[MEDIUM] patch cmake for CVE-2025-4947 (microsoft#13959)

Author: durgajagadeesh

SPECS/cmake/CVE-2025-4947.patch

@@ -0,0 +1,40 @@
+From f0b4659205da774d835434cfbf40425c25a0c813 Mon Sep 17 00:00:00 2001
+From: dj_palli <v-dpalli@microsoft.com>
+Date: Wed, 4 Jun 2025 03:37:55 +0000
+Subject: [PATCH] Address  CVE-2025-4947.patch
+
+Upstream patch URL: https://github.com/curl/curl/commit/a85f1df4803bbd272905c9e7125
+
+---
+ Utilities/cmcurl/lib/vquic/vquic-tls.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/Utilities/cmcurl/lib/vquic/vquic-tls.c b/Utilities/cmcurl/lib/vquic/vquic-tls.c
+index aca18b45..61cb6c51 100644
+--- a/Utilities/cmcurl/lib/vquic/vquic-tls.c
++++ b/Utilities/cmcurl/lib/vquic/vquic-tls.c
+@@ -324,15 +324,13 @@ CURLcode Curl_vquic_tls_verify_peer(struct curl_tls_ctx *ctx,
+ #elif defined(USE_WOLFSSL)
+   (void)data;
+   if(conn_config->verifyhost) {
+-    if(peer->sni) {
+-      WOLFSSL_X509* cert = wolfSSL_get_peer_certificate(ctx->ssl);
+-      if(wolfSSL_X509_check_host(cert, peer->sni, strlen(peer->sni), 0, NULL)
+-            == WOLFSSL_FAILURE) {
+-        result = CURLE_PEER_FAILED_VERIFICATION;
+-      }
+-      wolfSSL_X509_free(cert);
++    char *snihost = peer->sni ? peer->sni : peer->hostname;
++    WOLFSSL_X509* cert = wolfSSL_get_peer_certificate(ctx->wssl.ssl);
++    if(wolfSSL_X509_check_host(cert, snihost, strlen(snihost), 0, NULL)
++          == WOLFSSL_FAILURE) {
++      result = CURLE_PEER_FAILED_VERIFICATION;
+     }
+-
++    wolfSSL_X509_free(cert);
+   }
+ #endif
+   return result;
+-- 
+2.45.2
+

SPECS/cmake/cmake.spec

@@ -2,7 +2,7 @@
 Summary:        Cmake
 Name:           cmake
 Version:        3.30.3
-Release:        6%{?dist}
+Release:        7%{?dist}
 License:        BSD AND LGPLv2+
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -26,6 +26,7 @@ Patch7:         CVE-2023-44487.patch
 # required to determine what upstream patches are included.
 Patch8:         CVE-2023-35945.patch
 Patch9:		CVE-2024-48615.patch
+Patch10:	CVE-2025-4947.patch
 BuildRequires:  bzip2
 BuildRequires:  bzip2-devel
 BuildRequires:  curl
@@ -105,6 +106,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
 %{_libdir}/rpm/macros.d/macros.cmake
 
 %changelog
+* Tue Jun 03 2025 Durga Jagadeesh Palli <v-dpalli@microsoft.com> - 3.30.3-7
+- Patch CVE-2025-4947
+
 * Mon Apr 07 2025 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> - 3.30.3-6
 - Backport patch to fix CVE-2024-48615
 

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -51,8 +51,8 @@ check-debuginfo-0.15.2-1.azl3.aarch64.rpm
 chkconfig-1.25-1.azl3.aarch64.rpm
 chkconfig-debuginfo-1.25-1.azl3.aarch64.rpm
 chkconfig-lang-1.25-1.azl3.aarch64.rpm
-cmake-3.30.3-6.azl3.aarch64.rpm
-cmake-debuginfo-3.30.3-6.azl3.aarch64.rpm
+cmake-3.30.3-7.azl3.aarch64.rpm
+cmake-debuginfo-3.30.3-7.azl3.aarch64.rpm
 coreutils-9.4-6.azl3.aarch64.rpm
 coreutils-debuginfo-9.4-6.azl3.aarch64.rpm
 coreutils-lang-9.4-6.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -54,8 +54,8 @@ check-debuginfo-0.15.2-1.azl3.x86_64.rpm
 chkconfig-1.25-1.azl3.x86_64.rpm
 chkconfig-debuginfo-1.25-1.azl3.x86_64.rpm
 chkconfig-lang-1.25-1.azl3.x86_64.rpm
-cmake-3.30.3-6.azl3.x86_64.rpm
-cmake-debuginfo-3.30.3-6.azl3.x86_64.rpm
+cmake-3.30.3-7.azl3.x86_64.rpm
+cmake-debuginfo-3.30.3-7.azl3.x86_64.rpm
 coreutils-9.4-6.azl3.x86_64.rpm
 coreutils-debuginfo-9.4-6.azl3.x86_64.rpm
 coreutils-lang-9.4-6.azl3.x86_64.rpm