Skip to content

Commit 187dc78

Browse files
mbykhovtsev-msmbykhovtsev-ms
committed
Merge branch 'main' into mbykhovtsev/aug-release
2 parents 12803fd + ee3f843 commit 187dc78

File tree

89 files changed

+4069
-389
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

89 files changed

+4069
-389
lines changed

‎.pipelines/prchecks/PackageBuildPRCheck.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,6 @@ extends:
145145
maxCPU: "${{ configuration.maxCPUs }}"
146146
outputArtifactsFolder: $(ob_outputDirectory)
147147
outputRPMsTarballName: $(outputRPMsTarballName)
148-
pipArtifactFeeds: "mariner/Mariner-Pypi-Feed"
149148
selfRepoName: self
150149
testSuiteName: "[${{ configuration.name }}] Package test"
151150

@@ -204,7 +203,6 @@ extends:
204203
isUseCCache: true
205204
maxCPU: "${{ configuration.maxCPUs }}"
206205
outputArtifactsFolder: $(ob_outputDirectory)
207-
pipArtifactFeeds: "mariner/Mariner-Pypi-Feed"
208206
selfRepoName: self
209207
srpmPackList: "$(testListFromToolchain)"
210208
testRerunList: "$(testListFromToolchain)"

‎.pipelines/templates/PackageBuild.yml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -121,10 +121,6 @@ parameters:
121121
type: string
122122
default: ""
123123

124-
- name: pipArtifactFeeds
125-
type: string
126-
default: ""
127-
128124
- name: publishLogs
129125
type: boolean
130126
default: true
@@ -154,12 +150,6 @@ steps:
154150
parameters:
155151
buildRepoRoot: ${{ parameters.buildRepoRoot }}
156152

157-
- ${{ if parameters.pipArtifactFeeds }}:
158-
- task: PipAuthenticate@1
159-
inputs:
160-
artifactFeeds: "${{ parameters.pipArtifactFeeds }}"
161-
displayName: "Authenticate to custom pip artifact feeds"
162-
163153
- ${{ if parameters.customToolchainTarballName }}:
164154
- script: |
165155
toolchain_archive="$(find "${{ parameters.inputArtifactsFolder }}" -name "${{ parameters.customToolchainTarballName }}" -print -quit)"

‎.pipelines/templates/PackageTestResultsAnalysis.yml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,7 @@ parameters:
3232
default: "$(Agent.TempDirectory)"
3333

3434
steps:
35-
# TODO: the "--index-url" argument must be removed once accessing internal ADO feeds from fork PR checks is supported.
36-
- bash: pip3 install --user junit_xml==1.9 --index-url https://pypi.org/simple
37-
retryCountOnTaskFailure: 3
35+
- bash: sudo tdnf install -y python3-junit-xml
3836
displayName: "Install Python dependencies"
3937

