Skip to content

Commit 35e1eed

Browse files
CBL-Mariner-BotPawelWMS
CBL-Mariner-Bot
and
PawelWMS
authored
[AUTO-CHERRYPICK] Patched CVE-2024-37890, CVE-2023-42282, and CVE-2017-18214 in reaper. - branch main (#9807)
Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
1 parent 055ff1c commit 35e1eed

6 files changed

Lines changed: 269 additions & 63 deletions

File tree

‎SPECS/reaper/CVE-2017-18214.patch‎

Lines changed: 70 additions & 0 deletions
Large diffs are not rendered by default.

‎SPECS/reaper/CVE-2023-42282.patch‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
From: Pawel Winogrodzki <pawelwi@microsoft.com>
2+
Date: Tue, 9 Jul 2024 21:55:46 +0000
3+
Subject: Patching CVE-2023-42282.
4+
5+
Backported upstream patch:
6+
https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894?diff=split&w=0
7+
---
8+
lib/ip.js | 77 ++++++++++++++++++++++++++++++++++++++++++++++++++++---
9+
1 file changed, 73 insertions(+), 4 deletions(-)
10+
11+
diff --git a/tmp_local/n/versions/node/14.18.0/lib/node_modules/npm/node_modules/ip/lib/ip.js b/tmp_local/n/versions/node/14.18.0/lib/node_modules/npm/node_modules/ip/lib/ip.js
12+
index c1799a8..a0c920f 100644
13+
--- a/tmp_local/n/versions/node/14.18.0/lib/node_modules/npm/node_modules/ip/lib/ip.js
14+
+++ b/tmp_local/n/versions/node/14.18.0/lib/node_modules/npm/node_modules/ip/lib/ip.js
15+
@@ -300,12 +300,26 @@ ip.isEqual = function(a, b) {
16+
};
17+
18+
ip.isPrivate = function(addr) {
19+
- return /^(::f{4}:)?10\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$/i
20+
- .test(addr) ||
21+
+ // check loopback addresses first
22+
+ if (ip.isLoopback(addr)) {
23+
+ return true;
24+
+ }
25+
+
26+
+ // ensure the ipv4 address is valid
27+
+ if (!ip.isV6Format(addr)) {
28+
+ const ipl = ip.normalizeToLong(addr);
29+
+ if (ipl < 0) {
30+
+ throw new Error('invalid ipv4 address');
31+
+ }
32+
+ // normalize the address for the private range checks that follow
33+
+ addr = ip.fromLong(ipl);
34+
+ }
35+
+
36+
+ // check private ranges
37+
+ return /^(::f{4}:)?10\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$/i.test(addr) ||
38+
/^(::f{4}:)?192\.168\.([0-9]{1,3})\.([0-9]{1,3})$/i.test(addr) ||
39+
/^(::f{4}:)?172\.(1[6-9]|2\d|30|31)\.([0-9]{1,3})\.([0-9]{1,3})$/i
40+
.test(addr) ||
41+
- /^(::f{4}:)?127\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$/i.test(addr) ||
42+
/^(::f{4}:)?169\.254\.([0-9]{1,3})\.([0-9]{1,3})$/i.test(addr) ||
43+
/^f[cd][0-9a-f]{2}:/i.test(addr) ||
44+
/^fe80:/i.test(addr) ||
45+
@@ -318,9 +332,16 @@ ip.isPublic = function(addr) {
46+
};
47+
48+
ip.isLoopback = function(addr) {
49+
+ // If addr is an IPv4 address in long integer form (no dots and no colons), convert it
50+
+ if (!/\./.test(addr) && !/:/.test(addr)) {
51+
+ addr = ip.fromLong(Number(addr));
52+
+ }
53+
+
54+
return /^(::f{4}:)?127\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})/
55+
.test(addr) ||
56+
- /^fe80::1$/.test(addr) ||
57+
+ /^0177\./.test(addr) ||
58+
+ /^0x7f\./i.test(addr) ||
59+
+ /^fe80::1$/i.test(addr) ||
60+
/^::1$/.test(addr) ||
61+
/^::$/.test(addr);
62+
};
63+
@@ -414,3 +435,51 @@ ip.fromLong = function(ipl) {
64+
(ipl >> 8 & 255) + '.' +
65+
(ipl & 255) );
66+
};
67+
+
68+
+ip.normalizeToLong = function (addr) {
69+
+ const parts = addr.split('.').map(part => {
70+
+ // Handle hexadecimal format
71+
+ if (part.startsWith('0x') || part.startsWith('0X')) {
72+
+ return parseInt(part, 16);
73+
+ }
74+
+ // Handle octal format (strictly digits 0-7 after a leading zero)
75+
+ else if (part.startsWith('0') && part !== '0' && /^[0-7]+$/.test(part)) {
76+
+ return parseInt(part, 8);
77+
+ }
78+
+ // Handle decimal format, reject invalid leading zeros
79+
+ else if (/^[1-9]\d*$/.test(part) || part === '0') {
80+
+ return parseInt(part, 10);
81+
+ }
82+
+ // Return NaN for invalid formats to indicate parsing failure
83+
+ else {
84+
+ return NaN;
85+
+ }
86+
+ });
87+
+
88+
+ if (parts.some(isNaN)) return -1; // Indicate error with -1
89+
+
90+
+ let val = 0;
91+
+ const n = parts.length;
92+
+
93+
+ switch (n) {
94+
+ case 1:
95+
+ val = parts[0];
96+
+ break;
97+
+ case 2:
98+
+ if (parts[0] > 0xff || parts[1] > 0xffffff) return -1;
99+
+ val = (parts[0] << 24) | (parts[1] & 0xffffff);
100+
+ break;
101+
+ case 3:
102+
+ if (parts[0] > 0xff || parts[1] > 0xff || parts[2] > 0xffff) return -1;
103+
+ val = (parts[0] << 24) | (parts[1] << 16) | (parts[2] & 0xffff);
104+
+ break;
105+
+ case 4:
106+
+ if (parts.some(part => part > 0xff)) return -1;
107+
+ val = (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3];
108+
+ break;
109+
+ default:
110+
+ return -1; // Error case
111+
+ }
112+
+
113+
+ return val >>> 0;
114+
+};
115+
--
116+
2.39.4
117+

