Skip to content

Commit bec0395

Browse files
committed
Merge branch 'main' into 2.0
2 parents 0fbfb7a + 3eb66d1 commit bec0395

File tree

8 files changed

+102
-64
lines changed

8 files changed

+102
-64
lines changed

SPECS/msft-golang/msft-golang.signatures.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"Signatures": {
33
"go.20230802.5.src.tar.gz": "56b9e0e0c3c13ca95d5efa6de4e7d49a9d190eca77919beff99d33cd3fa74e95",
44
"go.20240206.2.src.tar.gz": "7982e0011aa9ab95fd0530404060410af4ba57326d26818690f334fdcb6451cd",
5-
"go1.22.7-20240905.3.src.tar.gz": "4c2601d9fe6b4692b6bb4487751dec149c30bd76ad9383331a84971a66bdd0bc",
5+
"go1.22.8-20241001.6.src.tar.gz": "549a43643849c73ffd8579d63e2e3488428f0a4c436169abe02be01a3dbd41c8",
66
"go1.4-bootstrap-20171003.tar.gz": "f4ff5b5eb3a3cae1c993723f3eab519c5bae18866b5e5f96fe1102f0cb5c3e52"
77
}
88
}

SPECS/msft-golang/msft-golang.spec

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
%global goroot %{_libdir}/golang
22
%global gopath %{_datadir}/gocode
3-
%global ms_go_filename go1.22.7-20240905.3.src.tar.gz
3+
%global ms_go_filename go1.22.8-20241001.6.src.tar.gz
44
%global ms_go_revision 1
55
%ifarch aarch64
66
%global gohostarch arm64
@@ -14,7 +14,7 @@
1414
%define __find_requires %{nil}
1515
Summary: Go
1616
Name: msft-golang
17-
Version: 1.22.7
17+
Version: 1.22.8
1818
Release: 1%{?dist}
1919
License: BSD
2020
Vendor: Microsoft Corporation
@@ -153,6 +153,9 @@ fi
153153
%{_bindir}/*
154154

155155
%changelog
156+
* Thu Oct 24 2024 CBL-Mariner Servicing Account <[email protected]> - 1.22.8-1
157+
- Auto-upgrade to 1.22.8 - To fix CVE-2022-41717
158+
156159
* Mon Sep 09 2024 Henry Beberman <[email protected]> - 1.22.7-1
157160
- Bump version to 1.22.7 to address CVE-2024-34158, CVE-2024-34156, CVE-2024-34155
158161

SPECS/mysql/CVE-2023-46218.patch

Lines changed: 0 additions & 50 deletions
This file was deleted.

SPECS/mysql/mysql.signatures.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"Signatures": {
3-
"mysql-boost-8.0.36.tar.gz": "429c5f69f3722e31807e74119d157a023277af210bfee513443cae60ebd2a86d"
4-
}
5-
}
2+
"Signatures": {
3+
"mysql-boost-8.0.40.tar.gz": "eb34a23d324584688199b4222242f4623ea7bca457a3191cd7a106c63a7837d9"
4+
}
5+
}

SPECS/mysql/mysql.spec

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Summary: MySQL.
22
Name: mysql
3-
Version: 8.0.36
3+
Version: 8.0.40
44
Release: 1%{?dist}
55
License: GPLv2 with exceptions AND LGPLv2 AND BSD
66
Vendor: Microsoft Corporation
@@ -9,7 +9,6 @@ Group: Applications/Databases
99
URL: https://www.mysql.com
1010
Source0: https://dev.mysql.com/get/Downloads/MySQL-8.0/%{name}-boost-%{version}.tar.gz
1111
Patch0: CVE-2012-5627.nopatch
12-
Patch1: CVE-2023-46218.patch
1312
BuildRequires: cmake
1413
BuildRequires: libtirpc-devel
1514
BuildRequires: openssl-devel
@@ -98,6 +97,15 @@ fi
9897
%{_libdir}/pkgconfig/mysqlclient.pc
9998

