Skip to content

Commit 2cfea6b

Browse files
CBL-Mariner-BotSumynwajslobodzian
authored
[AUTO-CHERRYPICK] Add Patch in terraform for CVE-2024-6257. - branch main (#9954)
Co-authored-by: Sumynwa <sumsharma@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
1 parent ca07e1b commit 2cfea6b

2 files changed

Lines changed: 135 additions & 2 deletions

File tree

‎SPECS/terraform/CVE-2024-6257.patch‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
From 9906874a23919a81eff097d84fdb8f98525ac880 Mon Sep 17 00:00:00 2001
2+
From: dduzgun-security <deniz.duzgun@hashicorp.com>
3+
Date: Thu, 20 Jun 2024 10:06:56 -0400
4+
Subject: [PATCH 1/2] recreate git config during update to prevent config
5+
alteration
6+
7+
Modified to apply to vendored code by: Sumedh Sharma <sumsharma@microsoft.com>
8+
- Adjusted paths to work for vendored version
9+
- Removed test code since it is not included in vendor trace
10+
---
11+
vendor/github.com/hashicorp/go-getter/get_git.go | 81 +++++++++++++++----
12+
1 file changed, 67 insertions(+), 14 deletions(-)
13+
14+
diff --git a/vendor/github.com/hashicorp/go-getter/get_git.go b/vendor/github.com/hashicorp/go-getter/get_git.go
15+
index 5227db7..51a898b 100644
16+
--- a/vendor/github.com/hashicorp/go-getter/get_git.go
17+
+++ b/vendor/github.com/hashicorp/go-getter/get_git.go
18+
@@ -125,7 +125,7 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
19+
return err
20+
}
21+
if err == nil {
22+
- err = g.update(ctx, dst, sshKeyFile, ref, depth)
23+
+ err = g.update(ctx, dst, sshKeyFile, u, ref, depth)
24+
} else {
25+
err = g.clone(ctx, dst, sshKeyFile, u, ref, depth)
26+
}
27+
@@ -228,28 +228,64 @@ func (g *GitGetter) clone(ctx context.Context, dst, sshKeyFile string, u *url.UR
28+
return nil
29+
}
30+
31+
-func (g *GitGetter) update(ctx context.Context, dst, sshKeyFile, ref string, depth int) error {
32+
- // Determine if we're a branch. If we're NOT a branch, then we just
33+
- // switch to master prior to checking out
34+
- cmd := exec.CommandContext(ctx, "git", "show-ref", "-q", "--verify", "refs/heads/"+ref)
35+
+func (g *GitGetter) update(ctx context.Context, dst, sshKeyFile string, u *url.URL, ref string, depth int) error {
36+
+ // Remove all variations of .git directories
37+
+ err := removeCaseInsensitiveGitDirectory(dst)
38+
+ if err != nil {
39+
+ return err
40+
+ }
41+
+
42+
+ // Initialize the git repository
43+
+ cmd := exec.CommandContext(ctx, "git", "init")
44+
+ cmd.Dir = dst
45+
+ err = getRunCommand(cmd)
46+
+ if err != nil {
47+
+ return err
48+
+ }
49+
+
50+
+ // Add the git remote
51+
+ cmd = exec.CommandContext(ctx, "git", "remote", "add", "origin", "--", u.String())
52+
+ cmd.Dir = dst
53+
+ err = getRunCommand(cmd)
54+
+ if err != nil {
55+
+ return err
56+
+ }
57+
+
58+
+ // Fetch the remote ref
59+
+ cmd = exec.CommandContext(ctx, "git", "fetch", "--tags")
60+
+ cmd.Dir = dst
61+
+ err = getRunCommand(cmd)
62+
+ if err != nil {
63+
+ return err
64+
+ }
65+
+
66+
+ // Fetch the remote ref
67+
+ cmd = exec.CommandContext(ctx, "git", "fetch", "origin", "--", ref)
68+
cmd.Dir = dst
69+
+ err = getRunCommand(cmd)
70+
+ if err != nil {
71+
+ return err
72+
+ }
73+
74+
- if getRunCommand(cmd) != nil {
75+
- // Not a branch, switch to default branch. This will also catch
76+
- // non-existent branches, in which case we want to switch to default
77+
- // and then checkout the proper branch later.
78+
- ref = findDefaultBranch(ctx, dst)
79+
+ // Reset the branch to the fetched ref
80+
+ cmd = exec.CommandContext(ctx, "git", "reset", "--hard", "FETCH_HEAD")
81+
+ cmd.Dir = dst
82+
+ err = getRunCommand(cmd)
83+
+ if err != nil {
84+
+ return err
85+
}
86+
87+
- // We have to be on a branch to pull
88+
- if err := g.checkout(ctx, dst, ref); err != nil {
89+
+ // Checkout ref branch
90+
+ err = g.checkout(ctx, dst, ref)
91+
+ if err != nil {
92+
return err
93+
}
94+
95+
+ // Pull the latest changes from the ref branch
96+
if depth > 0 {
97+
- cmd = exec.CommandContext(ctx, "git", "pull", "--depth", strconv.Itoa(depth), "--ff-only")
98+
+ cmd = exec.CommandContext(ctx, "git", "pull", "origin", "--depth", strconv.Itoa(depth), "--ff-only", "--", ref)
99+
} else {
100+
- cmd = exec.CommandContext(ctx, "git", "pull", "--ff-only")
101+
+ cmd = exec.CommandContext(ctx, "git", "pull", "origin", "--ff-only", "--", ref)
102+
}
103+
104+
cmd.Dir = dst
105+
@@ -374,3 +410,20 @@ func checkGitVersion(ctx context.Context, min string) error {
106+
107+
return nil
108+
}
109+
+
110+
+// removeCaseInsensitiveGitDirectory removes all .git directory variations
111+
+func removeCaseInsensitiveGitDirectory(dst string) error {
112+
+ files, err := os.ReadDir(dst)
113+
+ if err != nil {
114+
+ return fmt.Errorf("Failed to read the destination directory %s during git update", dst)
115+
+ }
116+
+ for _, f := range files {
117+
+ if strings.EqualFold(f.Name(), ".git") && f.IsDir() {
118+
+ err := os.RemoveAll(filepath.Join(dst, f.Name()))
119+
+ if err != nil {
120+
+ return fmt.Errorf("Failed to remove the .git directory in the destination directory %s during git update", dst)
121+
+ }
122+
+ }
123+
+ }
124+
+ return nil
125+
+}
126+
--
127+
2.25.1
128+

