Skip to content

Commit 308958d

Browse files
azurelinux-securityakhila-guruju
azurelinux-security
and
akhila-guruju
authored
[AutoPR- Security] Patch prometheus for CVE-2025-11065 [MEDIUM] (#15722)
Co-authored-by: Akhila Guruju <v-guakhila@microsoft.com>
1 parent 32541bb commit 308958d

2 files changed

Lines changed: 286 additions & 1 deletion

File tree

‎SPECS/prometheus/CVE-2025-11065.patch‎

Lines changed: 281 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,281 @@
1+
From 742921c9ba2854d27baa64272487fc5075d2c39c Mon Sep 17 00:00:00 2001
2+
From: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
3+
Date: Sat, 12 Jul 2025 07:25:50 +0200
4+
Subject: [PATCH] fix: error message leaks
5+
6+
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
7+
8+
Upstream Patch reference: https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c.patch
9+
---
10+
.../mitchellh/mapstructure/decode_hooks.go | 12 +-
11+
.../mitchellh/mapstructure/error.go | 156 ++++++++++++++++++
12+
.../mitchellh/mapstructure/mapstructure.go | 10 +-
13+
3 files changed, 169 insertions(+), 9 deletions(-)
14+
15+
diff --git a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
16+
index 3a754ca7..4dfab7d3 100644
17+
--- a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
18+
+++ b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
19+
@@ -134,7 +134,9 @@ func StringToTimeDurationHookFunc() DecodeHookFunc {
20+
}
21+
22+
// Convert it by parsing
23+
- return time.ParseDuration(data.(string))
24+
+ d, err := time.ParseDuration(data.(string))
25+
+
26+
+ return d, wrapTimeParseDurationError(err)
27+
}
28+
}
29+
30+
@@ -155,7 +157,7 @@ func StringToIPHookFunc() DecodeHookFunc {
31+
// Convert it by parsing
32+
ip := net.ParseIP(data.(string))
33+
if ip == nil {
34+
- return net.IP{}, fmt.Errorf("failed parsing ip %v", data)
35+
+ return net.IP{}, fmt.Errorf("failed parsing ip")
36+
}
37+
38+
return ip, nil
39+
@@ -178,7 +180,7 @@ func StringToIPNetHookFunc() DecodeHookFunc {
40+
41+
// Convert it by parsing
42+
_, net, err := net.ParseCIDR(data.(string))
43+
- return net, err
44+
+ return net, wrapNetParseError(err)
45+
}
46+
}
47+
48+
@@ -197,7 +199,9 @@ func StringToTimeHookFunc(layout string) DecodeHookFunc {
49+
}
50+
51+
// Convert it by parsing
52+
- return time.Parse(layout, data.(string))
53+
+ ti, err := time.Parse(layout, data.(string))
54+
+
55+
+ return ti, wrapTimeParseError(err)
56+
}
57+
}
58+
59+
diff --git a/vendor/github.com/mitchellh/mapstructure/error.go b/vendor/github.com/mitchellh/mapstructure/error.go
60+
index 47a99e5a..8c3b0786 100644
61+
--- a/vendor/github.com/mitchellh/mapstructure/error.go
62+
+++ b/vendor/github.com/mitchellh/mapstructure/error.go
63+
@@ -3,8 +3,12 @@ package mapstructure
64+
import (
65+
"errors"
66+
"fmt"
67+
+ "net"
68+
+ "net/url"
69+
"sort"
70+
+ "strconv"
71+
"strings"
72+
+ "time"
73+
)
74+
75+
// Error implements the error interface and can represents multiple
76+
@@ -48,3 +52,155 @@ func appendErrors(errors []string, err error) []string {
77+
return append(errors, e.Error())
78+
}
79+
}
80+
+
81+
+func wrapStrconvNumError(err error) error {
82+
+ if err == nil {
83+
+ return nil
84+
+ }
85+
+
86+
+ if err, ok := err.(*strconv.NumError); ok {
87+
+ return &strconvNumError{Err: err}
88+
+ }
89+
+
90+
+ return err
91+
+}
92+
+
93+