4038
- task: PythonScript@0

‎SPECS/apache-commons-lang3/CVE-2025-48924.patch‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
From b424803abdb2bec818e4fbcb251ce031c22aca53 Mon Sep 17 00:00:00 2001
2+
From: Gary Gregory <garydgregory@gmail.com>
3+
Date: Sat, 21 Sep 2024 17:23:08 -0400
4+
Subject: [PATCH] Rewrite ClassUtils.getClass() without recursion to avoid
5+
StackOverflowError on very long inputs.
6+
7+
- This was found fuzz testing Apache Commons Text which relies on
8+
ClassUtils.
9+
- OssFuzz Issue 42522972:
10+
apache-commons-text:StringSubstitutorInterpolatorFuzzer: Security
11+
exception in org.apache.commons.lang3.ClassUtils.getClass
12+
13+
Upstream Patch Reference: https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53.patch
14+
---
15+
src/changes/changes.xml | 1 +
16+
.../org/apache/commons/lang3/ClassUtils.java | 46 +++++++++----------
17+
2 files changed, 23 insertions(+), 24 deletions(-)
18+
19+
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
20+
index 5731324..dd2577b 100644
21+
--- a/src/changes/changes.xml
22+
+++ b/src/changes/changes.xml
23+
@@ -47,6 +47,7 @@ The <action> type attribute can be add,update,fix,remove.
24+
25+
<release version="3.8.1" date="2018-09-19" description="This release is a bugfix for Restoring Bundle-SymbolicName in the MANIFEST.mf file.">
26+
<action issue="LANG-1419" type="fix" dev="chtompki">Restore BundleSymbolicName for OSGi</action>
27+
+ <action type="fix" dev="ggregory" due-to="OSS-Fuzz, Gary Gregory">Rewrite ClassUtils.getClass(...) without recursion to avoid StackOverflowError on very long inputs. OSS-Fuzz Issue 42522972: apache-commons-text:StringSubstitutorInterpolatorFuzzer: Security exception in org.apache.commons.lang3.ClassUtils.getClass.</action>
28+
</release>
29+
30+
<release version="3.8" date="2018-08-15" description="New features and bug fixes. Requires Java 7, supports Java 8, 9, 10.">
31+
diff --git a/src/main/java/org/apache/commons/lang3/ClassUtils.java b/src/main/java/org/apache/commons/lang3/ClassUtils.java
32+
index be9f0dd..a9ec195 100644
33+
--- a/src/main/java/org/apache/commons/lang3/ClassUtils.java
34+
+++ b/src/main/java/org/apache/commons/lang3/ClassUtils.java
35+
@@ -985,30 +985,27 @@ public class ClassUtils {
36+
*/
37+
public static Class<?> getClass(
38+
final ClassLoader classLoader, final String className, final boolean initialize) throws ClassNotFoundException {
39+
- try {
40+
- Class<?> clazz;
41+
- if (namePrimitiveMap.containsKey(className)) {
42+
- clazz = namePrimitiveMap.get(className);
43+
- } else {
44+
- clazz = Class.forName(toCanonicalName(className), initialize, classLoader);
45+
- }
46+
- return clazz;
47+
- } catch (final ClassNotFoundException ex) {
48+
- // allow path separators (.) as inner class name separators
49+
- final int lastDotIndex = className.lastIndexOf(PACKAGE_SEPARATOR_CHAR);
50+
-
51+
- if (lastDotIndex != -1) {
52+
- try {
53+
- return getClass(classLoader, className.substring(0, lastDotIndex) +
54+
- INNER_CLASS_SEPARATOR_CHAR + className.substring(lastDotIndex + 1),
55+
- initialize);
56+
- } catch (final ClassNotFoundException ex2) { // NOPMD
57+
- // ignore exception
58+
+ // This method was re-written to avoid recursion and stack overflows found by fuzz testing.
59+
+ String next = className;
60+
+ int lastDotIndex = -1;
61+
+ do {
62+
+ try {
63+
+ Class<?> clazz;
64+
+ if (namePrimitiveMap.containsKey(next)) {
65+
+ clazz = namePrimitiveMap.get(next);
66+
+ } else {
67+
+ clazz = Class.forName(toCanonicalName(next), initialize, classLoader);
68+
+ }
69+
+ return clazz;
70+
+ } catch (final ClassNotFoundException ex) {
71+
+ lastDotIndex = next.lastIndexOf(PACKAGE_SEPARATOR_CHAR);
72+
+ if (lastDotIndex != -1) {
73+
+ next = next.substring(0, lastDotIndex) +
74+
+ INNER_CLASS_SEPARATOR_CHAR + next.substring(lastDotIndex + 1);
75+
}
76+
}
77+
-
78+
- throw ex;
79+
- }
80+
+ } while (lastDotIndex != -1);
81+
+ throw new ClassNotFoundException(next);
82+
}
83+
84+
/**
85+
@@ -1124,9 +1121,10 @@ public class ClassUtils {
86+
private static String toCanonicalName(String className) {
87+
className = StringUtils.deleteWhitespace(className);
88+
Validate.notNull(className, "className must not be null.");
89+
- if (className.endsWith("[]")) {
90+
+ final String arrayMarker = "[]";
91+
+ if (className.endsWith(arrayMarker)) {
92+
final StringBuilder classNameBuffer = new StringBuilder();
93+
- while (className.endsWith("[]")) {
94+
+ while (className.endsWith(arrayMarker)) {
95+
className = className.substring(0, className.length() - 2);
96+
classNameBuffer.append("[");
97+
}
98+
--
99+
2.34.1
100+

