Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch libsoup for CVE-2025-11021 [HIGH] - branch main" microsoft#14979

Co-authored-by: Azure Linux Security Servicing Account <[email protected]>

Author: CBL-Mariner-Bot

SPECS/libsoup/CVE-2025-11021.patch

@@ -0,0 +1,56 @@
+From 8f1e56bbb5a192892e026de3c4ee8914aa120d69 Mon Sep 17 00:00:00 2001
+From: Alynx Zhou <[email protected]>
+Date: Sat, 11 Oct 2025 15:52:47 +0800
+Subject: [PATCH] cookies: Avoid expires attribute if date is invalid
+
+According to CVE-2025-11021, we may get invalid on processing date
+string with timezone offset, this commit will ignore it.
+
+Closes #459
+
+Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
+Upstream-reference: https://gitlab.gnome.org/GNOME/libsoup/-/commit/9e1a427d2f047439d0320defe1593e6352595788.patch
+---
+ libsoup/cookies/soup-cookie.c | 9 +++++----
+ libsoup/soup-date-utils.c     | 3 +++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/libsoup/cookies/soup-cookie.c b/libsoup/cookies/soup-cookie.c
+index 021d527..093e451 100644
+--- a/libsoup/cookies/soup-cookie.c
++++ b/libsoup/cookies/soup-cookie.c
+@@ -733,12 +733,13 @@ serialize_cookie (SoupCookie *cookie, GString *header, gboolean set_cookie)
+ 
+ 	if (cookie->expires) {
+ 		char *timestamp;
+-
+-		g_string_append (header, "; expires=");
+ 		timestamp = soup_date_time_to_string (cookie->expires,
+ 						      SOUP_DATE_COOKIE);
+-		g_string_append (header, timestamp);
+-		g_free (timestamp);
++                if (timestamp) {
++                        g_string_append (header, "; expires=");
++                        g_string_append (header, timestamp);
++                        g_free (timestamp);
++                }
+ 	}
+ 	if (cookie->path) {
+ 		g_string_append (header, "; path=");
+diff --git a/libsoup/soup-date-utils.c b/libsoup/soup-date-utils.c
+index 061057e..27fa8e3 100644
+--- a/libsoup/soup-date-utils.c
++++ b/libsoup/soup-date-utils.c
+@@ -104,6 +104,9 @@ soup_date_time_to_string (GDateTime      *date,
+                 char *date_format;
+                 char *formatted_date;
+ 
++                if (!utcdate)
++                        return NULL;
++
+                 // We insert days/months ourselves to avoid locale specific formatting
+                 if (format == SOUP_DATE_HTTP) {
+ 			/* "Sun, 06 Nov 1994 08:49:37 GMT" */
+-- 
+2.45.4
+

SPECS/libsoup/libsoup.spec

@@ -2,7 +2,7 @@
 Summary:        libsoup HTTP client/server library
 Name:           libsoup
 Version:        %{BaseVersion}.4
-Release:        9%{?dist}
+Release:        10%{?dist}
 License:        GPLv2
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -35,6 +35,7 @@ Patch16:         CVE-2025-32912.patch
 Patch17:         CVE-2025-4476.patch
 Patch18:         CVE-2025-4948.patch
 Patch19:         CVE-2025-4969.patch
+Patch20:         CVE-2025-11021.patch
 
 
 BuildRequires:  meson
@@ -147,6 +148,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
 %defattr(-,root,root)
 
 %changelog
+* Wed Oct 29 2025 Azure Linux Security Servicing Account <[email protected]> - 3.0.4-10
+- Patch for CVE-2025-11021
+
 * Tue Aug 12 2025 Azure Linux Security Servicing Account <[email protected]> - 3.0.4-9
 - Patch for CVE-2025-4969