‎SPECS/terraform/terraform.spec‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Infrastructure as code deployment management tool
22
Name: terraform
33
Version: 1.3.2
4-
Release: 16%{?dist}
4+
Release: 17%{?dist}
55
License: MPLv2.0
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -29,7 +29,9 @@ Source0: https://github.com/hashicorp/terraform/archive/refs/tags/v%{vers
2929
Source1: %{name}-%{version}-vendor.tar.gz
3030
Patch0: CVE-2023-44487.patch
3131
Patch1: CVE-2024-3817.patch
32-
Patch2: CVE-2024-6104.patch
32+
Patch2: CVE-2024-6257.patch
33+
Patch3: CVE-2024-6104.patch
34+
3335

3436
%global debug_package %{nil}
3537
%define our_gopath %{_topdir}/.gopath
@@ -63,6 +65,9 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./terraform
6365
%{_bindir}/terraform
6466

6567
%changelog
68+
* Thu Jul 25 2024 Sumedh Sharma <sumsharma@microsoft.com> - 1.3.2-17
69+
- Patch CVE-2024-6257 in vendored hashicorp/go-getter
70+
6671
* Mon Jul 29 2024 Sumedh Sharma <sumsharma@microsoft.com> - 1.3.2-16
6772
- Patch CVE-2024-6104
6873

0 commit comments

Comments
 (0)