Skip to content

Commit 01d07b1

Browse files
akhila-gurujuakhila-guruju
authored
[Medium] Patch influxdb for CVE-2025-11065 (#15718)
1 parent 633ab0b commit 01d07b1

2 files changed

Lines changed: 213 additions & 1 deletion

File tree

‎SPECS/influxdb/CVE-2025-11065.patch‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
From 742921c9ba2854d27baa64272487fc5075d2c39c Mon Sep 17 00:00:00 2001
2+
From: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
3+
Date: Sat, 12 Jul 2025 07:25:50 +0200
4+
Subject: [PATCH] fix: error message leaks
5+
6+
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
7+
8+
Upstream Patch reference: https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c.patch
9+
---
10+
.../mitchellh/mapstructure/decode_hooks.go | 12 ++-
11+
.../mitchellh/mapstructure/error.go | 90 +++++++++++++++++++
12+
.../mitchellh/mapstructure/mapstructure.go | 8 +-
13+
3 files changed, 102 insertions(+), 8 deletions(-)
14+
15+
diff --git a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
16+
index 1f0abc6..4f70b03 100644
17+
--- a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
18+
+++ b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
19+
@@ -113,7 +113,9 @@ func StringToTimeDurationHookFunc() DecodeHookFunc {
20+
}
21+
22+
// Convert it by parsing
23+
- return time.ParseDuration(data.(string))
24+
+ d, err := time.ParseDuration(data.(string))
25+
+
26+
+ return d, wrapTimeParseDurationError(err)
27+
}
28+
}
29+
30+
@@ -134,7 +136,7 @@ func StringToIPHookFunc() DecodeHookFunc {
31+
// Convert it by parsing
32+
ip := net.ParseIP(data.(string))
33+
if ip == nil {
34+
- return net.IP{}, fmt.Errorf("failed parsing ip %v", data)
35+
+ return net.IP{}, fmt.Errorf("failed parsing ip")
36+
}
37+
38+
return ip, nil
39+
@@ -157,7 +159,7 @@ func StringToIPNetHookFunc() DecodeHookFunc {
40+
41+
// Convert it by parsing
42+
_, net, err := net.ParseCIDR(data.(string))
43+
- return net, err
44+
+ return net, wrapNetParseError(err)
45+
}
46+
}
47+
48+
@@ -176,7 +178,9 @@ func StringToTimeHookFunc(layout string) DecodeHookFunc {
49+
}
50+
51+
// Convert it by parsing
52+
- return time.Parse(layout, data.(string))
53+
+ ti, err := time.Parse(layout, data.(string))
54+
+
55+
+ return ti, wrapTimeParseError(err)
56+
}
57+
}
58+
59+
diff --git a/vendor/github.com/mitchellh/mapstructure/error.go b/vendor/github.com/mitchellh/mapstructure/error.go
60+
index 47a99e5..c5ac764 100644
61+
--- a/vendor/github.com/mitchellh/mapstructure/error.go
62+
+++ b/vendor/github.com/mitchellh/mapstructure/error.go
63+
@@ -3,8 +3,11 @@ package mapstructure
64+
import (
65+
"errors"
66+
"fmt"
67+
+ "net"
68+
"sort"
69+
+ "strconv"
70+
"strings"
71+
+ "time"
72+
)
73+
74+
// Error implements the error interface and can represents multiple
75+
@@ -48,3 +51,90 @@ func appendErrors(errors []string, err error) []string {
76+
return append(errors, e.Error())
77+
}
78+
}
79+
+
80+
+func wrapStrconvNumError(err error) error {
81+
+ if err == nil {
82+
+ return nil
83+
+ }
84+
+
85+
+ if err, ok := err.(*strconv.NumError); ok {
86+
+ return &strconvNumError{Err: err}
87+
+ }
88+
+
89+
+ return err
90+
+}
91+
+
92+
+type strconvNumError struct {
93+
+ Err *strconv.NumError
94+
+}
95+
+
96+
+func (e *strconvNumError) Error() string {
97+
+ return "strconv." + e.Err.Func + ": " + e.Err.Err.Error()
98+
+}
99+
+
100+
+func (e *strconvNumError) Unwrap() error { return e.Err }
101+
+
102+
+func wrapNetParseError(err error) error {
103+
+ if err == nil {
104+
+ return nil
105+
+ }
106+
+
107+
+ if err, ok := err.(*net.ParseError); ok {
108+
+ return &netParseError{Err: err}
109+
+ }
110+
+
111+
+ return err
112+
+}
113+
+
114+
+type netParseError struct {
115+
+ Err *net.ParseError
116+
+}
117+
+
118+
+func (e *netParseError) Error() string {
119+
+ return "invalid " + e.Err.Type
120+
+}
121+
+
122+
+func (e *netParseError) Unwrap() error { return e.Err }
123+
+
124+
