diff --git a/SPECS/cmake/CVE-2025-9301.patch b/SPECS/cmake/CVE-2025-9301.patch new file mode 100644 index 00000000000..ee8558d179d --- /dev/null +++ b/SPECS/cmake/CVE-2025-9301.patch @@ -0,0 +1,65 @@ +From 1372cd7428188f24067beae896b1f5c3887f167a Mon Sep 17 00:00:00 2001 +From: Tyler Yankee +Date: Wed, 13 Aug 2025 15:22:28 -0400 +Subject: [PATCH] foreach: Explicitly skip replay without iterations + +As written, foreach loops with a trailing `IN` (i.e., no loop +variable(s) given) lead to an assertion error. Handle this case by +exiting early when we know the loop won't execute anything. + +Fixes: #27135 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://gitlab.kitware.com/cmake/cmake/-/commit/37e27f71bc356d880c908040cd0cb68fa2c371b8.patch +--- + Source/cmForEachCommand.cxx | 3 +++ + Tests/RunCMake/foreach/RunCMakeTest.cmake | 1 + + Tests/RunCMake/foreach/TrailingIn-result.txt | 1 + + Tests/RunCMake/foreach/TrailingIn.cmake | 5 +++++ + 4 files changed, 10 insertions(+) + create mode 100644 Tests/RunCMake/foreach/TrailingIn-result.txt + create mode 100644 Tests/RunCMake/foreach/TrailingIn.cmake + +diff --git a/Source/cmForEachCommand.cxx b/Source/cmForEachCommand.cxx +index 4845a6d0..825c7e0d 100644 +--- a/Source/cmForEachCommand.cxx ++++ b/Source/cmForEachCommand.cxx +@@ -99,6 +99,9 @@ bool cmForEachFunctionBlocker::ArgumentsMatch(cmListFileFunction const& lff, + bool cmForEachFunctionBlocker::Replay( + std::vector functions, cmExecutionStatus& inStatus) + { ++ if (this->Args.size() == this->IterationVarsCount) { ++ return true; ++ } + return this->ZipLists ? this->ReplayZipLists(functions, inStatus) + : this->ReplayItems(functions, inStatus); + } +diff --git a/Tests/RunCMake/foreach/RunCMakeTest.cmake b/Tests/RunCMake/foreach/RunCMakeTest.cmake +index 15ca4770..acfc742e 100644 +--- a/Tests/RunCMake/foreach/RunCMakeTest.cmake ++++ b/Tests/RunCMake/foreach/RunCMakeTest.cmake +@@ -22,3 +22,4 @@ run_cmake(foreach-RANGE-invalid-test) + run_cmake(foreach-RANGE-out-of-range-test) + run_cmake(foreach-var-scope-CMP0124-OLD) + run_cmake(foreach-var-scope-CMP0124-NEW) ++run_cmake(TrailingIn) +diff --git a/Tests/RunCMake/foreach/TrailingIn-result.txt b/Tests/RunCMake/foreach/TrailingIn-result.txt +new file mode 100644 +index 00000000..573541ac +--- /dev/null ++++ b/Tests/RunCMake/foreach/TrailingIn-result.txt +@@ -0,0 +1 @@ ++0 +diff --git a/Tests/RunCMake/foreach/TrailingIn.cmake b/Tests/RunCMake/foreach/TrailingIn.cmake +new file mode 100644 +index 00000000..e2b5b2f2 +--- /dev/null ++++ b/Tests/RunCMake/foreach/TrailingIn.cmake +@@ -0,0 +1,5 @@ ++foreach(v IN) ++endforeach() ++ ++foreach(v1 v2 IN) ++endforeach() +-- +2.45.4 + diff --git a/SPECS/cmake/cmake.spec b/SPECS/cmake/cmake.spec index b5c33dfa2c8..f5548b58ca2 100644 --- a/SPECS/cmake/cmake.spec +++ b/SPECS/cmake/cmake.spec @@ -2,7 +2,7 @@ Summary: Cmake Name: cmake Version: 3.21.4 -Release: 18%{?dist} +Release: 19%{?dist} License: BSD AND LGPLv2+ Vendor: Microsoft Corporation Distribution: Mariner @@ -36,6 +36,7 @@ Patch21: CVE-2024-11053.patch Patch22: CVE-2024-9681.patch Patch23: CVE-2024-48615.patch Patch24: CVE-2024-8096.patch +Patch25: CVE-2025-9301.patch BuildRequires: bzip2 BuildRequires: bzip2-devel BuildRequires: curl @@ -101,6 +102,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure %{_prefix}/doc/%{name}-*/* %changelog +* Mon Sep 08 2025 Azure Linux Security Servicing Account - 3.21.4-19 +- Patch for CVE-2025-9301 + * Mon May 12 2025 Archana Shettigar - 3.21.4-18 - Fix CVE-2024-8096 by backporting diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index f33dfad0e92..3b6b2ef023c 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -30,8 +30,8 @@ check-debuginfo-0.15.2-1.cm2.aarch64.rpm chkconfig-1.20-4.cm2.aarch64.rpm chkconfig-debuginfo-1.20-4.cm2.aarch64.rpm chkconfig-lang-1.20-4.cm2.aarch64.rpm -cmake-3.21.4-18.cm2.aarch64.rpm -cmake-debuginfo-3.21.4-18.cm2.aarch64.rpm +cmake-3.21.4-19.cm2.aarch64.rpm +cmake-debuginfo-3.21.4-19.cm2.aarch64.rpm coreutils-8.32-7.cm2.aarch64.rpm coreutils-debuginfo-8.32-7.cm2.aarch64.rpm coreutils-lang-8.32-7.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 2a495e486c0..bfaddf889f9 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -31,8 +31,8 @@ check-debuginfo-0.15.2-1.cm2.x86_64.rpm chkconfig-1.20-4.cm2.x86_64.rpm chkconfig-debuginfo-1.20-4.cm2.x86_64.rpm chkconfig-lang-1.20-4.cm2.x86_64.rpm -cmake-3.21.4-18.cm2.x86_64.rpm -cmake-debuginfo-3.21.4-18.cm2.x86_64.rpm +cmake-3.21.4-19.cm2.x86_64.rpm +cmake-debuginfo-3.21.4-19.cm2.x86_64.rpm coreutils-8.32-7.cm2.x86_64.rpm coreutils-debuginfo-8.32-7.cm2.x86_64.rpm coreutils-lang-8.32-7.cm2.x86_64.rpm