matthew/sonic-buildimage
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix CVE-2017-1000487 security alert (#7173) (#7278)

Browse Source 
Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.
This commit is contained in:
xumia 2021-07-08 07:42:07 +08:00 committed by GitHub
parent 8cfa9260f3
commit 29311dc44e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
src/thrift/Makefile
View File

@ -23,6 +23,7 @@ $(addprefix $(DEST)/, $(MAIN_TARGET)): $(DEST)/% :
dpkg-source -x thrift_$(THRIFT_VERSION_FULL).dsc dpkg-source -x thrift_$(THRIFT_VERSION_FULL).dsc
pushd thrift-$(THRIFT_VERSION) pushd thrift-$(THRIFT_VERSION)
patch -p1 < ../patch/THRIFT-3577-assertion-failed.patch patch -p1 < ../patch/THRIFT-3577-assertion-failed.patch
patch -p1 < ../patch/0002-cve-2017-1000487.patch
DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage -d -rfakeroot -b -us -uc -j$(SONIC_CONFIG_MAKE_JOBS) --admindir $(SONIC_DPKG_ADMINDIR) DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage -d -rfakeroot -b -us -uc -j$(SONIC_CONFIG_MAKE_JOBS) --admindir $(SONIC_DPKG_ADMINDIR)
popd popd

25
src/thrift/patch/0002-cve-2017-1000487.patch Normal file
View File

@ -0,0 +1,25 @@
From 99d698c5247284319248e287bbce2762490fb70b Mon Sep 17 00:00:00 2001
From: xumia <xumia@microsoft.com>
Date: Mon, 29 Mar 2021 09:57:38 +0000
Subject: [PATCH] Fix CVE-2017-1000487 security alert
---
contrib/thrift-maven-plugin/pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/contrib/thrift-maven-plugin/pom.xml b/contrib/thrift-maven-plugin/pom.xml
index 76d0d4f3a..7313b69bf 100644
--- a/contrib/thrift-maven-plugin/pom.xml
+++ b/contrib/thrift-maven-plugin/pom.xml
@@ -75,7 +75,7 @@
<dependency>
<groupId>org.codehaus.plexus</groupId>
<artifactId>plexus-utils</artifactId>
- <version>3.0.14</version>
+ <version>3.0.16</version>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
--
2.17.1