‎SPECS/apache-commons-lang3/apache-commons-lang3.spec‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
Summary: Apache Commons Lang Package
1919
Name: apache-%{short_name}
2020
Version: 3.8.1
21-
Release: 5%{?dist}
21+
Release: 6%{?dist}
2222
License: Apache-2.0
2323
Vendor: Microsoft Corporation
2424
Distribution: Mariner
@@ -27,6 +27,7 @@ URL: https://commons.apache.org/proper/commons-lang
2727
Source0: https://archive.apache.org/dist/commons/lang/source/%{short_name}-%{version}-src.tar.gz
2828
Source1: build.xml
2929
Source2: default.properties
30+
Patch0: CVE-2025-48924.patch
3031
BuildRequires: ant
3132
BuildRequires: ant-junit
3233
BuildRequires: fdupes
@@ -57,7 +58,8 @@ Group: Documentation/HTML
5758
Javadoc for %{name}.
5859

5960
%prep
60-
%setup -q -n %{short_name}-%{version}-src
61+
62+
%autosetup -n %{short_name}-%{version}-src -p1
6163
cp %{SOURCE1} .
6264
cp %{SOURCE2} .
6365
sed -i 's/\r//' *.txt
@@ -98,6 +100,9 @@ cp -pr target/apidocs/* %{buildroot}%{_javadocdir}/%{name}/
98100
%{_javadocdir}/%{name}
99101

100102
%changelog
103+
* Wed Jul 16 2025 Aninda Pradhan <v-anipradhan@microsoft.com> - 3.8.1-6
104+
- Addressed CVE-2025-48924
105+
101106
* Fri Mar 17 2023 Mykhailo Bykhovtsev <mbykhovtsev@microsoft.com> - 3.8.1-5
102107
- Moved from extended to core
103108
- License verified

‎SPECS/apparmor/CVE-2023-53154.patch‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
From 1dfb03ca74b78ff4a87b48a70b91a5cfc985f9c4 Mon Sep 17 00:00:00 2001
2+
From: dj_palli <v-dpalli@microsoft.com>
3+
Date: Thu, 12 Jun 2025 20:49:56 +0000
4+
Subject: [PATCH] Address CVE-2023-53154
5+
6+
Upstream Patch Reference: https://github.com/DaveGamble/cJSON/commit/3ef4e4e730e5efd381be612df41e1ff3f5bb3c32
7+
8+
---
9+
binutils/cJSON.c | 5 +++++
10+
1 file changed, 5 insertions(+)
11+
12+
diff --git a/binutils/cJSON.c b/binutils/cJSON.c
13+
index e85ac11..45c1c45 100644
14+
--- a/binutils/cJSON.c
15+
+++ b/binutils/cJSON.c
16+
@@ -1650,6 +1650,11 @@ static cJSON_bool parse_object(cJSON * const item, parse_buffer * const input_bu
17+
current_item = new_item;
18+
}
19+
20+
+ if (cannot_access_at_index(input_buffer, 1))
21+
+ {
22+
+ goto fail; /* nothing comes after the comma */
23+
+ }
24+
+
25+
/* parse the name of the child */
26+
input_buffer->offset++;
27+
buffer_skip_whitespace(input_buffer);
28+
--
29+
2.45.2
30+