‎SPECS/reaper/CVE-2024-37890.patch‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From 355a396ccce875ea012a4ea8e6ab283bb575ba5b Mon Sep 17 00:00:00 2001
2+
From: ABC <abc>
3+
Date: Tue, 9 Jul 2024 16:48:16 +0000
4+
Subject: [PATCH] Patching CVE-2024-37890.
5+
6+
Applying the patch for the 6.x versions from:
7+
https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
8+
---
9+
src/ui/node_modules/ws/lib/websocket-server.js | 4 +++-
10+
1 file changed, 3 insertions(+), 1 deletion(-)
11+
12+
diff --git a/src/ui/node_modules/ws/lib/websocket-server.js b/src/ui/node_modules/ws/lib/websocket-server.js
13+
index db02f4d0..b74eb1cf 100644
14+
--- a/src/ui/node_modules/ws/lib/websocket-server.js
15+
+++ b/src/ui/node_modules/ws/lib/websocket-server.js
16+
@@ -186,12 +186,14 @@ class WebSocketServer extends EventEmitter {
17+
req.headers['sec-websocket-key'] !== undefined
18+
? req.headers['sec-websocket-key'].trim()
19+
: false;
20+
+ const upgrade = req.headers.upgrade;
21+
const version = +req.headers['sec-websocket-version'];
22+
const extensions = {};
23+
24+
if (
25+
req.method !== 'GET' ||
26+
- req.headers.upgrade.toLowerCase() !== 'websocket' ||
27+
+ upgrade === undefined ||
28+
+ upgrade.toLowerCase() !== 'websocket' ||
29+
!key ||
30+
!keyRegex.test(key) ||
31+
(version !== 8 && version !== 13) ||
32+
--
33+
2.39.4
34+

