Skip to content

Commit ac6d1fa

Browse files
jslobodzianjslobodzian
committed
Merge branch '3.0-dev' into 3.0
2 parents 8a62e95 + 93c20f2 commit ac6d1fa

15 files changed

+554
-8
lines changed

‎SPECS/ceph/CVE-2012-6708.patch

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
From c993d7d4b9ddb5d9dcb0c4120f798730aacfff0a Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Mon, 13 Jan 2025 14:53:54 -0800
4+
Subject: [PATCH] Adjust jQuery('html') detection to only match when html
5+
starts with '<' (not counting space characters). Fixes #11290.
6+
7+
Source: https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d.patch
8+
---
9+
qa/workunits/erasure-code/jquery.js | 3 ++-
10+
1 file changed, 2 insertions(+), 1 deletion(-)
11+
12+
diff --git a/qa/workunits/erasure-code/jquery.js b/qa/workunits/erasure-code/jquery.js
13+
index 8c24ffc61..45c208837 100644
14+
--- a/qa/workunits/erasure-code/jquery.js
15+
+++ b/qa/workunits/erasure-code/jquery.js
16+
@@ -56,7 +56,8 @@ var
17+
18+
// A simple way to check for HTML strings
19+
// Prioritize #id over <tag> to avoid XSS via location.hash (#9521)
20+
- rquickExpr = /^(?:[^#<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,
21+
+ // Strict HTML recognition (#11290: must start with <)
22+
+ rquickExpr = /^(?:(<[\w\W]+>)[^>]*|#([\w-]*))$/,
23+
24+
// Match a standalone tag
25+
rsingleTag = /^<(\w+)\s*\/?>(?:<\/\1>|)$/,
26+
--
27+
2.34.1
28+

‎SPECS/ceph/CVE-2014-5461.patch

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
From 4c6ecee6fcb3c3deead402098c6de1cfd53bb91b Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Tue, 28 Jan 2025 15:47:50 -0800
4+
Subject: [PATCH] Patch ceph to fix CVE-2014-5461
5+
6+
Stack overflow in vararg functions with many fixed parameters called
7+
with few arguments.
8+
9+
Link: https://www.lua.org/bugs.html#5.2.2-1
10+
---
11+
.../3rdparty/civetweb/src/third_party/lua-5.1.5/src/ldo.c | 2 +-
12+
1 file changed, 1 insertion(+), 1 deletion(-)
13+
14+
diff --git a/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/third_party/lua-5.1.5/src/ldo.c b/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/third_party/lua-5.1.5/src/ldo.c
15+
index d1bf786cb..30333bfa5 100644
16+
--- a/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/third_party/lua-5.1.5/src/ldo.c
17+
+++ b/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/third_party/lua-5.1.5/src/ldo.c
18+
@@ -274,7 +274,7 @@ int luaD_precall (lua_State *L, StkId func, int nresults) {
19+
CallInfo *ci;
20+
StkId st, base;
21+
Proto *p = cl->p;
22+
- luaD_checkstack(L, p->maxstacksize);
23+
+ luaD_checkstack(L, p->maxstacksize + p->numparams);
24+
func = restorestack(L, funcr);
25+
if (!p->is_vararg) { /* no varargs? */
26+
base = func + 1;
27+
--
28+
2.34.1
29+

‎SPECS/ceph/CVE-2015-9251.patch

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
From 124fa2abfde0939c5a7684be1c9f11565888a3a5 Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Tue, 28 Jan 2025 17:30:43 -0800
4+
Subject: [PATCH] [Medium] Patch ceph to fix CVE-2015-9251
5+
6+
Link: https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc.patch
7+
---
8+
qa/workunits/erasure-code/jquery.js | 8 ++++++++
9+
1 file changed, 8 insertions(+)
10+
11+
diff --git a/qa/workunits/erasure-code/jquery.js b/qa/workunits/erasure-code/jquery.js
12+
index 8c24ffc61..f4ce660b1 100644
13+
--- a/qa/workunits/erasure-code/jquery.js
14+
+++ b/qa/workunits/erasure-code/jquery.js
15+
@@ -8245,6 +8245,14 @@ jQuery.ajaxPrefilter( "json jsonp", function( s, originalSettings, jqXHR ) {
16+
return "script";
17+
}
18+
});
19+
+
20+
+// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
21+
+jQuery.ajaxPrefilter( function( s ) {
22+
+ if ( s.crossDomain ) {
23+
+ s.contents.script = false;
24+
+ }
25+
+} );
26+
+
27+
// Install script dataType
28+
jQuery.ajaxSetup({
29+
accepts: {
30+
--
31+
2.34.1
32+

