Skip to content

Commit 3779f0c

Browse files
azurelinux-securityazurelinux-security
committed
Patch glib-networking for CVE-2025-60019 
1 parent 55530bd commit 3779f0c

File tree

2 files changed

+178
-1
lines changed

2 files changed

+178
-1
lines changed

‎SPECS/glib-networking/CVE-2025-60019.patch‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
From 7e24f696a848b55901a0b629503730d55608bb78 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <[email protected]>
3+
Date: Mon, 29 Sep 2025 19:19:55 +0000
4+
Subject: [PATCH] openssl: check return value of g_tls_bio_alloc() and
5+
BIO_new(), guard BIO_free_all, and check BIO_new_mem_buf returns as per
6+
upstream patches
7+
8+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
9+
Upstream-reference: AI Backport of https://gitlab.gnome.org/GNOME/glib-networking/-/merge_requests/263.patch
10+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
11+
Upstream-reference: https://raw.githubusercontent.com/microsoft/azurelinux/285dc2d37625e2b33314153f6b16848fde3ff8f1/SPECS/glib-networking/CVE-2025-60019.patch
12+
---
13+
tls/openssl/gtlsbio.c | 6 ++--
14+
tls/openssl/gtlscertificate-openssl.c | 44 +++++++++++++++++++--------
15+
2 files changed, 35 insertions(+), 15 deletions(-)
16+
17+
diff --git a/tls/openssl/gtlsbio.c b/tls/openssl/gtlsbio.c
18+
index 4e138e7..93f930a 100644
19+
--- a/tls/openssl/gtlsbio.c
20+
+++ b/tls/openssl/gtlsbio.c
21+
@@ -355,7 +355,8 @@ g_tls_bio_new_from_iostream (GIOStream *io_stream)
22+
GTlsBio *gbio;
23+
24+
ret = g_tls_bio_alloc (&gbio);
25+
- gbio->io_stream = g_object_ref (io_stream);
26+
+ if (ret)
27+
+ gbio->io_stream = g_object_ref (io_stream);
28+
29+
return ret;
30+
}
31+
@@ -367,7 +368,8 @@ g_tls_bio_new_from_datagram_based (GDatagramBased *socket)
32+
GTlsBio *gbio;
33+
34+
ret = g_tls_bio_alloc (&gbio);
35+
- gbio->socket = g_object_ref (socket);
36+
+ if (ret)
37+
+ gbio->socket = g_object_ref (socket);
38+
39+
return ret;
40+
}
41+
diff --git a/tls/openssl/gtlscertificate-openssl.c b/tls/openssl/gtlscertificate-openssl.c
42+
index 648f3e8..a8f146b 100644
43+
--- a/tls/openssl/gtlscertificate-openssl.c
44+
+++ b/tls/openssl/gtlscertificate-openssl.c
45+
@@ -166,6 +166,8 @@ export_privkey_to_der (GTlsCertificateOpenssl *openssl,
46+
goto err;
47+
48+
bio = BIO_new (BIO_s_mem ());
49+
+ if (!bio)
50+
+ goto err;
51+
if (i2d_PKCS8_PRIV_KEY_INFO_bio (bio, pkcs8) == 0)
52+
goto err;
53+
54+
@@ -199,6 +201,9 @@ export_privkey_to_pem (GTlsCertificateOpenssl *openssl)
55+
return NULL;
56+
57+
bio = BIO_new (BIO_s_mem ());
58+
+ if (!bio)
59+
+ goto out;
60+
+
61+
ret = PEM_write_bio_PKCS8PrivateKey (bio, openssl->key, NULL, NULL, 0, NULL, NULL);
62+
if (ret == 0)
63+
goto out;
64+
@@ -211,7 +216,7 @@ export_privkey_to_pem (GTlsCertificateOpenssl *openssl)
65+
result = g_strdup (data);
66+
67+
out:
68+
- BIO_free_all (bio);
69+
+ g_clear_pointer (&bio, BIO_free_all);
70+
return result;
71+
}
72+
73+
@@ -232,6 +237,9 @@ maybe_import_pkcs12 (GTlsCertificateOpenssl *openssl)
74+
return;
75+
76+
bio = BIO_new (BIO_s_mem ());
77+
+ if (!bio)
78+
+ goto import_failed;
79+
+
80+
status = BIO_write (bio, openssl->pkcs12_data->data, openssl->pkcs12_data->len);
81+
if (status <= 0)
82+
goto import_failed;
83+
@@ -323,7 +331,7 @@ g_tls_certificate_openssl_get_property (GObject *object,
84+
guint8 *data;
85+
BIO *bio;
86+
GByteArray *byte_array;
87+
- char *certificate_pem;
88+
+ const char *certificate_pem;
89+
long size;
90+
91+
const ASN1_TIME *time_asn1;
92+
@@ -362,15 +370,12 @@ g_tls_certificate_openssl_get_property (GObject *object,
93+
case PROP_CERTIFICATE_PEM:
94+
bio = BIO_new (BIO_s_mem ());
95+
96+
