Skip to content

Commit 42923d3

Browse files
[AUTO-CHERRYPICK] Patch reaper for CVE-2024-12905 [HIGH] - branch main (#13350)
Co-authored-by: Sandeep Karambelkar <skarambelkar@microsoft.com>
1 parent ea3243c commit 42923d3

2 files changed

Lines changed: 82 additions & 1 deletion

File tree

SPECS/reaper/CVE-2024-12905.patch

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
From 7f2ff2574edbb046718122175286c08cf53511ba Mon Sep 17 00:00:00 2001
2+
From: Mathias Buus <mathiasbuus@gmail.com>
3+
Date: Sun, 12 Jan 2025 11:53:11 +0100
4+
Subject: [PATCH] refactor and throw on bad symlink
5+
6+
Upstream Patch Reference : https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed
7+
---
8+
.../bower/lib/node_modules/tar-fs/index.js | 15 ++++++++++++---
9+
.../bower/lib/node_modules/tar-fs/test/index.js | 2 +-
10+
2 files changed, 13 insertions(+), 4 deletions(-)
11+
12+
diff --git a/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js b/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js
13+
index 4d67485..3fd93bc 100644
14+
--- a/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js
15+
+++ b/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/index.js
16+
@@ -173,6 +173,8 @@ exports.extract = function (cwd, opts) {
17+
if (!cwd) cwd = '.'
18+
if (!opts) opts = {}
19+
20+
+ cwd = path.resolve(cwd)
21+
+
22+
var xfs = opts.fs || fs
23+
var ignore = opts.ignore || opts.filter || noop
24+
var map = opts.map || noop
25+
@@ -254,6 +256,9 @@ exports.extract = function (cwd, opts) {
26+
var onsymlink = function () {
27+
if (win32) return next() // skip symlinks on win for now before it can be tested
28+
xfs.unlink(name, function () {
29+
+ var dst = path.resolve(path.dirname(name), header.linkname)
30+
+ if (!inCwd(dst)) return next(new Error(name + ' is not a valid symlink'))
31+
+
32+
xfs.symlink(header.linkname, name, stat)
33+
})
34+
}
35+
@@ -261,11 +266,11 @@ exports.extract = function (cwd, opts) {
36+
var onlink = function () {
37+
if (win32) return next() // skip links on win for now before it can be tested
38+
xfs.unlink(name, function () {
39+
- var srcpath = path.join(cwd, path.join('/', header.linkname))
40+
+ var dst = path.join(cwd, path.join('/', header.linkname))
41+
42+
- xfs.link(srcpath, name, function (err) {
43+
+ xfs.link(dst, name, function (err) {
44+
if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) {
45+
- stream = xfs.createReadStream(srcpath)
46+
+ stream = xfs.createReadStream(dst)
47+
return onfile()
48+
}
49+
50+
@@ -274,6 +279,10 @@ exports.extract = function (cwd, opts) {
51+
})
52+
}
53+
54+
+ var inCwd = function (dst) {
55+
+ return dst.startsWith(cwd)
56+
+ }
57+
+
58+
var onfile = function () {
59+
var ws = xfs.createWriteStream(name)
60+
var rs = mapStream(stream, header)
61+
diff --git a/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/test/index.js b/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/test/index.js
62+
index a03844e..cbe2ac2 100644
63+
--- a/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/test/index.js
64+
+++ b/tmp_local/lib/node_modules/bower/lib/node_modules/tar-fs/test/index.js
65+
@@ -304,7 +304,7 @@ test('do not extract invalid tar', function (t) {
66+
fs.createReadStream(a)
67+
.pipe(tar.extract(out))
68+
.on('error', function (err) {
69+
- t.ok(/is not a valid path/i.test(err.message))
70+
+ t.ok(/is not a valid symlink/i.test(err.message))
71+
fs.stat(path.join(out, '../bar'), function (err) {
72+
t.ok(err)
73+
t.end()
74+
--
75+
2.40.4
76+

SPECS/reaper/reaper.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
Summary: Reaper for cassandra is a tool for running Apache Cassandra repairs against single or multi-site clusters.
77
Name: reaper
88
Version: 3.1.1
9-
Release: 17%{?dist}
9+
Release: 18%{?dist}
1010
License: ASL 2.0
1111
Vendor: Microsoft Corporation
1212
Distribution: Mariner
@@ -48,6 +48,7 @@ Patch12: CVE-2020-28458.patch
4848
Patch13: CVE-2024-52798.patch
4949
Patch14: CVE-2020-24025.patch
5050
Patch15: CVE-2024-28863.patch
51+
Patch16: CVE-2024-12905.patch
5152

5253
BuildRequires: git
5354
BuildRequires: javapackages-tools
@@ -113,6 +114,7 @@ popd
113114
pushd $tmp_local_dir/n/versions/node/14.18.0/lib/node_modules/
114115
%autopatch -p1 15
115116
popd
117+
%autopatch -p1 16
116118

117119
rsync -azvhr $tmp_local_dir/ "%{_prefix}/local"
118120
rm -rf $tmp_local_dir
@@ -190,6 +192,9 @@ fi
190192
%{_unitdir}/cassandra-%{name}.service
191193

192194
%changelog
195+
* Fri Apr 04 2025 Sandeep Karambelkar (skarambelkar@microsoft.com> - 3.1.1-18
196+
- Add patch to fix CVE-2024-12905
197+
193198
* Thu Mar 13 2025 Kevin Lockwood <v-klockwood@microsoft.com> - 3.1.1-17
194199
- Patch CVE-2024-28863
195200

0 commit comments

Comments
 (0)