‎SPECS/ceph/CVE-2020-22217.patch

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From 97568ddb836a9680c93335a3f8ca0f2c0616ccdc Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Mon, 27 Jan 2025 16:19:53 -0800
4+
Subject: [PATCH] Fix CVE-2020-22217 in c-ares
5+
6+
Link: https://github.com/c-ares/c-ares/pull/332
7+
---
8+
src/c-ares/ares_parse_soa_reply.c | 3 +++
9+
1 file changed, 3 insertions(+)
10+
11+
diff --git a/src/c-ares/ares_parse_soa_reply.c b/src/c-ares/ares_parse_soa_reply.c
12+
index 35af0a75c..5924bbca9 100644
13+
--- a/src/c-ares/ares_parse_soa_reply.c
14+
+++ b/src/c-ares/ares_parse_soa_reply.c
15+
@@ -65,6 +65,9 @@ ares_parse_soa_reply(const unsigned char *abuf, int alen,
16+
status = ares__expand_name_for_response(aptr, abuf, alen, &qname, &len);
17+
if (status != ARES_SUCCESS)
18+
goto failed_stat;
19+
+
20+
+ if (alen <= len + HFIXEDSZ + 1)
21+
+ goto failed;
22+
aptr += len;
23+
24+
/* skip qtype & qclass */
25+
--
26+
2.34.1
27+

‎SPECS/ceph/ceph.spec

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
#disable debuginfo because ceph-debuginfo rpm is too large
22
%define debug_package %{nil}
33
%define _unpackaged_files_terminate_build 0
4-
4+
55
Summary: User space components of the Ceph file system
66
Name: ceph
77
Version: 18.2.2
8-
Release: 3%{?dist}
8+
Release: 4%{?dist}
99
License: LGPLv2 and LGPLv3 and CC-BY-SA and GPLv2 and Boost and BSD and MIT and Public Domain and GPLv3 and ASL-2.0
1010
URL: https://ceph.io/
1111
Vendor: Microsoft Corporation
@@ -14,6 +14,10 @@ Source0: https://download.ceph.com/tarballs/%{name}-%{version}.tar.gz
1414
Patch0: 0034-src-pybind-rbd-rbd.pyx.patch
1515
Patch1: 0032-cmake-modules-BuildBoost.cmake.patch
1616
Patch2: CVE-2024-52338.patch
17+
Patch3: CVE-2014-5461.patch
18+
Patch4: CVE-2020-22217.patch
19+
Patch5: CVE-2015-9251.patch
20+
Patch6: CVE-2012-6708.patch
1721
#
1822
# Copyright (C) 2004-2019 The Ceph Project Developers. See COPYING file
1923
# at the top-level directory of this distribution and at
@@ -895,7 +899,7 @@ This package provides a Ceph hardware monitoring agent.
895899
# common
896900
#################################################################################
897901
%prep
898-
%autosetup -p1
902+
%autosetup -p1
899903

900904
%build
901905
pwd
@@ -2004,6 +2008,12 @@ exit 0
20042008

20052009

20062010
%changelog
2011+
* Tue Jan 28 2025 Kevin Lockwood <[email protected]> - 18.2.2-4
2012+
- Fix for CVE-2014-5461
2013+
- Fix for CVE-2020-22217
2014+
- Fix for CVE-2015-9251
2015+
- Fix for CVE-2012-6708
2016+
20072017
* Tue Jan 01 2025 Sandeep Karambelkar <[email protected]> - 18.2.2-3
20082018
- Based on the package build logs, opentelemetry-cpp submodule is not being built
20092019
- Removing opentelemetry-cpp to address below CVEs as this submodule is not relevant

