFT_VERSION).tar.gz" "$(THRIFT_LINK_PRE)/$(THRIFT_VERSION)/thrift-$(THRIFT_VERSION).tar.gz"
18+
19+
tar -xvzf ./thrift_$(THRIFT_VERSION).tar.gz
20+
if [ -f thrift.patch/series ]; then pushd thrift-$(THRIFT_VERSION) && QUILT_PATCHES=../thrift.patch quilt push -a; [ -d .pc ] && rm -rf .pc; popd; fi
21+
22+
pushd thrift-$(THRIFT_VERSION)
23+
DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage -d -rfakeroot -b -us -uc -j$(SONIC_CONFIG_MAKE_JOBS) --admindir $(SONIC_DPKG_ADMINDIR)
24+
popd
25+
26+
mv $(DERIVED_TARGETS) $* $(DEST)/
27+
28+
$(addprefix $(DEST)/, $(DERIVED_TARGETS)): $(DEST)/% : $(DEST)/$(MAIN_TARGET)

‎src/thrift_0_14_1/thrift

-1
This file was deleted.

‎src/thrift_0_14_1/thrift.patch/0003-Remove-minimist-packages.patch

+268
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,268 @@
1+
From f6fa1794539e68ac294038ac388d6bde40a6c237 Mar 2, 2021 00:00:00
2+
From: richardyu-ms <[email protected]>
3+
Date: Tue, 12 Apr 2022 15:46:16 +0000
4+
Subject: [PATCH] Fix security issue for package minimist
5+
6+
---
7+
3 files changed, 9 insertions(+), 120 deletions(-)
8+
9+
Index: thrift-0.14.1/lib/js/package-lock.json
10+
===================================================================
11+
--- thrift-0.14.1.orig/lib/js/package-lock.json
12+
+++ thrift-0.14.1/lib/js/package-lock.json
13+
@@ -1037,16 +1037,7 @@
14+
"dev": true,
15+
"requires": {
16+
"acorn-node": "^1.6.1",
17+
- "defined": "^1.0.0",
18+
- "minimist": "^1.1.1"
19+
- },
20+
- "dependencies": {
21+
- "minimist": {
22+
- "version": "1.2.0",
23+
- "resolved": "http://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
24+
- "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
25+
- "dev": true
26+
- }
27+
+ "defined": "^1.0.0"
28+
}
29+
},
30+
"diffie-hellman": {
31+
@@ -2616,20 +2607,11 @@
32+
"decamelize": "^1.1.2",
33+
"loud-rejection": "^1.0.0",
34+
"map-obj": "^1.0.1",
35+
- "minimist": "^1.1.3",
36+
"normalize-package-data": "^2.3.4",
37+
"object-assign": "^4.0.1",
38+
"read-pkg-up": "^1.0.1",
39+
"redent": "^1.0.0",
40+
"trim-newlines": "^1.0.0"
41+
- },
42+
- "dependencies": {
43+
- "minimist": {
44+
- "version": "1.2.0",
45+
- "resolved": "http://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
46+
- "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
47+
- "dev": true
48+
- }
49+
}
50+
},
51+
"micromatch": {
52+
@@ -2690,12 +2672,6 @@
53+
"brace-expansion": "^1.1.7"
54+
}
55+
},
56+
- "minimist": {
57+
- "version": "0.0.8",
58+
- "resolved": "http://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz",
59+
- "integrity": "sha1-hX/Kv8M5fSYluCKCYuhqp6ARsF0=",
60+
- "dev": true
61+
- },
62+
"mixin-deep": {
63+
"version": "1.3.1",
64+
"resolved": "https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz",
65+
@@ -2721,10 +2697,7 @@
66+
"version": "0.5.1",
67+
"resolved": "http://registry.npmjs.org/mkdirp/-/mkdirp-0.5.1.tgz",
68+
"integrity": "sha1-MAV0OOrGz3+MR2fzhkjWaX11yQM=",
69+
- "dev": true,
70+
- "requires": {
71+
- "minimist": "0.0.8"
72+
- }
73+
+ "dev": true
74+
},
75+
"module-deps": {
76+