‎SPECS/reaper/reaper.signatures.json‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
{
22
"Signatures": {
33
"cassandra-reaper-3.1.1.tar.gz": "6efe52195ad4a3c3b7a6f928bafa60d3df011709d9bc918e717033bf86d724d8",
4-
"reaper-bower-cache-3.1.1.tar.gz": "a8532fe1d28f6d2c99a5e0d08b17b85465617931d49c7d27450ed328e59c0b08",
54
"reaper-bower-components-3.1.1-1.tar.gz": "51f5b03b3f56966f5fbfe28a13e0a74003cf33372ff4ba13fd82c6fe79092033",
65
"reaper-local-lib-node-modules-3.1.1.tar.gz": "8daf9a8726a85ca31b024a5bab60a357fe927f670908955cdd9b106bf9c6bd60",
76
"reaper-local-n-3.1.1-1.tar.gz": "e60ecf1c982c8cd44b35da02aec6de5b1f8f0df562f290f9bb905d03f9eefa68",
87
"reaper-m2-cache-3.1.1.tar.gz": "14103df496c6bfd1bf2690b45e6082e3411872f7332f03a68cf5d8e28fc6b27f",
9-
"reaper-npm-cache-3.1.1.tar.gz": "1fd8fd9438ef682cccceaaf49d0e65ec50eb7145c20f27253a3521c731e79585",
108
"reaper-srcui-node-modules-3.1.1-1.tar.gz": "edd67243e97838657e09513f639a8e7c81fbb813353a19eba3949f79fb9e3e9e"
119
}
1210
}

‎SPECS/reaper/reaper.spec‎

Lines changed: 48 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -3,48 +3,45 @@
33
%define local_n_release 1
44
%define local_srcui_release 1
55

6-
%define srcdir cassandra-%{name}-%{version}
7-
%define bower_components reaper-bower-components-%{version}-%{local_srcui_release}.tar.gz
8-
%define srcui_node_modules reaper-srcui-node-modules-%{version}-%{local_srcui_release}.tar.gz
9-
%define bower_cache reaper-bower-cache-%{version}.tar.gz
10-
%define maven_cache reaper-m2-cache-%{version}.tar.gz
11-
%define npm_cache reaper-npm-cache-%{version}.tar.gz
12-
%define local_lib_node_modules reaper-local-lib-node-modules-%{version}.tar.gz
13-
%define local_n reaper-local-n-%{version}-%{local_n_release}.tar.gz
14-
156
Summary: Reaper for cassandra is a tool for running Apache Cassandra repairs against single or multi-site clusters.
167
Name: reaper
178
Version: 3.1.1
18-
Release: 9%{?dist}
9+
Release: 10%{?dist}
1910
License: ASL 2.0
2011
Vendor: Microsoft Corporation
2112
Distribution: Mariner
2213
Group: Applications/System
2314
URL: https://cassandra-reaper.io/
2415
Source0: https://github.com/thelastpickle/cassandra-reaper/archive/refs/tags/%{version}.tar.gz#/cassandra-reaper-%{version}.tar.gz
25-
# Building reaper from sources downloads artifacts related to maven/node/etc. These artifacts need to be downloaded as caches in order to build reaper using maven in offline mode.
16+
# Building reaper from sources downloads artifacts related to maven/node/etc.
17+
# These artifacts need to be downloaded as caches in order to build reaper using maven in offline mode.
2618
# Below is the list of cached sources.
2719
# bower-components downloaded under src/ui
2820
# NOTE: USE "reaper_build_caches.sh" TO RE-GENERATE BUILD CACHES.
29-
Source1: %{bower_components}
21+
Source1: reaper-bower-components-%{version}-%{local_srcui_release}.tar.gz
3022
# node_modules downloaded under src/ui
31-
Source2: %{srcui_node_modules}
32-
# bower cache
33-
Source3: %{bower_cache}
23+
Source2: reaper-srcui-node-modules-%{version}-%{local_srcui_release}.tar.gz
3424
# m2 cache
35-
Source4: %{maven_cache}
36-
# npm cache
37-
Source5: %{npm_cache}
25+
Source4: reaper-m2-cache-%{version}.tar.gz
3826
# node_modules downloaded to /usr/local/lib
39-
Source6: %{local_lib_node_modules}
27+
Source6: reaper-local-lib-node-modules-%{version}.tar.gz
4028
# v14.18.0 node binary under /usr/local
41-
Source7: %{local_n}
29+
Source7: reaper-local-n-%{version}-%{local_n_release}.tar.gz
30+
# Patches the src/ui/node_modules/ws/lib/websocket-server.js file, which comes
31+
# from the "reaper-srcui-node-modules*" tarball.
32+
# The src/ui/node_modules/ws/package.json file suggest we're on the
33+
# 6.x version of "ws". Patch for this version taken from here:
34+
# https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
35+
Patch0: CVE-2024-37890.patch
36+
Patch1: CVE-2023-42282.patch
37+
Patch2: CVE-2017-18214.patch
4238
BuildRequires: git
4339
BuildRequires: javapackages-tools
4440
BuildRequires: maven
4541
BuildRequires: msopenjdk-11
4642
BuildRequires: nodejs
4743
BuildRequires: python3
44+
BuildRequires: rsync
4845
BuildRequires: systemd-rpm-macros
4946
BuildRequires: openssl-devel
5047
Requires: msopenjdk-11
@@ -58,22 +55,15 @@ ExclusiveArch: x86_64
5855
Cassandra reaper is an open source tool that aims to schedule and orchestrate repairs of Apache Cassandra clusters.
5956