+func wrapTimeParseError(err error) error {
125+
+ if err == nil {
126+
+ return nil
127+
+ }
128+
+
129+
+ if err, ok := err.(*time.ParseError); ok {
130+
+ return &timeParseError{Err: err}
131+
+ }
132+
+
133+
+ return err
134+
+}
135+
+
136+
+type timeParseError struct {
137+
+ Err *time.ParseError
138+
+}
139+
+
140+
+func (e *timeParseError) Error() string {
141+
+ if e.Err.Message == "" {
142+
+ return fmt.Sprintf("parsing time as %q: cannot parse as %q", e.Err.Layout, e.Err.LayoutElem)
143+
+ }
144+
+
145+
+ return "parsing time " + e.Err.Message
146+
+}
147+
+
148+
+func (e *timeParseError) Unwrap() error { return e.Err }
149+
+
150+
+func wrapTimeParseDurationError(err error) error {
151+
+ if err == nil {
152+
+ return nil
153+
+ }
154+
+
155+
+ errMsg := err.Error()
156+
+ if strings.HasPrefix(errMsg, "time: unknown unit ") {
157+
+ return errors.New("time: unknown unit")
158+
+ } else if strings.HasPrefix(errMsg, "time: ") {
159+
+ idx := strings.LastIndex(errMsg, " ")
160+
+
161+
+ return errors.New(errMsg[:idx])
162+
+ }
163+
+
164+
+ return err
165+
+}
166+
diff --git a/vendor/github.com/mitchellh/mapstructure/mapstructure.go b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
167+
index 256ee63..8ef71ad 100644
168+
--- a/vendor/github.com/mitchellh/mapstructure/mapstructure.go
169+
+++ b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
170+
@@ -416,7 +416,7 @@ func (d *Decoder) decodeInt(name string, data interface{}, val reflect.Value) er
171+
if err == nil {
172+
val.SetInt(i)
173+
} else {
174+
- return fmt.Errorf("cannot parse '%s' as int: %s", name, err)
175+
+ return fmt.Errorf("cannot parse '%s' as int: %s", name, wrapStrconvNumError(err))
176+
}
177+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
178+
jn := data.(json.Number)
179+
@@ -467,7 +467,7 @@ func (d *Decoder) decodeUint(name string, data interface{}, val reflect.Value) e
180+
if err == nil {
181+
val.SetUint(i)
182+
} else {
183+
- return fmt.Errorf("cannot parse '%s' as uint: %s", name, err)
184+
+ return fmt.Errorf("cannot parse '%s' as uint: %s", name, wrapStrconvNumError(err))
185+
}
186+
default:
187+
return fmt.Errorf(
188+
@@ -498,7 +498,7 @@ func (d *Decoder) decodeBool(name string, data interface{}, val reflect.Value) e
189+
} else if dataVal.String() == "" {
190+
val.SetBool(false)
191+
} else {
192+
- return fmt.Errorf("cannot parse '%s' as bool: %s", name, err)
193+
+ return fmt.Errorf("cannot parse '%s' as bool: %s", name, wrapStrconvNumError(err))
194+
}
195+
default:
196+
return fmt.Errorf(
197+
@@ -532,7 +532,7 @@ func (d *Decoder) decodeFloat(name string, data interface{}, val reflect.Value)
198+
if err == nil {
199+
val.SetFloat(f)
200+
} else {
201+
- return fmt.Errorf("cannot parse '%s' as float: %s", name, err)
202+
+ return fmt.Errorf("cannot parse '%s' as float: %s", name, wrapStrconvNumError(err))
203+
}
204+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
205+
jn := data.(json.Number)
206+
--
207+
2.43.0
208+

‎SPECS/influxdb/influxdb.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
Summary: Scalable datastore for metrics, events, and real-time analytics
1919
Name: influxdb
2020
Version: 2.6.1
21-
Release: 28%{?dist}
21+
Release: 29%{?dist}
2222
License: MIT
2323
Vendor: Microsoft Corporation
2424
Distribution: Mariner
@@ -65,6 +65,7 @@ Patch6: CVE-2025-22870.patch
6565
Patch7: CVE-2024-51744.patch
6666
Patch8: CVE-2025-10543.patch
6767
Patch9: CVE-2025-65637.patch
68+
Patch10: CVE-2025-11065.patch
6869
BuildRequires: clang
6970
BuildRequires: golang <= 1.18.8
7071
BuildRequires: kernel-headers
@@ -154,6 +155,9 @@ go test ./...
154155
%{_tmpfilesdir}/influxdb.conf
155156

156157
%changelog
158+
* Wed Feb 04 2026 Akhila Guruju <v-guakhila@microsoft.com> - 2.6.1-29
159+
- Patch CVE-2025-11065
160+
157161
* Tue Jan 06 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.6.1-28
158162
- Patch for CVE-2025-65637
159163

0 commit comments

Comments
 (0)