‎SPECS/apparmor/apparmor.spec‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: AppArmor is an effective and easy-to-use Linux application security system.
22
Name: apparmor
33
Version: 3.0.4
4-
Release: 4%{?dist}
4+
Release: 5%{?dist}
55
License: GPLv2
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -11,8 +11,12 @@ Source0: https://launchpad.net/apparmor/3.0/3.0.4/+download/%{name}-%{ver
1111
Patch1: apparmor-service-start-fix.patch
1212
Patch2: CVE-2023-50471.patch
1313
Patch3: CVE-2024-31755.patch
14+
Patch4: CVE-2023-53154.patch
15+
Patch5: removed_unused_global_variables_fix_test-aa.patch
16+
1417
# CVE-2016-1585 has no upstream fix as of 2020/09/28
1518
Patch100: CVE-2016-1585.nopatch
19+
1620
BuildRequires: apr
1721
BuildRequires: apr-util-devel
1822
BuildRequires: autoconf
@@ -355,6 +359,10 @@ make DESTDIR=%{buildroot} install
355359
%exclude %{perl_archlib}/perllocal.pod
356360

357361
%changelog
362+
* Fri Jun 13 2025 Durga Jagadeesh Palli <v-dpalli@microsoft.com> - 3.0.4-5
363+
- Patch CVE-2023-53154
364+
- Patch removed_unused_global_variables_fix_test-aa.patch to fix PTest failure
365+
358366
* Thu May 30 2024 Sumedh Sharma <sumsharma@microsoft.com> - 3.0.4-4
359367
- Add patch for CVE-2024-31755
360368

‎SPECS/apparmor/removed_unused_global_variables_fix_test-aa.patch‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
From 91b1b21fe68bdbcb51552cc2dc2e930da139a123 Mon Sep 17 00:00:00 2001
2+
From: dj_palli <v-dpalli@microsoft.com>
3+
Date: Thu, 10 Jul 2025 07:22:28 +0000
4+
Subject: [PATCH] Address ptest error fix
5+
6+
Description: fix the Ptest failure by removing the unused global variables in test-aa
7+
8+
---
9+
utils/apparmor/aa.py | 1 -
10+
utils/apparmor/common.py | 1 -
11+
utils/test/test-aa-easyprof.py | 1 -
12+
3 files changed, 3 deletions(-)
13+
14+
diff --git a/utils/apparmor/aa.py b/utils/apparmor/aa.py
15+
index 4ba484d..71754aa 100644
16+
--- a/utils/apparmor/aa.py
17+
+++ b/utils/apparmor/aa.py
18+
@@ -1486,7 +1486,6 @@ def set_logfile(filename):
19+
def do_logprof_pass(logmark=''):
20+
# set up variables for this pass
21+
# transitions = hasher()
22+
- global active_profiles
23+
global sev_db
24+
# aa = hasher()
25+
# changed = dict()
26+
diff --git a/utils/apparmor/common.py b/utils/apparmor/common.py
27+
index bbe2834..b4ae059 100644
28+
--- a/utils/apparmor/common.py
29+
+++ b/utils/apparmor/common.py
30+
@@ -69,7 +69,6 @@ def msg(out, output=sys.stdout):
31+
32+
def debug(out):
33+
'''Print debug message'''
34+
- global DEBUGGING
35+
if DEBUGGING:
36+
try:
37+
print("DEBUG: %s" % (out), file=sys.stderr)
38+
diff --git a/utils/test/test-aa-easyprof.py b/utils/test/test-aa-easyprof.py
39+
index d205797..9d8e51c 100755
40+
--- a/utils/test/test-aa-easyprof.py
41+
+++ b/utils/test/test-aa-easyprof.py
42+
@@ -108,7 +108,6 @@ class T(unittest.TestCase):
43+
44+
def setUp(self):
45+
'''Setup for tests'''
46+
- global topdir
47+
48+
self.tmpdir = os.path.realpath(tempfile.mkdtemp(prefix='test-aa-easyprof'))
49+
50+
--
51+
2.45.2
52+