+type strconvNumError struct {
94+
+ Err *strconv.NumError
95+
+}
96+
+
97+
+func (e *strconvNumError) Error() string {
98+
+ return "strconv." + e.Err.Func + ": " + e.Err.Err.Error()
99+
+}
100+
+
101+
+func (e *strconvNumError) Unwrap() error { return e.Err }
102+
+
103+
+func wrapUrlError(err error) error {
104+
+ if err == nil {
105+
+ return nil
106+
+ }
107+
+
108+
+ if err, ok := err.(*url.Error); ok {
109+
+ return &urlError{Err: err}
110+
+ }
111+
+
112+
+ return err
113+
+}
114+
+
115+
+type urlError struct {
116+
+ Err *url.Error
117+
+}
118+
+
119+
+func (e *urlError) Error() string {
120+
+ return fmt.Sprintf("%s", e.Err.Err)
121+
+}
122+
+
123+
+func (e *urlError) Unwrap() error { return e.Err }
124+
+
125+
+func wrapNetParseError(err error) error {
126+
+ if err == nil {
127+
+ return nil
128+
+ }
129+
+
130+
+ if err, ok := err.(*net.ParseError); ok {
131+
+ return &netParseError{Err: err}
132+
+ }
133+
+
134+
+ return err
135+
+}
136+
+
137+
+type netParseError struct {
138+
+ Err *net.ParseError
139+
+}
140+
+
141+
+func (e *netParseError) Error() string {
142+
+ return "invalid " + e.Err.Type
143+
+}
144+
+
145+
+func (e *netParseError) Unwrap() error { return e.Err }
146+
+
147+
+func wrapTimeParseError(err error) error {
148+
+ if err == nil {
149+
+ return nil
150+
+ }
151+
+
152+
+ if err, ok := err.(*time.ParseError); ok {
153+
+ return &timeParseError{Err: err}
154+
+ }
155+
+
156+
+ return err
157+
+}
158+
+
159+
+type timeParseError struct {
160+
+ Err *time.ParseError
161+
+}
162+
+
163+
+func (e *timeParseError) Error() string {
164+
+ if e.Err.Message == "" {
165+
+ return fmt.Sprintf("parsing time as %q: cannot parse as %q", e.Err.Layout, e.Err.LayoutElem)
166+
+ }
167+
+
168+
+ return "parsing time " + e.Err.Message
169+
+}
170+
+
171+
+func (e *timeParseError) Unwrap() error { return e.Err }
172+
+
173+
+func wrapNetIPParseAddrError(err error) error {
174+
+ if err == nil {
175+
+ return nil
176+
+ }
177+
+
178+
+ if errMsg := err.Error(); strings.HasPrefix(errMsg, "ParseAddr") {
179+
+ errPieces := strings.Split(errMsg, ": ")
180+
+
181+
+ return fmt.Errorf("ParseAddr: %s", errPieces[len(errPieces)-1])
182+
+ }
183+
+
184+
+ return err
185+
+}
186+
+
187+
+func wrapNetIPParseAddrPortError(err error) error {
188+
+ if err == nil {
189+
+ return nil
190+
+ }
191+
+
192+
+ errMsg := err.Error()
193+
+ if strings.HasPrefix(errMsg, "invalid port ") {
194+
+ return errors.New("invalid port")
195+
+ } else if strings.HasPrefix(errMsg, "invalid ip:port ") {
196+
+ return errors.New("invalid ip:port")
197+
+ }
198+
+
199+
+ return err
200+
+}
201+
+
202+
+func wrapNetIPParsePrefixError(err error) error {
203+
+ if err == nil {
204+
+ return nil
205+
+ }
206+
+
207+
+ if errMsg := err.Error(); strings.HasPrefix(errMsg, "netip.ParsePrefix") {
208+
+ errPieces := strings.Split(errMsg, ": ")
209+
+
210+
+ return fmt.Errorf("netip.ParsePrefix: %s", errPieces[len(errPieces)-1])
211+
+ }
212+
+
213+
+ return err
214+
+}
215+
+
216+
+func wrapTimeParseDurationError(err error) error {
217+
+ if err == nil {
218+
+ return nil
219+
+ }
220+
+
221+
+ errMsg := err.Error()
222+
+ if strings.HasPrefix(errMsg, "time: unknown unit ") {
223+
+ return errors.New("time: unknown unit")
224+
+ } else if strings.HasPrefix(errMsg, "time: ") {
225+