‎SPECS/hwloc/CVE-2022-47022.patch

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
From b85436757996b58b805dc4d471ec1cb3c6f56781 Mon Sep 17 00:00:00 2001
2+
From: jykanase <[email protected]>
3+
Date: Tue, 28 Jan 2025 12:11:44 +0000
4+
Subject: [PATCH] CVE-2022-47022
5+
6+
Source Link: https://github.com/open-mpi/hwloc/commit/ac1f8db9a0790d2bf153711ff4cbf6101f89aace
7+
---
8+
hwloc/topology-linux.c | 15 ++++++++++++++-
9+
1 file changed, 14 insertions(+), 1 deletion(-)
10+
11+
diff --git a/hwloc/topology-linux.c b/hwloc/topology-linux.c
12+
index c7b63d2..fd6745e 100644
13+
--- a/hwloc/topology-linux.c
14+
+++ b/hwloc/topology-linux.c
15+
@@ -870,6 +870,8 @@ hwloc_linux_set_tid_cpubind(hwloc_topology_t topology __hwloc_attribute_unused,
16+
17+
setsize = CPU_ALLOC_SIZE(last+1);
18+
plinux_set = CPU_ALLOC(last+1);
19+
+ if (!plinux_set)
20+
+ return -1;
21+
22+
CPU_ZERO_S(setsize, plinux_set);
23+
hwloc_bitmap_foreach_begin(cpu, hwloc_set)
24+
@@ -950,7 +952,10 @@ hwloc_linux_find_kernel_nr_cpus(hwloc_topology_t topology)
25+
while (1) {
26+
cpu_set_t *set = CPU_ALLOC(nr_cpus);
27+
size_t setsize = CPU_ALLOC_SIZE(nr_cpus);
28+
- int err = sched_getaffinity(0, setsize, set); /* always works, unless setsize is too small */
29+
+ int err;
30+
+ if (!set)
31+
+ return -1; /* caller will return an error, and we'll try again later */
32+
+ err = sched_getaffinity(0, setsize, set); /* always works, unless setsize is too small */
33+
CPU_FREE(set);
34+
nr_cpus = setsize * 8; /* that's the value that was actually tested */
35+
if (!err)
36+
@@ -978,8 +983,12 @@ hwloc_linux_get_tid_cpubind(hwloc_topology_t topology __hwloc_attribute_unused,
37+
38+
/* find the kernel nr_cpus so as to use a large enough cpu_set size */
39+
kernel_nr_cpus = hwloc_linux_find_kernel_nr_cpus(topology);
40+
+ if (kernel_nr_cpus < 0)
41+
+ return -1;
42+
setsize = CPU_ALLOC_SIZE(kernel_nr_cpus);
43+
plinux_set = CPU_ALLOC(kernel_nr_cpus);
44+
+ if (!plinux_set)
45+
+ return -1;
46+
47+
err = sched_getaffinity(tid, setsize, plinux_set);
48+
49+
@@ -1333,6 +1342,8 @@ hwloc_linux_set_thread_cpubind(hwloc_topology_t topology, pthread_t tid, hwloc_c
50+
51+
setsize = CPU_ALLOC_SIZE(last+1);
52+
plinux_set = CPU_ALLOC(last+1);
53+
+ if (!plinux_set)
54+
+ return -1;
55+
56+
CPU_ZERO_S(setsize, plinux_set);
57+
hwloc_bitmap_foreach_begin(cpu, hwloc_set)
58+
@@ -1424,6 +1435,8 @@ hwloc_linux_get_thread_cpubind(hwloc_topology_t topology, pthread_t tid, hwloc_b
59+
60+
setsize = CPU_ALLOC_SIZE(last+1);
61+
plinux_set = CPU_ALLOC(last+1);
62+
+ if (!plinux_set)
63+
+ return -1;
64+
65+
err = pthread_getaffinity_np(tid, setsize, plinux_set);
66+
if (err) {
67+
--
68+
2.45.2
69+

‎SPECS/hwloc/hwloc.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
Summary: Portable Hardware Locality - portable abstraction of hierarchical architectures
22
Name: hwloc
33
Version: 2.9.2
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: BSD-2-Clause
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
88
URL: https://www.open-mpi.org/projects/hwloc/
99
Source0: http://www.open-mpi.org/software/hwloc/v2.9/downloads/%{name}-%{version}.tar.bz2
10+
Patch0: CVE-2022-47022.patch
1011
BuildRequires: gcc
1112
# C++ only for hwloc-hello-cpp test:
1213
BuildRequires: gcc-c++
@@ -167,6 +168,9 @@ LD_LIBRARY_PATH=$PWD/hwloc/.libs make check
167168
%{_libdir}/%{name}/hwloc*
168169

169170
%changelog
171+
* Wed Jan 29 2025 Jyoti Kanase <[email protected]> - 2.9.2-2
172+
- Fix CVE-2022-47022
173+
170174
* Fri Oct 27 2023 CBL-Mariner Servicing Account <[email protected]> - 2.9.2-1
171175
- Auto-upgrade to 2.9.2 - Azure Linux 3.0 - package upgrades
172176

‎SPECS/m2crypto/CVE-2019-11358.patch

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
From d3e8292d3c2ac5e78ee4f8cf7ea00241335159b4 Mon Sep 17 00:00:00 2001
2+
From: jykanase <[email protected]>
3+
Date: Wed, 29 Jan 2025 13:46:24 +0000
4+
Subject: [PATCH] CVE-2019-11358
5+
6+
Source Link: https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
7+
---
8+
doc/html/_static/jquery-3.2.1.js | 3 ++-
9+
1 file changed, 2 insertions(+), 1 deletion(-)
10+
11+
diff --git a/doc/html/_static/jquery-3.2.1.js b/doc/html/_static/jquery-3.2.1.js
12+
index d2d8ca4..8bbd717 100644
13+
--- a/doc/html/_static/jquery-3.2.1.js
14+
+++ b/doc/html/_static/jquery-3.2.1.js
15+
@@ -229,8 +229,9 @@ jQuery.extend = jQuery.fn.extend = function() {
16+
src = target[ name ];
17+
copy = options[ name ];
18+
19+
+ // Prevent Object.prototype pollution
20+
// Prevent never-ending loop
21+
- if ( target === copy ) {
22+
+ if ( name === "__proto__" || target === copy ) {
23+
continue;
24+
}
25+
26+
--
27+
2.45.2
28+

