Skip to content

Commit 40c71bb

Browse files
azurelinux-securityakhila-gurujuKanishk-Bansal
authored
[AutoPR- Security] Patch telegraf for CVE-2025-11065 [MEDIUM] (#15670)
Co-authored-by: Akhila Guruju <v-guakhila@microsoft.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent fa814a4 commit 40c71bb

2 files changed

Lines changed: 289 additions & 2 deletions

File tree

‎SPECS/telegraf/CVE-2025-11065.patch‎

Lines changed: 283 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,283 @@
1+
From fc678501cbc2fba6edee65d3f1ef2295b185f1f5 Mon Sep 17 00:00:00 2001
2+
From: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
3+
Date: Sat, 12 Jul 2025 07:25:50 +0200
4+
Subject: [PATCH] fix: error message leaks
5+
6+
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
7+
8+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
9+
Upstream-reference: https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c.patch
10+
---
11+
.../mitchellh/mapstructure/decode_hooks.go | 12 +-
12+
.../mitchellh/mapstructure/error.go | 156 ++++++++++++++++++
13+
.../mitchellh/mapstructure/mapstructure.go | 10 +-
14+
3 files changed, 169 insertions(+), 9 deletions(-)
15+
16+
diff --git a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
17+
index 3a754ca7..4dfab7d3 100644
18+
--- a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
19+
+++ b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
20+
@@ -134,7 +134,9 @@ func StringToTimeDurationHookFunc() DecodeHookFunc {
21+
}
22+
23+
// Convert it by parsing
24+
- return time.ParseDuration(data.(string))
25+
+ d, err := time.ParseDuration(data.(string))
26+
+
27+
+ return d, wrapTimeParseDurationError(err)
28+
}
29+
}
30+
31+
@@ -155,7 +157,7 @@ func StringToIPHookFunc() DecodeHookFunc {
32+
// Convert it by parsing
33+
ip := net.ParseIP(data.(string))
34+
if ip == nil {
35+
- return net.IP{}, fmt.Errorf("failed parsing ip %v", data)
36+
+ return net.IP{}, fmt.Errorf("failed parsing ip")
37+
}
38+
39+
return ip, nil
40+
@@ -178,7 +180,7 @@ func StringToIPNetHookFunc() DecodeHookFunc {
41+
42+
// Convert it by parsing
43+
_, net, err := net.ParseCIDR(data.(string))
44+
- return net, err
45+
+ return net, wrapNetParseError(err)
46+
}
47+
}
48+
49+
@@ -197,7 +199,9 @@ func StringToTimeHookFunc(layout string) DecodeHookFunc {
50+
}
51+
52+
// Convert it by parsing
53+
- return time.Parse(layout, data.(string))
54+
+ ti, err := time.Parse(layout, data.(string))
55+
+
56+
+ return ti, wrapTimeParseError(err)
57+
}
58+
}
59+
60+
diff --git a/vendor/github.com/mitchellh/mapstructure/error.go b/vendor/github.com/mitchellh/mapstructure/error.go
61+
index 47a99e5a..8c3b0786 100644
62+
--- a/vendor/github.com/mitchellh/mapstructure/error.go
63+
+++ b/vendor/github.com/mitchellh/mapstructure/error.go
64+
@@ -3,8 +3,12 @@ package mapstructure
65+
import (
66+
"errors"
67+
"fmt"
68+
+ "net"
69+
+ "net/url"
70+
"sort"
71+
+ "strconv"
72+
"strings"
73+
+ "time"
74+
)
75+
76+
// Error implements the error interface and can represents multiple
77+
@@ -48,3 +52,155 @@ func appendErrors(errors []string, err error) []string {
78+
return append(errors, e.Error())
79+
}
80+
}
81+
+
82+
+func wrapStrconvNumError(err error) error {
83+
+ if err == nil {
84+
+ return nil
85+
+ }
86+
+
87+
+ if err, ok := err.(*strconv.NumError); ok {
88+
+ return &strconvNumError{Err: err}
89+
+ }
90+
+
91+
+ return err
92+
+}
93+
+
94+
+type strconvNumError struct {
95+
+ Err *strconv.NumError
96+
+}
97+
+
98+
+func (e *strconvNumError) Error() string {
99+
+ return "strconv." + e.Err.Func + ": " + e.Err.Err.Error()
100+
+}
101+
+
102+
+func (e *strconvNumError) Unwrap() error { return e.Err }
103+
+
104+
+func wrapUrlError(err error) error {
105+
+ if err == nil {
106+
+ return nil
107+
+ }
108+
+
109+
+ if err, ok := err.(*url.Error); ok {
110+
+ return &urlError{Err: err}
111+
+ }
112+
+
113+
+ return err
114+
+}
115+
+
116+
+type urlError struct {
117+
+ Err *url.Error
118+
+}
119+
+
120+
+func (e *urlError) Error() string {
121+
+ return fmt.Sprintf("%s", e.Err.Err)
122+
+}
123+
+
124+
+func (e *urlError) Unwrap() error { return e.Err }
125+
+
126+
+func wrapNetParseError(err error) error {
127+
+ if err == nil {
128+
+ return nil
129+
+ }
130+
+
131+
+ if err, ok := err.(*net.ParseError); ok {
132+
+ return &netParseError{Err: err}
133+
+ }
134+
+
135+
+ return err
136+
+}
137+
+
138+
+type netParseError struct {
139+
+ Err *net.ParseError
140+
+}
141+
+
142+
+func (e *netParseError) Error() string {
143+
+ return "invalid " + e.Err.Type
144+
+}
145+
