[202012] Fix CVE-2017-1000487 security alert (#11635)

Why I did it Fix CVE-2017-1000487 alert in thrift 0.14.1. See https://nvd.nist.gov/vuln/detail/CVE-2017-1000487 How I did it Change the version of org.codehaus.plexus:plexus-utils from 3.0.14 to 3.0.16.
sonic-net · Aug 8, 2022 · 1c8c1a6 · 1c8c1a6
1 parent 14f93e1
commit 1c8c1a6
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/src/thrift_0_13_0/Makefile b/src/thrift_0_13_0/Makefile
@@ -26,6 +26,7 @@ $(addprefix $(DEST)/, $(MAIN_TARGET)): $(DEST)/% :
 	patch -p1 < ../patch/0001-Remove-unneeded-packages.patch
 	patch -p1 < ../patch/0002-Remove-minimist-packages.patch
 	patch -p1 < ../patch/0003-Remove-underscore-packages.patch
+	patch -p1 < ../patch/0002-cve-2017-1000487.patch
 	DEB_BUILD_OPTIONS=nocheck dpkg-buildpackage -d -rfakeroot -b -us -uc -j$(SONIC_CONFIG_MAKE_JOBS) --admindir $(SONIC_DPKG_ADMINDIR)
 	popd
 

diff --git a/src/thrift_0_13_0/patch/0002-cve-2017-1000487.patch b/src/thrift_0_13_0/patch/0002-cve-2017-1000487.patch
@@ -0,0 +1 @@
+../../thrift/patch/0002-cve-2017-1000487.patch