- if (!PEM_write_bio_X509 (bio, openssl->cert) || !BIO_write (bio, "\0", 1))
97+
- certificate_pem = NULL;
98+
- else
99+
+ if (bio && PEM_write_bio_X509 (bio, openssl->cert) == 1 && BIO_write (bio, "\0", 1) == 1)
100+
{
101+
BIO_get_mem_data (bio, &certificate_pem);
102+
g_value_set_string (value, certificate_pem);
103+
-
104+
- BIO_free_all (bio);
105+
}
106+
+ g_clear_pointer (&bio, BIO_free_all);
107+
break;
108+
109+
case PROP_PRIVATE_KEY:
110+
@@ -410,6 +415,8 @@ g_tls_certificate_openssl_get_property (GObject *object,
111+
112+
case PROP_SUBJECT_NAME:
113+
bio = BIO_new (BIO_s_mem ());
114+
+ if (!bio)
115+
+ break;
116+
name = X509_get_subject_name (openssl->cert);
117+
X509_NAME_print_ex (bio, name, 0, XN_FLAG_SEP_COMMA_PLUS);
118+
BIO_write (bio, "\0", 1);
119+
@@ -420,6 +427,8 @@ g_tls_certificate_openssl_get_property (GObject *object,
120+
121+
case PROP_ISSUER_NAME:
122+
bio = BIO_new (BIO_s_mem ());
123+
+ if (!bio)
124+
+ break;
125+
name = X509_get_issuer_name (openssl->cert);
126+
X509_NAME_print_ex (bio, name, 0, XN_FLAG_SEP_COMMA_PLUS);
127+
BIO_write (bio, "\0", 1);
128+
@@ -528,8 +537,11 @@ g_tls_certificate_openssl_set_property (GObject *object,
129+
break;
130+
CRITICAL_IF_CERTIFICATE_INITIALIZED ("certificate-pem");
131+
bio = BIO_new_mem_buf ((gpointer)string, -1);
132+
- openssl->cert = PEM_read_bio_X509 (bio, NULL, NULL, NULL);
133+
- BIO_free (bio);
134+
+ if (bio)
135+
+ {
136+
+ openssl->cert = PEM_read_bio_X509 (bio, NULL, NULL, NULL);
137+
+ BIO_free (bio);
138+
+ }
139+
if (openssl->cert)
140+
openssl->have_cert = TRUE;
141+
else if (!openssl->construct_error)
142+
@@ -549,8 +561,11 @@ g_tls_certificate_openssl_set_property (GObject *object,
143+
CRITICAL_IF_KEY_INITIALIZED ("private-key");
144+
145+
bio = BIO_new_mem_buf (bytes->data, bytes->len);
146+
- openssl->key = d2i_PrivateKey_bio (bio, NULL);
147+
- BIO_free (bio);
148+
+ if (bio)
149+
+ {
150+
+ openssl->key = d2i_PrivateKey_bio (bio, NULL);
151+
+ BIO_free (bio);
152+
+ }
153+
if (openssl->key)
154+
openssl->have_key = TRUE;
155+
else if (!openssl->construct_error)
156+
@@ -570,8 +585,11 @@ g_tls_certificate_openssl_set_property (GObject *object,
157+
CRITICAL_IF_KEY_INITIALIZED ("private-key-pem");
158+
159+
bio = BIO_new_mem_buf ((gpointer)string, -1);
160+
- openssl->key = PEM_read_bio_PrivateKey (bio, NULL, NULL, NULL);
161+
- BIO_free (bio);
162+
+ if (bio)
163+
+ {
164+
+ openssl->key = PEM_read_bio_PrivateKey (bio, NULL, NULL, NULL);
165+
+ BIO_free (bio);
166+
+ }
167+
if (openssl->key)
168+
openssl->have_key = TRUE;
169+
else if (!openssl->construct_error)
170+
--
171+
2.45.4
172+

‎SPECS/glib-networking/glib-networking.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
Summary: Glib networking modules
22
Name: glib-networking
33
Version: 2.78.0
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: GPLv2+ WITH exceptions
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
88
Group: System Environment/Development
99
URL: https://gitlab.gnome.org/GNOME/glib-networking/
1010
Source0: https://download.gnome.org/sources/%{name}/2.78/%{name}-%{version}.tar.xz
11+
Patch0: CVE-2025-60019.patch
1112
BuildRequires: gcc
1213
BuildRequires: gettext
1314
BuildRequires: meson
@@ -28,6 +29,7 @@ implementation.
2829

2930
%prep
3031
%setup -q
32+
%patch 0 -p1
3133

3234
%build
3335
%meson -Dlibproxy=disabled
@@ -47,6 +49,9 @@ implementation.
4749
%{_libdir}/gio/modules/libgiognutls.so
4850

4951
%changelog
52+
* Tue Sep 30 2025 Azure Linux Security Servicing Account <[email protected]> - 2.78.0-2
53+
- Patch for CVE-2025-60019
54+
5055
* Tue Feb 13 2024 Vince Perri <[email protected]> - 2.78.0-1
5156
- Upgrade to 2.78.0
5257

0 commit comments

Comments
 (0)