Skip to content

Commit a8af320

Browse files
xorduxCBL-Mariner-Bot
xordux
authored and
CBL-Mariner-Bot
committed
Fix CVE-2024-45338 in multiple packages (#11767)
Co-authored-by: jslobodzian <[email protected]> (cherry picked from commit fa62dba)
1 parent 24d1355 commit a8af320

38 files changed

+1302
-26
lines changed

‎SPECS/application-gateway-kubernetes-ingress/CVE-2024-45338.patch

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From 16acb322637a8ee779fa757345d7aef0ac16e69e Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Thu, 2 Jan 2025 10:22:13 +0000
4+
Subject: [PATCH] Fix CVE CVE-2024-45338 in
5+
application-gateway-kubernetes-ingress
6+
7+
---
8+
vendor/golang.org/x/net/html/doctype.go | 2 +-
9+
vendor/golang.org/x/net/html/foreign.go | 3 +--
10+
vendor/golang.org/x/net/html/parse.go | 4 ++--
11+
3 files changed, 4 insertions(+), 5 deletions(-)
12+
13+
diff --git a/vendor/golang.org/x/net/html/doctype.go b/vendor/golang.org/x/net/html/doctype.go
14+
index c484e5a..bca3ae9 100644
15+
--- a/vendor/golang.org/x/net/html/doctype.go
16+
+++ b/vendor/golang.org/x/net/html/doctype.go
17+
@@ -87,7 +87,7 @@ func parseDoctype(s string) (n *Node, quirks bool) {
18+
}
19+
}
20+
if lastAttr := n.Attr[len(n.Attr)-1]; lastAttr.Key == "system" &&
21+
- strings.ToLower(lastAttr.Val) == "http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd" {
22+
+ strings.EqualFold(lastAttr.Val, "http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd") {
23+
quirks = true
24+
}
25+
}
26+
diff --git a/vendor/golang.org/x/net/html/foreign.go b/vendor/golang.org/x/net/html/foreign.go
27+
index 9da9e9d..e8515d8 100644
28+
--- a/vendor/golang.org/x/net/html/foreign.go
29+
+++ b/vendor/golang.org/x/net/html/foreign.go
30+
@@ -40,8 +40,7 @@ func htmlIntegrationPoint(n *Node) bool {
31+
if n.Data == "annotation-xml" {
32+
for _, a := range n.Attr {
33+
if a.Key == "encoding" {
34+
- val := strings.ToLower(a.Val)
35+
- if val == "text/html" || val == "application/xhtml+xml" {
36+
+ if strings.EqualFold(a.Val, "text/html") || strings.EqualFold(a.Val, "application/xhtml+xml") {
37+
return true
38+
}
39+
}
40+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
41+
index 291c919..d93fe03 100644
42+
--- a/vendor/golang.org/x/net/html/parse.go
43+
+++ b/vendor/golang.org/x/net/html/parse.go
44+
@@ -1031,7 +1031,7 @@ func inBodyIM(p *parser) bool {
45+
if p.tok.DataAtom == a.Input {
46+
for _, t := range p.tok.Attr {
47+
if t.Key == "type" {
48+
- if strings.ToLower(t.Val) == "hidden" {
49+
+ if strings.EqualFold(t.Val, "hidden") {
50+
// Skip setting framesetOK = false
51+
return true
52+
}
53+
@@ -1459,7 +1459,7 @@ func inTableIM(p *parser) bool {
54+
return inHeadIM(p)
55+
case a.Input:
56+
for _, t := range p.tok.Attr {
57+
- if t.Key == "type" && strings.ToLower(t.Val) == "hidden" {
58+
+ if t.Key == "type" && strings.EqualFold(t.Val, "hidden") {
59+
p.addElement()
60+
p.oe.pop()
61+
return true
62+
--
63+
2.39.4
64+

‎SPECS/application-gateway-kubernetes-ingress/application-gateway-kubernetes-ingress.spec

