Skip to content

Commit 4a9ab9d

Browse files
[AUTO-CHERRYPICK] Patch nodejs for CVE-2025-27516 [Medium] - branch main (#12950)
Co-authored-by: Sandeep Karambelkar <skarambelkar@microsoft.com>
1 parent 59d25ec commit 4a9ab9d

2 files changed

Lines changed: 69 additions & 1 deletion

File tree

SPECS/nodejs/CVE-2025-27516.patch

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
From 01e50061072389bc315db7c55e5489eb5370a5f7 Mon Sep 17 00:00:00 2001
2+
From: David Lord <davidism@gmail.com>
3+
Date: Wed, 5 Mar 2025 10:08:48 -0800
4+
Subject: [PATCH] attr filter uses env.getattr
5+
6+
---
7+
deps/v8/third_party/jinja2/filters.py | 30 +++++++++++----------------
8+
1 file changed, 12 insertions(+), 18 deletions(-)
9+
10+
diff --git a/deps/v8/third_party/jinja2/filters.py b/deps/v8/third_party/jinja2/filters.py
11+
index 1daf42bc..e71cb5ca 100644
12+
--- a/deps/v8/third_party/jinja2/filters.py
13+
+++ b/deps/v8/third_party/jinja2/filters.py
14+
@@ -5,6 +5,7 @@ import random
15+
import re
16+
import warnings
17+
from collections import namedtuple
18+
+from inspect import getattr_static
19+
from itertools import chain
20+
from itertools import groupby
21+
22+
@@ -1072,28 +1073,21 @@ def do_reverse(value):
23+
@environmentfilter
24+
def do_attr(environment, obj, name):
25+
"""Get an attribute of an object. ``foo|attr("bar")`` works like
26+
- ``foo.bar`` just that always an attribute is returned and items are not
27+
- looked up.
28+
+ ``foo.bar``, but returns undefined instead of falling back to ``foo["bar"]``
29+
+ if the attribute doesn't exist.
30+
31+
See :ref:`Notes on subscriptions <notes-on-subscriptions>` for more details.
32+
"""
33+
try:
34+
- name = str(name)
35+
- except UnicodeError:
36+
- pass
37+
- else:
38+
- try:
39+
- value = getattr(obj, name)
40+
- except AttributeError:
41+
- pass
42+
- else:
43+
- if environment.sandboxed and not environment.is_safe_attribute(
44+
- obj, name, value
45+
- ):
46+
- return environment.unsafe_undefined(obj, name)
47+
- return value
48+
- return environment.undefined(obj=obj, name=name)
49+
-
50+
+ # This avoids executing properties/descriptors, but misses __getattr__
51+
+ # and __getattribute__ dynamic attrs.
52+
+ getattr_static(obj, name)
53+
+ except AttributeError:
54+
+ # This finds dynamic attrs, and we know it's not a descriptor at this point.
55+
+ if not hasattr(obj, name):
56+
+ return environment.undefined(obj=obj, name=name)
57+
+
58+
+ return environment.getattr(obj, name)
59+
60+
@contextfilter
61+
def do_map(*args, **kwargs):
62+
--
63+
2.40.4
64+

SPECS/nodejs/nodejs18.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Name: nodejs18
66
# WARNINGS: MUST check and update the 'npm_version' macro for every version update of this package.
77
# The version of NPM can be found inside the sources under 'deps/npm/package.json'.
88
Version: 18.20.3
9-
Release: 4%{?dist}
9+
Release: 5%{?dist}
1010
License: BSD and MIT and Public Domain and NAIST-2003 and Artistic-2.0
1111
Group: Applications/System
1212
Vendor: Microsoft Corporation
@@ -23,6 +23,7 @@ Patch3: CVE-2025-23085.patch
2323
Patch4: CVE-2024-22020.patch
2424
Patch5: CVE-2024-22195.patch
2525
Patch6: CVE-2024-34064.patch
26+
Patch7: CVE-2025-27516.patch
2627
BuildRequires: brotli-devel
2728
BuildRequires: coreutils >= 8.22
2829
BuildRequires: gcc
@@ -123,6 +124,9 @@ make cctest
123124
%{_datadir}/systemtap/tapset/node.stp
124125

125126
%changelog
127+
* Mon Mar 10 2025 Sandeep Karambelkar <skarambelkar@microsoft.com> - 18.20.3-5
128+
- Patch CVE-2025-27516
129+
126130
* Tue Feb 18 2025 Kevin Lockwood <v-klockwood@microsoft.com> - 18.20.3-4
127131
- Patch CVE-2024-34064
128132

0 commit comments

Comments
 (0)