[AutoPR- Security] Patch libsoup for CVE-2025-11021 [HIGH] (microsoft#14947)

Co-authored-by: jslobodzian <[email protected]>

Author: azurelinux-security

SPECS/libsoup/CVE-2025-11021.patch

@@ -0,0 +1,56 @@
+From e4ba9e66488af3251fe6b71a3119ee2bd5ca4750 Mon Sep 17 00:00:00 2001
+From: Alynx Zhou <[email protected]>
+Date: Sat, 11 Oct 2025 15:52:47 +0800
+Subject: [PATCH] cookies: Avoid expires attribute if date is invalid
+
+According to CVE-2025-11021, we may get invalid on processing date
+string with timezone offset, this commit will ignore it.
+
+Closes #459
+
+Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
+Upstream-reference: https://gitlab.gnome.org/GNOME/libsoup/-/commit/9e1a427d2f047439d0320defe1593e6352595788.patch
+---
+ libsoup/cookies/soup-cookie.c | 9 +++++----
+ libsoup/soup-date-utils.c     | 3 +++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/libsoup/cookies/soup-cookie.c b/libsoup/cookies/soup-cookie.c
+index 7c41b1d..5af154d 100644
+--- a/libsoup/cookies/soup-cookie.c
++++ b/libsoup/cookies/soup-cookie.c
+@@ -726,12 +726,13 @@ serialize_cookie (SoupCookie *cookie, GString *header, gboolean set_cookie)
+ 
+ 	if (cookie->expires) {
+ 		char *timestamp;
+-
+-		g_string_append (header, "; expires=");
+ 		timestamp = soup_date_time_to_string (cookie->expires,
+ 						      SOUP_DATE_COOKIE);
+-		g_string_append (header, timestamp);
+-		g_free (timestamp);
++                if (timestamp) {
++                        g_string_append (header, "; expires=");
++                        g_string_append (header, timestamp);
++                        g_free (timestamp);
++                }
+ 	}
+ 	if (cookie->path) {
+ 		g_string_append (header, "; path=");
+diff --git a/libsoup/soup-date-utils.c b/libsoup/soup-date-utils.c
+index fd785f5..e5aa805 100644
+--- a/libsoup/soup-date-utils.c
++++ b/libsoup/soup-date-utils.c
+@@ -95,6 +95,9 @@ soup_date_time_to_string (GDateTime      *date,
+                 char *date_format;
+                 char *formatted_date;
+ 
++                if (!utcdate)
++                        return NULL;
++
+                 // We insert days/months ourselves to avoid locale specific formatting
+                 if (format == SOUP_DATE_HTTP) {
+ 			/* "Sun, 06 Nov 1994 08:49:37 GMT" */
+-- 
+2.45.4
+

SPECS/libsoup/libsoup.spec

@@ -4,7 +4,7 @@
 Summary:        libsoup HTTP client/server library
 Name:           libsoup
 Version:        3.4.4
-Release:        9%{?dist}
+Release:        10%{?dist}
 License:        GPLv2
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -67,6 +67,7 @@ Patch17:         CVE-2025-4476.patch
 Patch18:         CVE-2025-32907.patch
 Patch19:         CVE-2025-4948.patch
 Patch20:         CVE-2025-4969.patch
+Patch21:         CVE-2025-11021.patch
 
 %description
 libsoup is HTTP client/server library for GNOME
@@ -134,6 +135,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
 %defattr(-,root,root)
 
 %changelog
+* Wed Oct 29 2025 Azure Linux Security Servicing Account <[email protected]> - 3.4.4-10
+- Patch for CVE-2025-11021
+
 * Tue Aug 12 2025 Azure Linux Security Servicing Account <[email protected]> - 3.4.4-9
 - Patch for CVE-2025-4969