+6-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Application Gateway Ingress Controller
33
Name: application-gateway-kubernetes-ingress
44
Version: 1.7.2
5-
Release: 2%{?dist}
5+
Release: 3%{?dist}
66
License: MIT
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
@@ -25,6 +25,7 @@ Source0: https://github.com/Azure/application-gateway-kubernetes-ingress/
2525
Source1: %{name}-%{version}-vendor.tar.gz
2626
Patch0: CVE-2022-21698.patch
2727
Patch1: CVE-2022-41273.patch
28+
Patch2: CVE-2024-45338.patch
2829

2930
BuildRequires: golang >= 1.13
3031

@@ -39,6 +40,7 @@ rm -rf vendor
3940
tar -xf %{SOURCE1} --no-same-owner
4041
%patch 0 -p1 -d vendor/github.com/prometheus/client_golang
4142
%patch 1 -p1 -d vendor/golang.org/x/net
43+
%patch 2 -p1
4244

4345
%build
4446
export VERSION=%{version}
@@ -57,6 +59,9 @@ cp appgw-ingress %{buildroot}%{_bindir}/
5759
%{_bindir}/appgw-ingress
5860

5961
%changelog
62+
* Tue Dec 31 2024 Rohit Rawat <[email protected]> - 1.7.2-3
63+
- Add patch for CVE-2024-45338
64+
6065
* Thu Jul 11 2024 Thien Trung Vuong <[email protected]> - 1.7.2-2
6166
- Add patch for CVE-2022-21698, CVE-2022-41273
6267
- Move vendored tarball extraction into %prep and %changed from %autosetup to %setup

‎SPECS/cert-manager/CVE-2024-45338.patch

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
From bda2595d9dbcd7805b5b78466753b9d1849945d2 Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Thu, 2 Jan 2025 10:22:12 +0000
4+
Subject: [PATCH] Fix CVE CVE-2024-45338 in cert-manager
5+
6+
---
7+
cmd/ctl/vendor/golang.org/x/net/html/doctype.go | 2 +-
8+
cmd/ctl/vendor/golang.org/x/net/html/foreign.go | 3 +--
9+
cmd/ctl/vendor/golang.org/x/net/html/parse.go | 4 ++--
10+
3 files changed, 4 insertions(+), 5 deletions(-)
11+
12+
diff --git a/cmd/ctl/vendor/golang.org/x/net/html/doctype.go b/cmd/ctl/vendor/golang.org/x/net/html/doctype.go
13+
index c484e5a..bca3ae9 100644
14+
--- a/cmd/ctl/vendor/golang.org/x/net/html/doctype.go
15+
+++ b/cmd/ctl/vendor/golang.org/x/net/html/doctype.go
16+
@@ -87,7 +87,7 @@ func parseDoctype(s string) (n *Node, quirks bool) {
17+
}
18+
}
19+
if lastAttr := n.Attr[len(n.Attr)-1]; lastAttr.Key == "system" &&
20+
- strings.ToLower(lastAttr.Val) == "http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd" {
21+
+ strings.EqualFold(lastAttr.Val, "http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd") {
22+
quirks = true
23+
}
24+
}
25+
diff --git a/cmd/ctl/vendor/golang.org/x/net/html/foreign.go b/cmd/ctl/vendor/golang.org/x/net/html/foreign.go
26+
index 9da9e9d..e8515d8 100644
27+
--- a/cmd/ctl/vendor/golang.org/x/net/html/foreign.go
28+
+++ b/cmd/ctl/vendor/golang.org/x/net/html/foreign.go
29+
@@ -40,8 +40,7 @@ func htmlIntegrationPoint(n *Node) bool {
30+
if n.Data == "annotation-xml" {
31+
for _, a := range n.Attr {
32+
if a.Key == "encoding" {
33+
- val := strings.ToLower(a.Val)
34+
- if val == "text/html" || val == "application/xhtml+xml" {
35+
+ if strings.EqualFold(a.Val, "text/html") || strings.EqualFold(a.Val, "application/xhtml+xml") {
36+
return true
37+
}
38+
}
39+
diff --git a/cmd/ctl/vendor/golang.org/x/net/html/parse.go b/cmd/ctl/vendor/golang.org/x/net/html/parse.go
40+
index 46a89ed..5b8374b 100644
41+
--- a/cmd/ctl/vendor/golang.org/x/net/html/parse.go
42+
+++ b/cmd/ctl/vendor/golang.org/x/net/html/parse.go
43+
@@ -1031,7 +1031,7 @@ func inBodyIM(p *parser) bool {
44+
if p.tok.DataAtom == a.Input {
45+
for _, t := range p.tok.Attr {
46+
if t.Key == "type" {
47+
- if strings.ToLower(t.Val) == "hidden" {
48+
+ if strings.EqualFold(t.Val, "hidden") {
49+
// Skip setting framesetOK = false
50+
return true
51+
}
52+
@@ -1459,7 +1459,7 @@ func inTableIM(p *parser) bool {
53+
return inHeadIM(p)
54+
case a.Input:
55+
for _, t := range p.tok.Attr {
56+
- if t.Key == "type" && strings.ToLower(t.Val) == "hidden" {
57+
+ if t.Key == "type" && strings.EqualFold(t.Val, "hidden") {
58+
p.addElement()
59+
p.oe.pop()
60+
return true
61+
--
62+
2.39.4
63+