6057
%prep
61-
%setup -q -n %{srcdir}
62-
63-
%build
64-
export JAVA_HOME="%{_libdir}/jvm/msopenjdk-11"
65-
export LD_LIBRARY_PATH="%{_libdir}/jvm/msopenjdk-11/lib/jli"
66-
67-
pushd "$HOME"
68-
echo "Installing bower cache."
69-
tar xf %{SOURCE3}
58+
%autosetup -N -n cassandra-%{name}-%{version}
7059

71-
echo "Installing m2 cache."
72-
tar xf %{SOURCE4}
60+
echo "Installing bower_components and npm_modules caches."
61+
for source in "%{SOURCE1}" "%{SOURCE2}"; do
62+
tar -C src/ui -xf "$source"
63+
done
7364

74-
echo "Installing npm cache"
75-
tar xf %{SOURCE5}
76-
popd
65+
echo "Installing the m2 cache."
66+
tar -C "$HOME" -xf "%{SOURCE4}"
7767

7868
# Reaper build fails when trying to install node-sass@4.9.0/node-gyp@3.8.0 and build node native addons using mariner default node@16.14.2/npm@8.5.0.
7969
# ERROR:
@@ -82,33 +72,35 @@ popd
8272
# There is no way to remove node-sass dependency from builds, hence we need to install local node/npm and caches to be able to build reaper.
8373
# NOTE: This issue was also faced on Fedora Fc37 when trying to build reaper.
8474
# NOTE: node-sass seems to be deprecated, the spec and build process will be modified once reaper removes its dependencies as well.
85-
pushd %{_prefix}/local
75+
76+
# Extracting to intermediate folder to apply patch.
77+
tmp_local_dir=tmp_local
78+
mkdir -p $tmp_local_dir/{bin,lib}
79+
pushd $tmp_local_dir
8680
echo "Installing node_modules"
87-
tar xf %{SOURCE6} -C ./lib/
81+
tar -C ./lib/ -xf %{SOURCE6}
8882

8983
echo "Installing n version 14.18.0"
90-
tar xf %{SOURCE7}
84+
tar -xf %{SOURCE7}
9185

9286
echo "Creating symlinks under local/bin"
93-
cd ./bin
94-
ln -sf ../lib/node_modules/bower/bin/bower bower
95-
ln -sf ../lib/node_modules/npm/bin/npm-cli.js npm
96-
ln -sf ../lib/node_modules/npm/bin/npx-cli.js npx
87+
ln -sf ../lib/node_modules/bower/bin/bower bin/bower
88+
ln -sf ../lib/node_modules/npm/bin/npm-cli.js bin/npm
89+
ln -sf ../lib/node_modules/npm/bin/npx-cli.js bin/npx
9790

98-
cp ../n/versions/node/14.18.0/bin/node .
91+
cp n/versions/node/14.18.0/bin/node bin
9992

10093
ls -al
10194
popd
10295

103-
cd %{_builddir}/%{srcdir}
104-
echo "Installing src caches"
105-
pushd ./src/ui
106-
echo "Installing bower_components"
107-
tar xf %{SOURCE1}
96+
%autopatch -p1
10897