"version": "6.2.2",
77+
@@ -3971,18 +3944,7 @@
78+
"version": "1.0.0",
79+
"resolved": "https://registry.npmjs.org/subarg/-/subarg-1.0.0.tgz",
80+
"integrity": "sha1-9izxdYHplrSPyWVpn1TAauJouNI=",
81+
- "dev": true,
82+
- "requires": {
83+
- "minimist": "^1.1.0"
84+
- },
85+
- "dependencies": {
86+
- "minimist": {
87+
- "version": "1.2.0",
88+
- "resolved": "http://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
89+
- "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
90+
- "dev": true
91+
- }
92+
- }
93+
+ "dev": true
94+
},
95+
"supports-color": {
96+
"version": "5.5.0",
97+
Index: thrift-0.14.1/lib/ts/package-lock.json
98+
===================================================================
99+
--- thrift-0.14.1.orig/lib/ts/package-lock.json
100+
+++ thrift-0.14.1/lib/ts/package-lock.json
101+
@@ -1139,16 +1139,7 @@
102+
"dev": true,
103+
"requires": {
104+
"acorn-node": "^1.3.0",
105+
- "defined": "^1.0.0",
106+
- "minimist": "^1.1.1"
107+
- },
108+
- "dependencies": {
109+
- "minimist": {
110+
- "version": "1.2.0",
111+
- "resolved": "http://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
112+
- "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
113+
- "dev": true
114+
- }
115+
+ "defined": "^1.0.0"
116+
}
117+
},
118+
"diagnostics": {
119+
@@ -3032,20 +3023,11 @@
120+
"decamelize": "^1.1.2",
121+
"loud-rejection": "^1.0.0",
122+
"map-obj": "^1.0.1",
123+
- "minimist": "^1.1.3",
124+
"normalize-package-data": "^2.3.4",
125+
"object-assign": "^4.0.1",
126+
"read-pkg-up": "^1.0.1",
127+
"redent": "^1.0.0",
128+
"trim-newlines": "^1.0.0"
129+
- },
130+
- "dependencies": {
131+
- "minimist": {
132+
- "version": "1.2.0",
133+
- "resolved": "http://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
134+
- "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
135+
- "dev": true
136+
- }
137+
}
138+
},
139+
"micromatch": {
140+
@@ -3121,11 +3103,6 @@
141+
"brace-expansion": "^1.1.7"
142+
}
143+
},
144+
- "minimist": {
145+
- "version": "0.0.8",
146+
- "resolved": "http://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz",
147+
- "integrity": "sha1-hX/Kv8M5fSYluCKCYuhqp6ARsF0="
148+
- },
149+
"mixin-deep": {
150+
"version": "1.3.1",
151+
"resolved": "https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz",
152+
@@ -3150,10 +3127,7 @@
153+
"mkdirp": {
154+
"version": "0.5.1",
155+
"resolved": "http://registry.npmjs.org/mkdirp/-/mkdirp-0.5.1.tgz",
156+
- "integrity": "sha1-MAV0OOrGz3+MR2fzhkjWaX11yQM=",
157+
- "requires": {
158+
- "minimist": "0.0.8"
159+
- }
160+
+ "integrity": "sha1-MAV0OOrGz3+MR2fzhkjWaX11yQM="
161+
},
162+
"module-deps": {
163+
"version": "6.2.0",
164+
@@ -4396,18 +4370,7 @@
165+
"version": "1.0.0",
166+
"resolved": "https://registry.npmjs.org/subarg/-/subarg-1.0.0.tgz",
167+
"integrity": "sha1-9izxdYHplrSPyWVpn1TAauJouNI=",
168+
- "dev": true,
169+
- "requires": {
170+
- "minimist": "^1.1.0"
171+
- },
172+
- "dependencies": {
173+
- "minimist": {
174+
- "version": "1.2.0",
175+
- "resolved": "http://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