+
146+
+func (e *netParseError) Unwrap() error { return e.Err }
147+
+
148+
+func wrapTimeParseError(err error) error {
149+
+ if err == nil {
150+
+ return nil
151+
+ }
152+
+
153+
+ if err, ok := err.(*time.ParseError); ok {
154+
+ return &timeParseError{Err: err}
155+
+ }
156+
+
157+
+ return err
158+
+}
159+
+
160+
+type timeParseError struct {
161+
+ Err *time.ParseError
162+
+}
163+
+
164+
+func (e *timeParseError) Error() string {
165+
+ if e.Err.Message == "" {
166+
+ return fmt.Sprintf("parsing time as %q: cannot parse as %q", e.Err.Layout, e.Err.LayoutElem)
167+
+ }
168+
+
169+
+ return "parsing time " + e.Err.Message
170+
+}
171+
+
172+
+func (e *timeParseError) Unwrap() error { return e.Err }
173+
+
174+
+func wrapNetIPParseAddrError(err error) error {
175+
+ if err == nil {
176+
+ return nil
177+
+ }
178+
+
179+
+ if errMsg := err.Error(); strings.HasPrefix(errMsg, "ParseAddr") {
180+
+ errPieces := strings.Split(errMsg, ": ")
181+
+
182+
+ return fmt.Errorf("ParseAddr: %s", errPieces[len(errPieces)-1])
183+
+ }
184+
+
185+
+ return err
186+
+}
187+
+
188+
+func wrapNetIPParseAddrPortError(err error) error {
189+
+ if err == nil {
190+
+ return nil
191+
+ }
192+
+
193+
+ errMsg := err.Error()
194+
+ if strings.HasPrefix(errMsg, "invalid port ") {
195+
+ return errors.New("invalid port")
196+
+ } else if strings.HasPrefix(errMsg, "invalid ip:port ") {
197+
+ return errors.New("invalid ip:port")
198+
+ }
199+
+
200+
+ return err
201+
+}
202+
+
203+
+func wrapNetIPParsePrefixError(err error) error {
204+
+ if err == nil {
205+
+ return nil
206+
+ }
207+
+
208+
+ if errMsg := err.Error(); strings.HasPrefix(errMsg, "netip.ParsePrefix") {
209+
+ errPieces := strings.Split(errMsg, ": ")
210+
+
211+
+ return fmt.Errorf("netip.ParsePrefix: %s", errPieces[len(errPieces)-1])
212+
+ }
213+
+
214+
+ return err
215+
+}
216+
+
217+
+func wrapTimeParseDurationError(err error) error {
218+
+ if err == nil {
219+
+ return nil
220+
+ }
221+
+
222+
+ errMsg := err.Error()
223+
+ if strings.HasPrefix(errMsg, "time: unknown unit ") {
224+
+ return errors.New("time: unknown unit")
225+
+ } else if strings.HasPrefix(errMsg, "time: ") {
226+
+ idx := strings.LastIndex(errMsg, " ")
227+
+
228+
+ return errors.New(errMsg[:idx])
229+
+ }
230+
+
231+
+ return err
232+
+}
233+
diff --git a/vendor/github.com/mitchellh/mapstructure/mapstructure.go b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
234+
index 7581806a..4845a28f 100644
235+
--- a/vendor/github.com/mitchellh/mapstructure/mapstructure.go
236+
+++ b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
237+
@@ -642,7 +642,7 @@ func (d *Decoder) decodeInt(name string, data interface{}, val reflect.Value) er
238+
if err == nil {
239+
val.SetInt(i)
240+
} else {
241+
- return fmt.Errorf("cannot parse '%s' as int: %s", name, err)
242+
+ return fmt.Errorf("cannot parse '%s' as int: %s", name, wrapStrconvNumError(err))
243+
}
244+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
245+
jn := data.(json.Number)
246+
@@ -699,14 +699,14 @@ func (d *Decoder) decodeUint(name string, data interface{}, val reflect.Value) e
247+
if err == nil {
248+
val.SetUint(i)
249+
} else {
250+
- return fmt.Errorf("cannot parse '%s' as uint: %s", name, err)
251+
+ return fmt.Errorf("cannot parse '%s' as uint: %s", name, wrapStrconvNumError(err))
252+
}
253+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
254+
jn := data.(json.Number)
255+
i, err := strconv.ParseUint(string(jn), 0, 64)
256+
if err != nil {
257+
return fmt.Errorf(
258+
- "error decoding json.Number into %s: %s", name, err)
259+
+ "error decoding json.Number into %s: %s", name, wrapStrconvNumError(err))
260+
}
261+
val.SetUint(i)
262+
default:
263+
@@ -738,7 +738,7 @@ func (d *Decoder) decodeBool(name string, data interface{}, val reflect.Value) e
264+
} else if dataVal.String() == "" {
265+
val.SetBool(false)
266+
} else {
267+
- return fmt.Errorf("cannot parse '%s' as bool: %s", name, err)
268+
+ return fmt.Errorf("cannot parse '%s' as bool: %s", name, wrapStrconvNumError(err))
269+
}
270+
default:
271+
return fmt.Errorf(
272+
@@ -777,7 +777,7 @@ func (d *Decoder) decodeFloat(name string, data interface{}, val reflect.Value)
273+
if err == nil {
274+
val.SetFloat(f)
275+
} else {
276+
- return fmt.Errorf("cannot parse '%s' as float: %s", name, err)
277+
+ return fmt.Errorf("cannot parse '%s' as float: %s", name, wrapStrconvNumError(err))
278+
}
279+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
280+
jn := data.(json.Number)
281+
--
282+
2.45.4
283+