109-
echo "Installing npm_modules"
110-
tar fx %{SOURCE2}
111-
popd
98+
rsync -azvhr $tmp_local_dir/ "%{_prefix}/local"
99+
rm -rf $tmp_local_dir
100+
101+
%build
102+
export JAVA_HOME="%{_libdir}/jvm/msopenjdk-11"
103+
export LD_LIBRARY_PATH="%{_libdir}/jvm/msopenjdk-11/lib/jli"
112104

113105
# Building using maven in offline mode.
114106
mvn -DskipTests package -o
@@ -122,7 +114,8 @@ mkdir -p %{buildroot}%{_sysconfdir}/cassandra-%{name}/configs
122114
mkdir -p %{buildroot}%{_sysconfdir}/bash_completion.d
123115
mkdir -p %{buildroot}%{_unitdir}
124116
mkdir -p %{buildroot}%{_datadir}/licenses/%{name}
125-
cd %{_builddir}/%{srcdir}/src/packaging
117+
118+
pushd src/packaging
126119

127120
cp resource/cassandra-reaper.yaml %{buildroot}%{_sysconfdir}/cassandra-%{name}/
128121
cp resource/cassandra-reaper*.yaml %{buildroot}%{_sysconfdir}/cassandra-%{name}/configs
@@ -139,7 +132,7 @@ cp debian/cassandra-%{name}.new.service %{buildroot}/%{_unitdir}/cassandra-%{nam
139132
chmod 0644 %{buildroot}/%{_unitdir}/cassandra-%{name}.service
140133
chmod 7555 %{buildroot}%{_sysconfdir}/init.d/cassandra-%{name}
141134

142-
cp %{_builddir}/%{srcdir}/LICENSE.txt %{buildroot}%{_datadir}/licenses/%{name}
135+
popd
143136

144137
%pre
145138
getent group reaper > /dev/null || groupadd -r reaper
@@ -178,6 +171,9 @@ fi
178171
%{_unitdir}/cassandra-%{name}.service
179172

180173
%changelog
174+
* Tue Jul 09 2024 Pawel Winogrodzki <pawelwi@microsoft.com> - 3.1.1-10
175+
- Patching CVE-2024-37890, CVE-2023-42282, and CVE-2017-18214.
176+
181177
* Thu May 23 2024 Archana Choudhary <archana1@microsoft.com> - 3.1.1-9
182178
- Repackage and update src/ui node modules and bower components to 3.1.1-1
183179
- Address CVE-2024-4068 by upgrading the version of the npm module "braces" to 3.0.3

‎SPECS/reaper/reaper_build_caches.sh‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,7 @@ SOURCE_URL="https://github.com/thelastpickle/cassandra-reaper/archive/refs/tags/
2424
# Build cache names
2525
BOWER_COMPONENTS="reaper-bower-components-${VERSION}.tar.gz"
2626
SRC_UI_NODE_MODULES="reaper-srcui-node-modules-${VERSION}.tar.gz"
27-
BOWER_CACHE="reaper-bower-cache-${VERSION}.tar.gz"
2827
MAVEN_CACHE="reaper-m2-cache-${VERSION}.tar.gz"
29-
NPM_CACHE="reaper-npm-cache-${VERSION}.tar.gz"
3028
LOCAL_LIB_NODE_MODULES="reaper-local-lib-node-modules-${VERSION}.tar.gz"
3129
LOCAL_N="reaper-local-n-${VERSION}.tar.gz"
3230

@@ -103,17 +101,10 @@ function buildReaperSources {
103101
function createCacheTars {
104102
echo "Creating build caches."
105103
pushd ${homeCacheDir}
106-
echo "creating bower_cache tar..."
107-
tar -cf ${BOWER_CACHE} .cache
108-
mv ${BOWER_CACHE} ${reaperCacheDir}
109104

110105
echo "creating maven_cache tar..."
111106
tar -cf ${MAVEN_CACHE} .m2
112107
mv ${MAVEN_CACHE} ${reaperCacheDir}
113-
114-
echo "creating npm_cache tar..."
115-
tar -cf ${NPM_CACHE} .npm
116-
mv ${NPM_CACHE} ${reaperCacheDir}
117108
popd
118109

119110
pushd ${tempDir}/cassandra-reaper-${VERSION}/src/ui

0 commit comments

Comments
 (0)