‎SPECS/binutils/CVE-2025-7545.patch‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
From 5ea79aec8f03363778904754b75337f73be0db16 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account
3+
<azurelinux-security@microsoft.com>
4+
Date: Thu, 17 Jul 2025 08:56:14 +0000
5+
Subject: [PATCH] Fix CVE CVE-2025-7545 in binutils
6+
7+
Upstream Patch Reference: https://github.com/bminor/binutils-gdb/commit/08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944.patch
8+
---
9+
binutils/objcopy.c | 6 ++++++
10+
1 file changed, 6 insertions(+)
11+
12+
diff --git a/binutils/objcopy.c b/binutils/objcopy.c
13+
index a6c2e0dc..b9552398 100644
14+
--- a/binutils/objcopy.c
15+
+++ b/binutils/objcopy.c
16+
@@ -4438,6 +4438,7 @@ copy_section (bfd *ibfd, sec_ptr isection, void *obfdarg)
17+
char *to = (char *) memhunk;
18+
char *end = (char *) memhunk + size;
19+
int i;
20+
+ bfd_size_type memhunk_size = size;
21+
22+
/* If the section address is not exactly divisible by the interleave,
23+
then we must bias the from address. If the copy_byte is less than
24+
@@ -4457,6 +4458,11 @@ copy_section (bfd *ibfd, sec_ptr isection, void *obfdarg)
25+
}
26+
27+
size = (size + interleave - 1 - copy_byte) / interleave * copy_width;
28+
+
29+
+ /* Don't extend the output section size. */
30+
+ if (size > memhunk_size)
31+
+ size = memhunk_size;
32+
+
33+
osection->lma /= interleave;
34+
if (copy_byte < extra)
35+
osection->lma++;
36+
--
37+
2.45.3
38+

‎SPECS/binutils/CVE-2025-7546.patch‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
From 41461010eb7c79fee7a9d5f6209accdaac66cc6b Mon Sep 17 00:00:00 2001
2+
From: "H.J. Lu" <hjl.tools@gmail.com>
3+
Date: Sat, 21 Jun 2025 06:52:00 +0800
4+
Subject: [PATCH] elf: Report corrupted group section
5+
6+
Report corrupted group section instead of trying to recover.
7+
8+
PR binutils/33050
9+
* elf.c (bfd_elf_set_group_contents): Report corrupted group
10+
section.
11+
12+
Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
13+
14+
[AI Backported] Upstream Patch Reference: https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b
15+
---
16+
bfd/elf.c | 12 +++++++++++-
17+
1 file changed, 11 insertions(+), 1 deletion(-)
18+
19+
diff --git a/bfd/elf.c b/bfd/elf.c
20+
index 05bb9c99..4fc0a65e 100644
21+
--- a/bfd/elf.c
22+
+++ b/bfd/elf.c
23+
@@ -3633,8 +3633,18 @@ bfd_elf_set_group_contents (bfd *abfd, asection *sec, void *failedptrarg)
24+
break;
25+
}
26+
27+
+ /* We should always get here with loc == sec->contents + 4. Return
28+
+ an error for bogus SHT_GROUP sections. */
29+
loc -= 4;
30+
- BFD_ASSERT (loc == sec->contents);
31+
+ if (loc != sec->contents)
32+
+ {
33+
+ /* xgettext:c-format */
34+
+ _bfd_error_handler (_("%pB: corrupted group section: `%pA'"),
35+
+ abfd, sec);
36+
+ bfd_set_error (bfd_error_bad_value);
37+
+ *failedptr = true;
38+
+ return;
39+
+ }
40+
41+
H_PUT_32 (abfd, sec->flags & SEC_LINK_ONCE ? GRP_COMDAT : 0, loc);
42+
}
43+
--
44+
2.45.3
45+

0 commit comments

Comments
 (0)