‎SPECS/telegraf/telegraf.spec‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: agent for collecting, processing, aggregating, and writing metrics.
22
Name: telegraf
33
Version: 1.31.0
4-
Release: 12%{?dist}
4+
Release: 13%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -25,6 +25,7 @@ Patch10: CVE-2025-30215.patch
2525
Patch11: CVE-2025-22872.patch
2626
Patch12: CVE-2025-47913.patch
2727
Patch13: CVE-2025-10543.patch
28+
Patch14: CVE-2025-11065.patch
2829

2930
BuildRequires: golang
3031
BuildRequires: systemd-devel
@@ -89,6 +90,9 @@ fi
8990
%dir %{_sysconfdir}/%{name}/telegraf.d
9091

9192
%changelog
93+
* Tue Feb 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.31.0-13
94+
- Patch for CVE-2025-11065
95+
9296
* Mon Dec 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.31.0-12
9397
- Patch for CVE-2025-10543
9498

@@ -107,7 +111,7 @@ fi
107111
* Mon Mar 31 2025 Kanishk Bansal <kanbansal@microsoft.com> - 1.31.0-7
108112
- Patch CVE-2025-30204
109113

110-
* Tue Mar 26 2025 Sreeniavsulu Malavathula <v-smalavathu@microsoft.com> - 1.31.0-6
114+
* Wed Mar 26 2025 Sreeniavsulu Malavathula <v-smalavathu@microsoft.com> - 1.31.0-6
111115
- Fix CVE-2025-22870, CVE-2024-51744 with an upstream patch
112116

113117
* Wed Mar 05 2025 Kanishk Bansal <kanbansal@microsoft.com> - 1.31.0-5

0 commit comments

Comments
 (0)