‎SPECS/cert-manager/cert-manager.spec

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Automatically provision and manage TLS certificates in Kubernetes
22
Name: cert-manager
33
Version: 1.12.13
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: ASL 2.0
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -14,6 +14,7 @@ Source0: https://github.com/jetstack/%{name}/archive/refs/tags/v%{version
1414
# 2. <repo-root>/SPECS/cert-manager/generate_source_tarball.sh --srcTarball %%{name}-%%{version}.tar.gz --pkgVersion %%{version}
1515
Source1: %{name}-%{version}-vendor.tar.gz
1616
Patch0: CVE-2024-45337.patch
17+
Patch1: CVE-2024-45338.patch
1718
BuildRequires: golang
1819
Requires: %{name}-acmesolver
1920
Requires: %{name}-cainjector
@@ -104,6 +105,9 @@ install -D -m0755 bin/webhook %{buildroot}%{_bindir}/
104105
%{_bindir}/webhook
105106

106107
%changelog
108+
* Tue Dec 31 2024 Rohit Rawat <[email protected]> - 1.12.13-3
109+
- Add patch for CVE-2024-45338
110+
107111
* Wed Jan 08 2025 Muhammad Falak <[email protected]> - 1.12.13-2
108112
- Patch CVE-2024-45337
109113