10099
%changelog
100+
* Fri Oct 18 2024 Sudipta Pandit <[email protected]> - 8.0.40-1
101+
- Upgrade to 8.0.40 to fix multiple CVEs -- CVE-2024-21193, CVE-2024-21194, CVE-2024-21162, CVE-2024-21157, CVE-2024-21130,
102+
CVE-2024-20996, CVE-2024-21129, CVE-2024-21159, CVE-2024-21135, CVE-2024-21173, CVE-2024-21160, CVE-2024-21125, CVE-2024-21134,
103+
CVE-2024-21127, CVE-2024-21142, CVE-2024-21166, CVE-2024-21163, CVE-2024-21203, CVE-2024-21219, CVE-2024-21247, CVE-2024-21237,
104+
CVE-2024-21231, CVE-2024-21213, CVE-2024-21218, CVE-2024-21197, CVE-2024-21230, CVE-2024-21207, CVE-2024-21201, CVE-2024-21198,
105+
CVE-2024-21238, CVE-2024-21196, CVE-2024-21239, CVE-2024-21199, CVE-2024-21241, CVE-2024-21236, CVE-2024-21212, CVE-2024-21096,
106+
CVE-2024-21171, CVE-2024-21165, CVE-2023-46219
107+
- Remove patch for CVE-2023-46218 (fixed in 8.0.37)
108+
101109
* Tue Jun 18 2024 Archana Choudhary <[email protected]> - 8.0.36-1
102110
- Upgrade to 8.0.36 to fix 10 CVEs
103111

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
From 926c72f641cd122e1e8fc9f92f0fea885d3c8ede Mon Sep 17 00:00:00 2001
2+
From: Mykhailo Bykhovtsev <[email protected]>
3+
Date: Wed, 23 Oct 2024 16:13:23 -0700
4+
Subject: [PATCH] patch CVE-2022-25255
5+
Patch taken from https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff
6+
7+
---
8+
src/corelib/io/qprocess_unix.cpp | 28 +++++++++++++++-------------
9+
1 file changed, 15 insertions(+), 13 deletions(-)
10+
11+
diff --git a/src/corelib/io/qprocess_unix.cpp b/src/corelib/io/qprocess_unix.cpp
12+
index 7a2daa2a..29b771a1 100644
13+
--- a/src/corelib/io/qprocess_unix.cpp
14+
+++ b/src/corelib/io/qprocess_unix.cpp
15+
@@ -1,7 +1,7 @@
16+
/****************************************************************************
17+
**
18+
** Copyright (C) 2016 The Qt Company Ltd.
19+
-** Copyright (C) 2016 Intel Corporation.
20+
+** Copyright (C) 2022 Intel Corporation.
21+
** Contact: https://www.qt.io/licensing/
22+
**
23+
** This file is part of the QtCore module of the Qt Toolkit.
24+
@@ -422,14 +422,15 @@ void QProcessPrivate::startProcess()
25+
// Add the program name to the argument list.
26+
argv[0] = nullptr;
27+
if (!program.contains(QLatin1Char('/'))) {
28+
+ // findExecutable() returns its argument if it's an absolute path,
29+
+ // otherwise it searches $PATH; returns empty if not found (we handle
30+
+ // that case much later)
31+
const QString &exeFilePath = QStandardPaths::findExecutable(program);
32+
- if (!exeFilePath.isEmpty()) {
33+
- const QByteArray &tmp = QFile::encodeName(exeFilePath);
34+
- argv[0] = ::strdup(tmp.constData());
35+
- }
36+
- }
37+
- if (!argv[0])
38+
+ const QByteArray &tmp = QFile::encodeName(exeFilePath);
39+
+ argv[0] = ::strdup(tmp.constData());
40+
+ } else {
41+
argv[0] = ::strdup(encodedProgramName.constData());
42+
+ }
43+
44+
// Add every argument to the list
45+
for (int i = 0; i < arguments.count(); ++i)
46+
@@ -975,15 +976,16 @@ bool QProcessPrivate::startDetached(qint64 *pid)
47+
envp = _q_dupEnvironment(environment.d.constData()->vars, &envc);
48+
}
49+
50+
- QByteArray tmp;
51+
if (!program.contains(QLatin1Char('/'))) {
52+
+ // findExecutable() returns its argument if it's an absolute path,
53+
+ // otherwise it searches $PATH; returns empty if not found (we handle
54+
+ // that case much later)
55+
const QString &exeFilePath = QStandardPaths::findExecutable(program);
56+
- if (!exeFilePath.isEmpty())
57+
- tmp = QFile::encodeName(exeFilePath);
58+
+ const QByteArray &tmp = QFile::encodeName(exeFilePath);
59+
+ argv[0] = ::strdup(tmp.constData());
60+
+ } else {
61+
+ argv[0] = ::strdup(QFile::encodeName(program));
62+
}
63+
- if (tmp.isEmpty())
64+
- tmp = QFile::encodeName(program);
65+
- argv[0] = tmp.data();
66+
67+
if (envp)
68+
qt_safe_execve(argv[0], argv, envp);
69+
--
70+
2.34.1
71+

