|
| 1 | +From 5bcb7c0465f965050d6c73a96cd3dceb3b89765e Mon Sep 17 00:00:00 2001 |
| 2 | +From: Azure Linux Security Servicing Account |
| 3 | + |
| 4 | +Date: Mon, 28 Jul 2025 06:16:16 +0000 |
| 5 | +Subject: [PATCH] Fix CVE CVE-2025-22872 in nvidia-container-toolkit |
| 6 | + |
| 7 | +Upstream Patch Reference: https://github.com/golang/net/commit/e1fcd82abba34df74614020343be8eb1fe85f0d9.patch |
| 8 | +--- |
| 9 | + tests/vendor/golang.org/x/net/html/token.go | 18 ++++++++++++++++-- |
| 10 | + 1 file changed, 16 insertions(+), 2 deletions(-) |
| 11 | + |
| 12 | +diff --git a/tests/vendor/golang.org/x/net/html/token.go b/tests/vendor/golang.org/x/net/html/token.go |
| 13 | +index 3c57880..6598c1f 100644 |
| 14 | +--- a/tests/vendor/golang.org/x/net/html/token.go |
| 15 | ++++ b/tests/vendor/golang.org/x/net/html/token.go |
| 16 | +@@ -839,8 +839,22 @@ func (z *Tokenizer) readStartTag() TokenType { |
| 17 | + if raw { |
| 18 | + z.rawTag = strings.ToLower(string(z.buf[z.data.start:z.data.end])) |
| 19 | + } |
| 20 | +- // Look for a self-closing token like "<br/>". |
| 21 | +- if z.err == nil && z.buf[z.raw.end-2] == '/' { |
| 22 | ++ // Look for a self-closing token (e.g. <br/>). |
| 23 | ++ // |
| 24 | ++ // Originally, we did this by just checking that the last character of the |
| 25 | ++ // tag (ignoring the closing bracket) was a solidus (/) character, but this |
| 26 | ++ // is not always accurate. |
| 27 | ++ // |
| 28 | ++ // We need to be careful that we don't misinterpret a non-self-closing tag |
| 29 | ++ // as self-closing, as can happen if the tag contains unquoted attribute |
| 30 | ++ // values (i.e. <p a=/>). |
| 31 | ++ // |
| 32 | ++ // To avoid this, we check that the last non-bracket character of the tag |
| 33 | ++ // (z.raw.end-2) isn't the same character as the last non-quote character of |
| 34 | ++ // the last attribute of the tag (z.pendingAttr[1].end-1), if the tag has |
| 35 | ++ // attributes. |
| 36 | ++ nAttrs := len(z.attr) |
| 37 | ++ if z.err == nil && z.buf[z.raw.end-2] == '/' && (nAttrs == 0 || z.raw.end-2 != z.attr[nAttrs-1][1].end-1) { |
| 38 | + return SelfClosingTagToken |
| 39 | + } |
| 40 | + return StartTagToken |
| 41 | +-- |
| 42 | +2.45.4 |
| 43 | + |
0 commit comments