+ idx := strings.LastIndex(errMsg, " ")
226+
+
227+
+ return errors.New(errMsg[:idx])
228+
+ }
229+
+
230+
+ return err
231+
+}
232+
diff --git a/vendor/github.com/mitchellh/mapstructure/mapstructure.go b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
233+
index 7581806a..4845a28f 100644
234+
--- a/vendor/github.com/mitchellh/mapstructure/mapstructure.go
235+
+++ b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
236+
@@ -642,7 +642,7 @@ func (d *Decoder) decodeInt(name string, data interface{}, val reflect.Value) er
237+
if err == nil {
238+
val.SetInt(i)
239+
} else {
240+
- return fmt.Errorf("cannot parse '%s' as int: %s", name, err)
241+
+ return fmt.Errorf("cannot parse '%s' as int: %s", name, wrapStrconvNumError(err))
242+
}
243+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
244+
jn := data.(json.Number)
245+
@@ -699,14 +699,14 @@ func (d *Decoder) decodeUint(name string, data interface{}, val reflect.Value) e
246+
if err == nil {
247+
val.SetUint(i)
248+
} else {
249+
- return fmt.Errorf("cannot parse '%s' as uint: %s", name, err)
250+
+ return fmt.Errorf("cannot parse '%s' as uint: %s", name, wrapStrconvNumError(err))
251+
}
252+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
253+
jn := data.(json.Number)
254+
i, err := strconv.ParseUint(string(jn), 0, 64)
255+
if err != nil {
256+
return fmt.Errorf(
257+
- "error decoding json.Number into %s: %s", name, err)
258+
+ "error decoding json.Number into %s: %s", name, wrapStrconvNumError(err))
259+
}
260+
val.SetUint(i)
261+
default:
262+
@@ -738,7 +738,7 @@ func (d *Decoder) decodeBool(name string, data interface{}, val reflect.Value) e
263+
} else if dataVal.String() == "" {
264+
val.SetBool(false)
265+
} else {
266+
- return fmt.Errorf("cannot parse '%s' as bool: %s", name, err)
267+
+ return fmt.Errorf("cannot parse '%s' as bool: %s", name, wrapStrconvNumError(err))
268+
}
269+
default:
270+
return fmt.Errorf(
271+
@@ -777,7 +777,7 @@ func (d *Decoder) decodeFloat(name string, data interface{}, val reflect.Value)
272+
if err == nil {
273+
val.SetFloat(f)
274+
} else {
275+
- return fmt.Errorf("cannot parse '%s' as float: %s", name, err)
276+
+ return fmt.Errorf("cannot parse '%s' as float: %s", name, wrapStrconvNumError(err))
277+
}
278+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
279+
jn := data.(json.Number)
280+
--
281+
2.43.0

‎SPECS/prometheus/prometheus.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
Summary: Prometheus monitoring system and time series database
55
Name: prometheus
66
Version: 2.37.9
7-
Release: 6%{?dist}
7+
Release: 7%{?dist}
88
License: Apache-2.0
99
Vendor: Microsoft Corporation
1010
Distribution: Mariner
@@ -26,6 +26,7 @@ Patch5: CVE-2025-30204.patch
2626
Patch6: CVE-2024-51744.patch
2727
Patch7: fix-ptests-for-local-test-CA-certificate.patch
2828
Patch8: CVE-2025-65637.patch
29+
Patch9: CVE-2025-11065.patch
2930
BuildRequires: golang
3031
BuildRequires: nodejs
3132
BuildRequires: systemd-rpm-macros
@@ -139,6 +140,9 @@ fi
139140
%doc README.md RELEASE.md documentation
140141

141142
%changelog
143+
* Wed Feb 04 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.37.9-7
144+
- Patch for CVE-2025-11065
145+
142146
* Mon Dec 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.37.9-6
143147
- Patch for CVE-2025-65637
144148

0 commit comments

Comments
 (0)