‎SPECS/m2crypto/m2crypto.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Crypto and SSL toolkit for Python
22
Name: m2crypto
33
Version: 0.38.0
4-
Release: 3%{?dist}
4+
Release: 4%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -10,6 +10,7 @@ URL: https://pypi.python.org/pypi/M2Crypto
1010
Source0: https://files.pythonhosted.org/packages/2c/52/c35ec79dd97a8ecf6b2bbd651df528abb47705def774a4a15b99977274e8/M2Crypto-%{version}.tar.gz
1111
Patch0: 0001-skip-test_tls1_nok-which-cant-be-run-in-FIPS.patch
1212
Patch1: CVE-2020-25657.patch
13+
Patch2: CVE-2019-11358.patch
1314

1415
%description
1516
M2Crypto is a crypto and SSL toolkit for Python
@@ -57,6 +58,9 @@ pip3 install parameterized
5758
%{python3_sitelib}/*
5859

5960
%changelog
61+
* Wed Jan 29 2025 Jyoti Kanase <[email protected]> - 0.38.0-4
62+
- Fix CVE-2019-11358
63+
6064
* Tue Aug 16 2022 Muhammad Falak <[email protected]> - 0.38.0-3
6165
- Patch CVE-2020-25657
6266

‎SPECS/mysql/CVE-2024-9681.patch

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From 4584d3ab388a83e2e0753c69437df975b4a13547 Mon Sep 17 00:00:00 2001
2+
From: jykanase <[email protected]>
3+
Date: Sat, 25 Jan 2025 13:44:11 +0000
4+
Subject: [PATCH] CVE-2024-9681
5+
6+
Backported form: https://github.com/curl/curl/commit/a94973805df96269bf
7+
---
8+
extra/curl/curl-8.9.1/lib/hsts.c | 14 ++++++++++----
9+
1 file changed, 10 insertions(+), 4 deletions(-)
10+
11+
diff --git a/extra/curl/curl-8.9.1/lib/hsts.c b/extra/curl/curl-8.9.1/lib/hsts.c
12+
index 8cd77ae3..6e2599b1 100644
13+
--- a/extra/curl/curl-8.9.1/lib/hsts.c
14+
+++ b/extra/curl/curl-8.9.1/lib/hsts.c
15+
@@ -249,12 +249,14 @@ CURLcode Curl_hsts_parse(struct hsts *h, const char *hostname,
16+
struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
17+
bool subdomain)
18+
{
19+
+ struct stsentry *bestsub = NULL;
20+
if(h) {
21+
char buffer[MAX_HSTS_HOSTLEN + 1];
22+
time_t now = time(NULL);
23+
size_t hlen = strlen(hostname);
24+
struct Curl_llist_element *e;
25+
struct Curl_llist_element *n;
26+
+ size_t blen = 0;
27+
28+
if((hlen > MAX_HSTS_HOSTLEN) || !hlen)
29+
return NULL;
30+
@@ -279,15 +281,19 @@ struct stsentry *Curl_hsts(struct hsts *h, const char *hostname,
31+
if(ntail < hlen) {
32+
size_t offs = hlen - ntail;
33+
if((hostname[offs-1] == '.') &&
34+
- strncasecompare(&hostname[offs], sts->host, ntail))
35+
- return sts;
36+
+ strncasecompare(&hostname[offs], sts->host, ntail) &&
37+
+ (ntail > blen)) {
38+
+ /* save the tail match with the longest tail */
39+
+ bestsub = sts;
40+
+ blen = ntail;
41+
+ }
42+
}
43+
}
44+
if(strcasecompare(hostname, sts->host))
45+
return sts;
46+
}
47+
}
48+
- return NULL; /* no match */
49+
+ return bestsub;
50+
}
51+
52+
/*
53+
@@ -439,7 +445,7 @@ static CURLcode hsts_add(struct hsts *h, char *line)
54+
e = Curl_hsts(h, p, subdomain);
55+
if(!e)
56+
result = hsts_create(h, p, subdomain, expires);
57+
- else {
58+
+ else if(strcasecompare(p, e->host)) {
59+
/* the same hostname, use the largest expire time */
60+
if(expires > e->expires)
61+
e->expires = expires;
62+
--
63+
2.45.2
64+

0 commit comments

Comments
 (0)