[Cherry-Pick] Fix CVE-2022-32149 in application-gateway-kubernetes-ingress (#10274) (#10376)

Co-authored-by: sindhu-karri <33163197+sindhu-karri@users.noreply.github.com>

Author: rikenm1

SPECS/application-gateway-kubernetes-ingress/CVE-2022-32149.patch

@@ -0,0 +1,35 @@
+From 7ee36713a66401f828dfe476196ca290f7c23ffe Mon Sep 17 00:00:00 2001
+From: Sindhu Karri <lakarri@microsoft.com>
+Date: Wed, 28 Aug 2024 05:01:17 +0000
+Subject: [PATCH] Fix CVE-2022-32149
+
+---
+ vendor/golang.org/x/text/language/parse.go | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/vendor/golang.org/x/text/language/parse.go b/vendor/golang.org/x/text/language/parse.go
+index 11acfd8..11d11f4 100644
+--- a/vendor/golang.org/x/text/language/parse.go
++++ b/vendor/golang.org/x/text/language/parse.go
+@@ -133,6 +133,7 @@ func update(b *language.Builder, part ...interface{}) (err error) {
+ }
+ 
+ var errInvalidWeight = errors.New("ParseAcceptLanguage: invalid weight")
++var errTagListTooLarge = errors.New("tag list exceeds max length")
+ 
+ // ParseAcceptLanguage parses the contents of an Accept-Language header as
+ // defined in http://www.ietf.org/rfc/rfc2616.txt and returns a list of Tags and
+@@ -150,6 +151,10 @@ func ParseAcceptLanguage(s string) (tag []Tag, q []float32, err error) {
+ 
+ 		entry, weight := split(entry, ';')
+ 
++	if strings.Count(s, "-") > 1000 {
++		return nil, nil, errTagListTooLarge
++	}
++
+ 		// Scan the language.
+ 		t, err := Parse(entry)
+ 		if err != nil {
+-- 
+2.33.8
+

SPECS/application-gateway-kubernetes-ingress/application-gateway-kubernetes-ingress.spec

@@ -2,7 +2,7 @@
 Summary:        Application Gateway Ingress Controller
 Name:           application-gateway-kubernetes-ingress
 Version:        1.4.0
-Release:        21%{?dist}
+Release:        22%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -29,6 +29,7 @@ Source1:        %{name}-%{version}-vendor.tar.gz
 Patch0:         CVE-2022-21698.patch
 Patch1:         CVE-2023-44487.patch
 Patch2:         CVE-2021-44716.patch
+Patch3:         CVE-2022-32149.patch
 
 BuildRequires:  golang
 %if %{with_check}
@@ -67,6 +68,9 @@ cp appgw-ingress %{buildroot}%{_bindir}/
 %{_bindir}/appgw-ingress
 
 %changelog
+* Wed Aug 28 2024 Sindhu Karri <lakarri@microsoft.com> - 1.4.0-22
+- Fix CVE-2022-32149 with a patch
+
 * Wed Jul 17 2024 Muhammad Falak R Wani <mwani@microsoft.com> - 1.4.0-21
 - Drop requirement on a specific version of golang