Skip to content

Commit 44e4c5e

Browse files
[AUTO-CHERRYPICK] Patch gh to fix CVE-2024-53858 and CVE-2024-53859 - branch 3.0-dev (#12075)
Co-authored-by: Sandeep Karambelkar <[email protected]>
1 parent 48d8b0b commit 44e4c5e

File tree

3 files changed

+77
-1
lines changed

3 files changed

+77
-1
lines changed

SPECS/gh/CVE-2024-53858.nopatch

Whitespace-only changes.

SPECS/gh/CVE-2024-53859.patch

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
From 5d6079f8ad16f553cdaea1d56fedcb4a3a1db082 Mon Sep 17 00:00:00 2001
2+
From: William Martin <[email protected]>
3+
Date: Thu, 31 Oct 2024 14:07:48 +0100
4+
Subject: [PATCH] Fix token exposure for non-gh hosts in codespaces
5+
6+
This commit introduces a fix for `GITHUB_TOKEN` being exposed to non-github hosts while in a codespace. We no longer return the `GITHUB_TOKEN` for any host except github.com and github.localhost while in a codespace (while the env var `CODESPACES` is `true`).
7+
8+
This commit also changes how tokens are returned when no oAuth token is found in a config. Previously, an empty string and the `oauthToken` source was returned. Now, we return an empty string and the `defaultSource` source. The intention behind this change is to make more logical sense by not returning an `oauthToken` source when we didn't get any token. It's also worth mentioning that this change also improves our test coverage - all lines in `tokenForHost` are now covered by tests, and we don't have unreachable code.
9+
10+
Co-authored-by: Kynan Ware <[email protected]>
11+
12+
Modified patch to apply to AzureLinux
13+
Modified-by: Sandeep Karambelkar <[email protected]>
14+
---
15+
pkg/auth/auth.go | 27 ++++++++----
16+
1 file changed, 91 insertions(+), 33 deletions(-)
17+
18+
diff --git a/vendor/github.com/cli/go-gh/v2/pkg/auth/auth.go b/vendor/github.com/cli/go-gh/v2/pkg/auth/auth.go
19+
index a903736..4378e75 100644
20+
--- a/vendor/github.com/cli/go-gh/v2/pkg/auth/auth.go
21+
+++ b/vendor/github.com/cli/go-gh/v2/pkg/auth/auth.go
22+
@@ -63,6 +63,15 @@ func TokenFromEnvOrConfig(host string) (string, string) {
23+
24+
func tokenForHost(cfg *config.Config, host string) (string, string) {
25+
host = NormalizeHostname(host)
26+
+
27+
+ if isCodespaces, _ := strconv.ParseBool(os.Getenv(codespaces)); isCodespaces {
28+
+ if host == github || host == localhost {
29+
+ if token := os.Getenv(githubToken); token != "" {
30+
+ return token, githubToken
31+
+ }
32+
+ }
33+
+ }
34+
+
35+
if IsEnterprise(host) {
36+
if token := os.Getenv(ghEnterpriseToken); token != "" {
37+
return token, ghEnterpriseToken
38+
@@ -70,25 +79,25 @@ func tokenForHost(cfg *config.Config, host string) (string, string) {
39+
if token := os.Getenv(githubEnterpriseToken); token != "" {
40+
return token, githubEnterpriseToken
41+
}
42+
- if isCodespaces, _ := strconv.ParseBool(os.Getenv(codespaces)); isCodespaces {
43+
- if token := os.Getenv(githubToken); token != "" {
44+
- return token, githubToken
45+
- }
46+
- }
47+
if cfg != nil {
48+
- token, _ := cfg.Get([]string{hostsKey, host, oauthToken})
49+
- return token, oauthToken
50+
+ if token, _ := cfg.Get([]string{hostsKey, host, oauthToken}); token != "" {
51+
+ return token, oauthToken
52+
+ }
53+
}
54+
+ return "", defaultSource
55+
}
56+
+
57+
if token := os.Getenv(ghToken); token != "" {
58+
return token, ghToken
59+
}
60+
if token := os.Getenv(githubToken); token != "" {
61+
return token, githubToken
62+
}
63+
+
64+
if cfg != nil {
65+
- token, _ := cfg.Get([]string{hostsKey, host, oauthToken})
66+
- return token, oauthToken
67+
+ if token, _ := cfg.Get([]string{hostsKey, host, oauthToken}); token != "" {
68+
+ return token, oauthToken
69+
+ }
70+
}
71+
return "", defaultSource
72+
}

SPECS/gh/gh.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: GitHub official command line tool
22
Name: gh
33
Version: 2.62.0
4-
Release: 4%{?dist}
4+
Release: 5%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -17,6 +17,7 @@ Patch0: 0001-Fix-false-negative-in-TestMigrationWriteErrors-when-.patch
1717
Patch1: CVE-2024-54132.patch
1818
Patch2: CVE-2024-45337.patch
1919
Patch3: CVE-2024-45338.patch
20+
Patch5: CVE-2024-53859.patch
2021

2122
BuildRequires: golang < 1.23
2223
BuildRequires: git
@@ -59,6 +60,9 @@ make test
5960
%{_datadir}/zsh/site-functions/_gh
6061

6162
%changelog
63+
* Wed Jan 21 2025 Sandeep Karambelkar <[email protected]> - 2.62.0-5
64+
- Patch CVE-2024-53859, CVE-2024-53858
65+
6266
* Tue Dec 31 2024 Rohit Rawat <[email protected]> - 2.62.0-4
6367
- Add patch for CVE-2024-45338
6468

0 commit comments

Comments
 (0)