‎SPECS/cf-cli/CVE-2024-45338.patch

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
From 0d84094c36cc3a80da129773b966a3d5be4032ac Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Thu, 2 Jan 2025 10:22:13 +0000
4+
Subject: [PATCH] Fix CVE CVE-2024-45338 in cf-cli
5+
6+
---
7+
vendor/golang.org/x/net/html/doctype.go | 2 +-
8+
vendor/golang.org/x/net/html/foreign.go | 3 +--
9+
vendor/golang.org/x/net/html/parse.go | 4 ++--
10+
3 files changed, 4 insertions(+), 5 deletions(-)
11+
12+
diff --git a/vendor/golang.org/x/net/html/doctype.go b/vendor/golang.org/x/net/html/doctype.go
13+
index c484e5a..bca3ae9 100644
14+
--- a/vendor/golang.org/x/net/html/doctype.go
15+
+++ b/vendor/golang.org/x/net/html/doctype.go
16+
@@ -87,7 +87,7 @@ func parseDoctype(s string) (n *Node, quirks bool) {
17+
}
18+
}
19+
if lastAttr := n.Attr[len(n.Attr)-1]; lastAttr.Key == "system" &&
20+
- strings.ToLower(lastAttr.Val) == "http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd" {
21+
+ strings.EqualFold(lastAttr.Val, "http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd") {
22+
quirks = true
23+
}
24+
}
25+
diff --git a/vendor/golang.org/x/net/html/foreign.go b/vendor/golang.org/x/net/html/foreign.go
26+
index 9da9e9d..e8515d8 100644
27+
--- a/vendor/golang.org/x/net/html/foreign.go
28+
+++ b/vendor/golang.org/x/net/html/foreign.go
29+
@@ -40,8 +40,7 @@ func htmlIntegrationPoint(n *Node) bool {
30+
if n.Data == "annotation-xml" {
31+
for _, a := range n.Attr {
32+
if a.Key == "encoding" {
33+
- val := strings.ToLower(a.Val)
34+
- if val == "text/html" || val == "application/xhtml+xml" {
35+
+ if strings.EqualFold(a.Val, "text/html") || strings.EqualFold(a.Val, "application/xhtml+xml") {
36+
return true
37+
}
38+
}
39+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
40+
index 46a89ed..5b8374b 100644
41+
--- a/vendor/golang.org/x/net/html/parse.go
42+
+++ b/vendor/golang.org/x/net/html/parse.go
43+
@@ -1031,7 +1031,7 @@ func inBodyIM(p *parser) bool {
44+
if p.tok.DataAtom == a.Input {
45+
for _, t := range p.tok.Attr {
46+
if t.Key == "type" {
47+
- if strings.ToLower(t.Val) == "hidden" {
48+
+ if strings.EqualFold(t.Val, "hidden") {
49+
// Skip setting framesetOK = false
50+
return true
51+
}
52+
@@ -1459,7 +1459,7 @@ func inTableIM(p *parser) bool {
53+
return inHeadIM(p)
54+
case a.Input:
55+
for _, t := range p.tok.Attr {
56+
- if t.Key == "type" && strings.ToLower(t.Val) == "hidden" {
57+
+ if t.Key == "type" && strings.EqualFold(t.Val, "hidden") {
58+
p.addElement()
59+
p.oe.pop()
60+
return true
61+
--
62+
2.39.4
63+

‎SPECS/cf-cli/cf-cli.spec

+6-4
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ Summary: The official command line client for Cloud Foundry.
55
Name: cf-cli
66
# Note: Upgrading the package also warrants an upgrade in the CF_BUILD_SHA
77
Version: 8.7.3
8-
Release: 4%{?dist}
8+
Release: 5%{?dist}
99
License: Apache-2.0
1010
Vendor: Microsoft Corporation
1111
Distribution: Azure Linux
@@ -34,6 +34,7 @@ Source1: cli-%{version}-vendor.tar.gz
3434
Patch0: CVE-2023-39325.patch
3535
Patch1: CVE-2024-24786.patch
3636
Patch2: CVE-2024-45337.patch
37+
Patch3: CVE-2024-45338.patch
3738

3839
BuildRequires: golang >= 1.18.3
3940
%global debug_package %{nil}
@@ -45,9 +46,7 @@ The official command line client for Cloud Foundry.
4546
%prep
4647
%setup -q -n cli-%{version}
4748
tar --no-same-owner -xf %{SOURCE1}
48-
%patch 0 -p1
49-
%patch 1 -p1
50-
%patch 2 -p1
49+
%autopatch -p1
5150

5251
%build
5352
export GOPATH=%{our_gopath}
@@ -69,6 +68,9 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./out/cf
6968
%{_bindir}/cf
7069

7170
%changelog
71+
* Tue Dec 31 2024 Rohit Rawat <[email protected]> - 8.7.3-5
72+
- Add patch for CVE-2024-45338
73+
7274
* Fri Dec 20 2024 Aurelien Bombo <[email protected]> - 8.7.3-4
7375
- Add patch for CVE-2024-45337
7476