176+
- "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
177+
- "dev": true
178+
- }
179+
- }
180+
+ "dev": true
181+
},
182+
"supports-color": {
183+
"version": "5.5.0",
184+
Index: thrift-0.14.1/package-lock.json
185+
===================================================================
186+
--- thrift-0.14.1.orig/package-lock.json
187+
+++ thrift-0.14.1/package-lock.json
188+
@@ -1427,16 +1427,7 @@
189+
"integrity": "sha512-4vGP107UDhhNHeWA5N8j/nUPlQbtB/W/K2x/P7aElbWMWrOkJA0MRSVFsMFrTPSAAjZWCG9uki2+1cQDzFtVcQ==",
190+
"dev": true,
191+
"requires": {
192+
- "html-validator": "3.1.3",
193+
- "minimist": "1.2.0"
194+
- },
195+
- "dependencies": {
196+
- "minimist": {
197+
- "version": "1.2.0",
198+
- "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
199+
- "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
200+
- "dev": true
201+
- }
202+
+ "html-validator": "3.1.3"
203+
}
204+
},
205+
"http-signature": {
206+
@@ -1920,18 +1911,7 @@
207+
"version": "2.1.1",
208+
"resolved": "https://registry.npmjs.org/json5/-/json5-2.1.1.tgz",
209+
"integrity": "sha512-l+3HXD0GEI3huGq1njuqtzYK8OYJyXMkOLtQ53pjWh89tvWS2h6l+1zMkYWqlb57+SiQodKZyvMEFb2X+KrFhQ==",
210+
- "dev": true,
211+
- "requires": {
212+
- "minimist": "^1.2.0"
213+
- },
214+
- "dependencies": {
215+
- "minimist": {
216+
- "version": "1.2.0",
217+
- "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
218+
- "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
219+
- "dev": true
220+
- }
221+
- }
222+
+ "dev": true
223+
},
224+
"jsprim": {
225+
"version": "1.4.1",
226+
@@ -2072,20 +2052,11 @@
227+
"brace-expansion": "^1.1.7"
228+
}
229+
},
230+
- "minimist": {
231+
- "version": "0.0.8",
232+
- "resolved": "http://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz",
233+
- "integrity": "sha1-hX/Kv8M5fSYluCKCYuhqp6ARsF0=",
234+
- "dev": true
235+
- },
236+
"mkdirp": {
237+
"version": "0.5.1",
238+
"resolved": "http://registry.npmjs.org/mkdirp/-/mkdirp-0.5.1.tgz",
239+
"integrity": "sha1-MAV0OOrGz3+MR2fzhkjWaX11yQM=",
240+
- "dev": true,
241+
- "requires": {
242+
- "minimist": "0.0.8"
243+
- }
244+
+ "dev": true
245+
},
246+
"ms": {
247+
"version": "2.0.0",
248+
@@ -2790,7 +2761,6 @@
249+
"glob": "~7.1.2",
250+
"has": "~1.0.3",
251+
"inherits": "~2.0.3",
252+
- "minimist": "~1.2.0",
253+
"object-inspect": "~1.6.0",
254+
"resolve": "~1.7.1",
255+
"resumer": "~0.0.0",
256+
@@ -2798,12 +2768,6 @@
257+
"through": "~2.3.8"
258+
},
259+
"dependencies": {
260+
- "minimist": {
261+
- "version": "1.2.0",
262+
- "resolved": "http://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
263+
- "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ=",
264+
- "dev": true
265+
- },
266+
"resolve": {
267+
"version": "1.7.1",
268+
"resolved": "https://registry.npmjs.org/resolve/-/resolve-1.7.1.tgz",

‎src/thrift_0_14_1/thrift.patch/series

+1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
0001-Remove-unneeded-packages.patch
22
0002-Fix-build-rules.patch
3+
0003-Remove-minimist-packages.patch

0 commit comments

Comments
 (0)