Skip to content

Commit 3dd7921

Browse files
CBL-Mariner-BotKanishk-Bansal
CBL-Mariner-Bot
and
Kanishk-Bansal
authored
[AUTO-CHERRYPICK] Patch influxdb for CVE-2025-22868 & CVE-2025-27144 [High] - branch 3.0-dev (#12782)
Co-authored-by: Kanishk Bansal <[email protected]>
1 parent 9d70498 commit 3dd7921

File tree

3 files changed

+95
-2
lines changed

3 files changed

+95
-2
lines changed

‎SPECS/influxdb/CVE-2025-22868.patch

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
From 681b4d8edca1bcfea5bce685d77ea7b82ed3e7b3 Mon Sep 17 00:00:00 2001
2+
From: Neal Patel <[email protected]>
3+
Date: Thu, 30 Jan 2025 14:10:09 -0500
4+
Subject: [PATCH] jws: split token into fixed number of parts
5+
6+
Thanks to 'jub0bs' for reporting this issue.
7+
8+
Fixes #71490
9+
Fixes CVE-2025-22868
10+
11+
Change-Id: I2552731f46d4907f29aafe7863c558387b6bd6e2
12+
Reviewed-on: https://go-review.googlesource.com/c/oauth2/+/652155
13+
Auto-Submit: Gopher Robot <[email protected]>
14+
Reviewed-by: Damien Neil <[email protected]>
15+
Reviewed-by: Roland Shoemaker <[email protected]>
16+
LUCI-TryBot-Result: Go LUCI <[email protected]>
17+
---
18+
vendor/golang.org/x/oauth2/jws/jws.go | 4 ++--
19+
1 file changed, 2 insertions(+), 2 deletions(-)
20+
21+
diff --git a/vendor/golang.org/x/oauth2/jws/jws.go b/vendor/golang.org/x/oauth2/jws/jws.go
22+
index 95015648b..6f03a49d3 100644
23+
--- a/vendor/golang.org/x/oauth2/jws/jws.go
24+
+++ b/vendor/golang.org/x/oauth2/jws/jws.go
25+
@@ -165,11 +165,11 @@ func Encode(header *Header, c *ClaimSet, key *rsa.PrivateKey) (string, error) {
26+
// Verify tests whether the provided JWT token's signature was produced by the private key
27+
// associated with the supplied public key.
28+
func Verify(token string, key *rsa.PublicKey) error {
29+
- parts := strings.Split(token, ".")
30+
- if len(parts) != 3 {
31+
+ if strings.Count(token, ".") != 2 {
32+
return errors.New("jws: invalid token received, token must have 3 parts")
33+
}
34+
35+
+ parts := strings.SplitN(token, ".", 3)
36+
signedContent := parts[0] + "." + parts[1]
37+
signatureString, err := base64.RawURLEncoding.DecodeString(parts[2])
38+
if err != nil {

‎SPECS/influxdb/CVE-2025-27144.patch

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
From fa324fa38481f9d2da9109cb5983326f62ff7507 Mon Sep 17 00:00:00 2001
2+
From: Kanishk-Bansal <[email protected]>
3+
Date: Fri, 28 Feb 2025 07:45:53 +0000
4+
Subject: [PATCH] CVE-2025-27144
5+
Upstream Ref: https://github.com/go-jose/go-jose/commit/c9ed84d8f0cfadcfad817150158caca6fcbc518b
6+
7+
---
8+
vendor/gopkg.in/square/go-jose.v2/jwe.go | 5 +++--
9+
vendor/gopkg.in/square/go-jose.v2/jws.go | 5 +++--
10+
2 files changed, 6 insertions(+), 4 deletions(-)
11+
12+
diff --git a/vendor/gopkg.in/square/go-jose.v2/jwe.go b/vendor/gopkg.in/square/go-jose.v2/jwe.go
13+
index b5a6dcd..cd1de9e 100644
14+
--- a/vendor/gopkg.in/square/go-jose.v2/jwe.go
15+
+++ b/vendor/gopkg.in/square/go-jose.v2/jwe.go
16+
@@ -201,10 +201,11 @@ func (parsed *rawJSONWebEncryption) sanitized() (*JSONWebEncryption, error) {
17+
18+
// parseEncryptedCompact parses a message in compact format.
19+
func parseEncryptedCompact(input string) (*JSONWebEncryption, error) {
20+
- parts := strings.Split(input, ".")
21+
- if len(parts) != 5 {
22+
+ // Five parts is four separators
23+
+ if strings.Count(input, ".") != 4 {
24+
return nil, fmt.Errorf("square/go-jose: compact JWE format must have five parts")
25+
}
26+
+ parts := strings.SplitN(input, ".", 5)
27+
28+
rawProtected, err := base64.RawURLEncoding.DecodeString(parts[0])
29+
if err != nil {
30+
diff --git a/vendor/gopkg.in/square/go-jose.v2/jws.go b/vendor/gopkg.in/square/go-jose.v2/jws.go
31+
index 7e261f9..a8d55fb 100644
32+
--- a/vendor/gopkg.in/square/go-jose.v2/jws.go
33+
+++ b/vendor/gopkg.in/square/go-jose.v2/jws.go
34+
@@ -275,10 +275,11 @@ func (parsed *rawJSONWebSignature) sanitized() (*JSONWebSignature, error) {
35+
36+
// parseSignedCompact parses a message in compact format.
37+
func parseSignedCompact(input string, payload []byte) (*JSONWebSignature, error) {
38+
- parts := strings.Split(input, ".")
39+
- if len(parts) != 3 {
40+
+ // Three parts is two separators
41+
+ if strings.Count(input, ".") != 2 {
42+
return nil, fmt.Errorf("square/go-jose: compact JWS format must have three parts")
43+
}
44+
+ parts := strings.SplitN(input, ".", 3)
45+
46+
if parts[1] != "" && payload != nil {
47+
return nil, fmt.Errorf("square/go-jose: payload is not detached")
48+
--
49+
2.45.2
50+

‎SPECS/influxdb/influxdb.spec

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
Summary: Scalable datastore for metrics, events, and real-time analytics
1919
Name: influxdb
2020
Version: 2.7.5
21-
Release: 1%{?dist}
21+
Release: 2%{?dist}
2222
License: MIT
2323
Vendor: Microsoft Corporation
2424
Distribution: Azure Linux
@@ -61,7 +61,9 @@ Patch2: CVE-2024-6104.patch
6161
Patch3: CVE-2023-45288.patch
6262
Patch4: CVE-2024-24786.patch
6363
Patch5: CVE-2024-45338.patch
64-
Patch6: CVE-2024-28180.patch
64+
Patch6: CVE-2024-28180.patch
65+
Patch7: CVE-2025-27144.patch
66+
Patch8: CVE-2025-22868.patch
6567
BuildRequires: clang
6668
BuildRequires: golang
6769
BuildRequires: kernel-headers
@@ -151,6 +153,9 @@ go test ./...
151153
%{_tmpfilesdir}/influxdb.conf
152154

153155
%changelog
156+
* Mon Mar 03 2025 Kanishk Bansal <[email protected]> - 2.7.5-2
157+
- Fix CVE-2025-22868, CVE-2025-27144 with an upstream patch
158+
154159
* Mon Feb 10 2025 CBL-Mariner Servicing Account <[email protected]> - 2.7.5-1
155160
- Auto-upgrade to 2.7.5 - Upgrade influxdb to fix CVE-2023-44487
156161

0 commit comments

Comments
 (0)