[AUTO-CHERRYPICK] Fix CVE-2022-32149 in prometheus-adapter - branch main (#10338)

Co-authored-by: sindhu-karri <33163197+sindhu-karri@users.noreply.github.com>

Author: CBL-Mariner-Bot

SPECS/prometheus-adapter/CVE-2022-32149.patch

@@ -0,0 +1,35 @@
+From 7ee36713a66401f828dfe476196ca290f7c23ffe Mon Sep 17 00:00:00 2001
+From: Sindhu Karri <lakarri@microsoft.com>
+Date: Wed, 28 Aug 2024 05:01:17 +0000
+Subject: [PATCH] Fix CVE-2022-32149
+
+---
+ vendor/golang.org/x/text/language/parse.go | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/vendor/golang.org/x/text/language/parse.go b/vendor/golang.org/x/text/language/parse.go
+index 11acfd8..11d11f4 100644
+--- a/vendor/golang.org/x/text/language/parse.go
++++ b/vendor/golang.org/x/text/language/parse.go
+@@ -133,6 +133,7 @@ func update(b *language.Builder, part ...interface{}) (err error) {
+ }
+ 
+ var errInvalidWeight = errors.New("ParseAcceptLanguage: invalid weight")
++var errTagListTooLarge = errors.New("tag list exceeds max length")
+ 
+ // ParseAcceptLanguage parses the contents of an Accept-Language header as
+ // defined in http://www.ietf.org/rfc/rfc2616.txt and returns a list of Tags and
+@@ -150,6 +151,10 @@ func ParseAcceptLanguage(s string) (tag []Tag, q []float32, err error) {
+ 
+ 		entry, weight := split(entry, ';')
+ 
++	if strings.Count(s, "-") > 1000 {
++		return nil, nil, errTagListTooLarge
++	}
++
+ 		// Scan the language.
+ 		t, err := Parse(entry)
+ 		if err != nil {
+-- 
+2.33.8
+

SPECS/prometheus-adapter/prometheus-adapter.spec

@@ -1,13 +1,14 @@
 Summary:        Kubernetes Custom, Resource, and External Metric APIs implemented to work with Prometheus.
 Name:           prometheus-adapter
 Version:        0.10.0
-Release:        13%{?dist}
+Release:        14%{?dist}
 License:        Apache-2.0
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
 URL:            https://github.com/kubernetes-sigs/prometheus-adapter
 Source0:        https://github.com/kubernetes-sigs/%{name}/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
 Patch0:         CVE-2024-24786.patch
+Patch1:         CVE-2022-32149.patch
 BuildRequires:  golang
 
 %description
@@ -42,6 +43,9 @@ make test
 %doc README.md RELEASE.md
 
 %changelog
+* Fri Aug 30 2024 Sindhu Karri <lakarri@microsoft.com> - 0.10.0-14
+- Fix CVE-2022-32149 in golang.org/x/text
+
 * Thu Jun 06 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 0.10.0-13
 - Bump release to rebuild with go 1.21.11
 
@@ -81,4 +85,4 @@ make test
 
 * Wed Feb 15 2023 Osama Esmail <osamaesmail@microsoft.com> - 0.10.0-1
 - Original version for CBL-Mariner
-- License verified.
+- License verified.