SPECS/qt5-qtbase/qt5-qtbase.spec

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
Name: qt5-qtbase
3434
Summary: Qt5 - QtBase components
3535
Version: 5.12.11
36-
Release: 13%{?dist}
36+
Release: 14%{?dist}
3737
# See LICENSE.GPL3-EXCEPT.txt, for exception details
3838
License: GFDL AND LGPLv3 AND GPLv2 AND GPLv3 with exceptions AND QT License Agreement 4.0
3939
Vendor: Microsoft Corporation
@@ -163,6 +163,8 @@ Patch90: CVE-2022-25643.patch
163163
Patch91: qt5-qtbase-5.15-http-encrypted-signal.patch
164164
Patch92: CVE-2024-39936.patch
165165

166+
Patch93: CVE-2022-25255.patch
167+
166168
# Do not check any files in %%{_qt5_plugindir}/platformthemes/ for requires.
167169
# Those themes are there for platform integration. If the required libraries are
168170
# not there, the platform to integrate with isn't either. Then Qt will just
@@ -276,6 +278,7 @@ Qt5 libraries used for drawing widgets and OpenGL items.
276278
%patch90 -p1
277279
%patch91 -p1
278280
%patch92 -p1
281+
%patch93 -p1
279282

280283
## upstream patches
281284

@@ -781,6 +784,9 @@ fi
781784
%{_qt5_libdir}/cmake/Qt5Gui/Qt5Gui_QXdgDesktopPortalThemePlugin.cmake
782785

783786
%changelog
787+
* Wed Oct 23 2024 Mykhailo Bykhovtsev <[email protected]> - 5.12.11-14
788+
- Add patch to resolve CVE-2022-25255.
789+
784790
* Wed Aug 07 2024 Sumedh Sharma <[email protected]> - 5.12.11-13
785791
- Add patch to resolve CVE-2024-39936.
786792

cgmanifest.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13673,8 +13673,8 @@
1367313673
"type": "other",
1367413674
"other": {
1367513675
"name": "msft-golang",
13676-
"version": "1.22.7",
13677-
"downloadUrl": "https://github.com/microsoft/go/releases/download/v1.22.7-1/go1.22.7-20240905.3.src.tar.gz"
13676+
"version": "1.22.8",
13677+
"downloadUrl": "https://github.com/microsoft/go/releases/download/v1.22.8-1/go1.22.8-20241001.6.src.tar.gz"
1367813678
}
1367913679
}
1368013680
},
@@ -13813,8 +13813,8 @@
1381313813
"type": "other",
1381413814
"other": {
1381513815
"name": "mysql",
13816-
"version": "8.0.36",
13817-
"downloadUrl": "https://dev.mysql.com/get/Downloads/MySQL-8.0/mysql-boost-8.0.36.tar.gz"
13816+
"version": "8.0.40",
13817+
"downloadUrl": "https://dev.mysql.com/get/Downloads/MySQL-8.0/mysql-boost-8.0.40.tar.gz"
1381813818
}
1381913819
}
1382013820
},

0 commit comments

Comments
 (0)