[AUTO-CHERRYPICK] [AutoPR- Security] Patch gnutls for CVE-2025-6395, CVE-2025-32989, CVE-2025-32988 - branch main (microsoft#14345)

Co-authored-by: Azure Linux Security Servicing Account <[email protected]>
Co-authored-by: Kevin Lockwood <[email protected]>
Co-authored-by: Kanishk Bansal <[email protected]>

Author: 4 people

SPECS/gnutls/CVE-2025-32988.patch

@@ -0,0 +1,34 @@
+From d014da2652f9ab50f5da2548834a3071363992a1 Mon Sep 17 00:00:00 2001
+From: Azure Linux Security Servicing Account
+ <[email protected]>
+Date: Tue, 15 Jul 2025 05:21:30 +0000
+Subject: [PATCH] Fix CVE CVE-2025-32988 in gnutls
+
+Upstream Patch Reference: https://gitlab.com/gnutls/gnutls/-/commit/608829769cbc247679ffe98841109fc73875e573.patch
+---
+ lib/x509/extensions.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/lib/x509/extensions.c b/lib/x509/extensions.c
+index dc333f4..2f0823a 100644
+--- a/lib/x509/extensions.c
++++ b/lib/x509/extensions.c
+@@ -805,7 +805,6 @@ _gnutls_write_new_othername(asn1_node ext, const char *ext_name,
+ 	result = asn1_write_value(ext, name2, oid, 1);
+ 	if (result != ASN1_SUCCESS) {
+ 		gnutls_assert();
+-		asn1_delete_structure(&ext);
+ 		return _gnutls_asn2err(result);
+ 	}
+ 
+@@ -814,7 +813,6 @@ _gnutls_write_new_othername(asn1_node ext, const char *ext_name,
+ 	result = asn1_write_value(ext, name2, data, data_size);
+ 	if (result != ASN1_SUCCESS) {
+ 		gnutls_assert();
+-		asn1_delete_structure(&ext);
+ 		return _gnutls_asn2err(result);
+ 	}
+ 
+-- 
+2.45.3
+

SPECS/gnutls/CVE-2025-32989.patch

@@ -0,0 +1,27 @@
+From 554887236c9eb9b134e2c370c0000e0c7ce51594 Mon Sep 17 00:00:00 2001
+From: Azure Linux Security Servicing Account
+ <[email protected]>
+Date: Tue, 15 Jul 2025 05:21:51 +0000
+Subject: [PATCH] Fix CVE CVE-2025-32989 in gnutls
+
+Upstream Patch Reference: https://gitlab.com/gnutls/gnutls/-/commit/8e5ca951257202089246fa37e93a99d210ee5ca2.patch
+---
+ lib/x509/x509_ext.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/x509/x509_ext.c b/lib/x509/x509_ext.c
+index 40b0f77..29cdae6 100644
+--- a/lib/x509/x509_ext.c
++++ b/lib/x509/x509_ext.c
+@@ -3850,7 +3850,7 @@ int gnutls_x509_ext_ct_import_scts(const gnutls_datum_t *ext, gnutls_x509_ct_sct
+ 	}
+ 
+ 	length = _gnutls_read_uint16(scts_content.data);
+-	if (length < 4) {
++	if (length < 4 || length > scts_content.size) {
+ 		gnutls_free(scts_content.data);
+ 		return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+ 	}
+-- 
+2.45.3
+