‎SPECS/containerized-data-importer/CVE-2024-45338.patch

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
From 0c0cb82a7671b2aa12c5136ab9368245e3803985 Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Thu, 2 Jan 2025 10:22:13 +0000
4+
Subject: [PATCH] Fix CVE CVE-2024-45338 in containerized-data-importer
5+
6+
---
7+
.../vendor/golang.org/x/net/html/doctype.go | 2 +-
8+
.../vendor/golang.org/x/net/html/foreign.go | 3 +--
9+
.../vendor/golang.org/x/net/html/parse.go | 4 ++--
10+
3 files changed, 4 insertions(+), 5 deletions(-)
11+
12+
diff --git a/vendor/golang.org/x/net/html/doctype.go b/vendor/golang.org/x/net/html/doctype.go
13+
index c484e5a..bca3ae9 100644
14+
--- a/vendor/golang.org/x/net/html/doctype.go
15+
+++ b/vendor/golang.org/x/net/html/doctype.go
16+
@@ -87,7 +87,7 @@ func parseDoctype(s string) (n *Node, quirks bool) {
17+
}
18+
}
19+
if lastAttr := n.Attr[len(n.Attr)-1]; lastAttr.Key == "system" &&
20+
- strings.ToLower(lastAttr.Val) == "http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd" {
21+
+ strings.EqualFold(lastAttr.Val, "http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd") {
22+
quirks = true
23+
}
24+
}
25+
diff --git a/vendor/golang.org/x/net/html/foreign.go b/vendor/golang.org/x/net/html/foreign.go
26+
index 9da9e9d..e8515d8 100644
27+
--- a/vendor/golang.org/x/net/html/foreign.go
28+
+++ b/vendor/golang.org/x/net/html/foreign.go
29+
@@ -40,8 +40,7 @@ func htmlIntegrationPoint(n *Node) bool {
30+
if n.Data == "annotation-xml" {
31+
for _, a := range n.Attr {
32+
if a.Key == "encoding" {
33+
- val := strings.ToLower(a.Val)
34+
- if val == "text/html" || val == "application/xhtml+xml" {
35+
+ if strings.EqualFold(a.Val, "text/html") || strings.EqualFold(a.Val, "application/xhtml+xml") {
36+
return true
37+
}
38+
}
39+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
40+
index 46a89ed..5b8374b 100644
41+
--- a/vendor/golang.org/x/net/html/parse.go
42+
+++ b/vendor/golang.org/x/net/html/parse.go
43+
@@ -1031,7 +1031,7 @@ func inBodyIM(p *parser) bool {
44+
if p.tok.DataAtom == a.Input {
45+
for _, t := range p.tok.Attr {
46+
if t.Key == "type" {
47+
- if strings.ToLower(t.Val) == "hidden" {
48+
+ if strings.EqualFold(t.Val, "hidden") {
49+
// Skip setting framesetOK = false
50+
return true
51+
}
52+
@@ -1459,7 +1459,7 @@ func inTableIM(p *parser) bool {
53+
return inHeadIM(p)
54+
case a.Input:
55+
for _, t := range p.tok.Attr {
56+
- if t.Key == "type" && strings.ToLower(t.Val) == "hidden" {
57+
+ if t.Key == "type" && strings.EqualFold(t.Val, "hidden") {
58+
p.addElement()
59+
p.oe.pop()
60+
return true
61+
--
62+
2.39.4
63+

‎SPECS/containerized-data-importer/containerized-data-importer.spec

+5-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
Summary: Container native virtualization
1919
Name: containerized-data-importer
2020
Version: 1.57.0
21-
Release: 6%{?dist}
21+
Release: 7%{?dist}
2222
License: ASL 2.0
2323
Vendor: Microsoft Corporation
2424
Distribution: Azure Linux
@@ -28,6 +28,7 @@ Source0: https://github.com/kubevirt/containerized-data-importer/archive/
2828
Patch0: CVE-2024-3727.patch
2929
Patch1: CVE-2022-2879.patch
3030
Patch2: CVE-2024-24786.patch
31+
Patch3: CVE-2024-45338.patch
3132
BuildRequires: golang
3233
BuildRequires: golang-packaging
3334
BuildRequires: libnbd-devel
@@ -222,6 +223,9 @@ install -m 0644 _out/manifests/release/cdi-cr.yaml %{buildroot}%{_datadir}/cdi/m
222223
%{_datadir}/cdi/manifests
223224

224225
%changelog
226+
* Tue Dec 31 2024 Rohit Rawat <[email protected]> - 1.57.0-7
227+
- Add patch for CVE-2024-45338
228+
225229
* Mon Nov 25 2024 Bala <[email protected]> - 1.57.0-6
226230
- Fix CVE-2024-24786
227231

0 commit comments

Comments
 (0)