Skip to content

Commit 633ab0b

Browse files
azurelinux-securityKanishk-Bansal
azurelinux-security
and
Kanishk-Bansal
authored
[AutoPR- Security] Patch kube-vip-cloud-provider for CVE-2025-11065 [MEDIUM] (#15723)
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent ab34d3d commit 633ab0b

2 files changed

Lines changed: 283 additions & 5 deletions

File tree

‎SPECS/kube-vip-cloud-provider/CVE-2025-11065.patch‎

Lines changed: 277 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,277 @@
1+
From 1c8d41722fa9476055f51c1a547c328ea6c6e4c2 Mon Sep 17 00:00:00 2001
2+
From: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
3+
Date: Sat, 12 Jul 2025 07:25:50 +0200
4+
Subject: [PATCH] fix: error message leaks
5+
6+
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
7+
8+
Upstream Patch reference: https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c.patch
9+
10+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
11+
Upstream-reference: https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c.patch
12+
---
13+
.../mitchellh/mapstructure/decode_hooks.go | 12 +-
14+
.../mitchellh/mapstructure/error.go | 156 ++++++++++++++++++
15+
.../mitchellh/mapstructure/mapstructure.go | 8 +-
16+
3 files changed, 168 insertions(+), 8 deletions(-)
17+
18+
diff --git a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
19+
index 1f0abc6..4f70b03 100644
20+
--- a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
21+
+++ b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
22+
@@ -113,7 +113,9 @@ func StringToTimeDurationHookFunc() DecodeHookFunc {
23+
}
24+
25+
// Convert it by parsing
26+
- return time.ParseDuration(data.(string))
27+
+ d, err := time.ParseDuration(data.(string))
28+
+
29+
+ return d, wrapTimeParseDurationError(err)
30+
}
31+
}
32+
33+
@@ -134,7 +136,7 @@ func StringToIPHookFunc() DecodeHookFunc {
34+
// Convert it by parsing
35+
ip := net.ParseIP(data.(string))
36+
if ip == nil {
37+
- return net.IP{}, fmt.Errorf("failed parsing ip %v", data)
38+
+ return net.IP{}, fmt.Errorf("failed parsing ip")
39+
}
40+
41+
return ip, nil
42+
@@ -157,7 +159,7 @@ func StringToIPNetHookFunc() DecodeHookFunc {
43+
44+
// Convert it by parsing
45+
_, net, err := net.ParseCIDR(data.(string))
46+
- return net, err
47+
+ return net, wrapNetParseError(err)
48+
}
49+
}
50+
51+
@@ -176,7 +178,9 @@ func StringToTimeHookFunc(layout string) DecodeHookFunc {
52+
}
53+
54+
// Convert it by parsing
55+
- return time.Parse(layout, data.(string))
56+
+ ti, err := time.Parse(layout, data.(string))
57+
+
58+
+ return ti, wrapTimeParseError(err)
59+
}
60+
}
61+
62+
diff --git a/vendor/github.com/mitchellh/mapstructure/error.go b/vendor/github.com/mitchellh/mapstructure/error.go
63+
index 47a99e5..8c3b078 100644
64+
--- a/vendor/github.com/mitchellh/mapstructure/error.go
65+
+++ b/vendor/github.com/mitchellh/mapstructure/error.go
66+
@@ -3,8 +3,12 @@ package mapstructure
67+
import (
68+
"errors"
69+
"fmt"
70+
+ "net"
71+
+ "net/url"
72+
"sort"
73+
+ "strconv"
74+
"strings"
75+
+ "time"
76+
)
77+
78+
// Error implements the error interface and can represents multiple
79+
@@ -48,3 +52,155 @@ func appendErrors(errors []string, err error) []string {
80+
return append(errors, e.Error())
81+
}
82+
}
83+
+
84+
+func wrapStrconvNumError(err error) error {
85+
+ if err == nil {
86+
+ return nil
87+
+ }
88+
+
89+
+ if err, ok := err.(*strconv.NumError); ok {
90+
+ return &strconvNumError{Err: err}
91+
+ }
92+
+
93+
+ return err
94+
+}
95+
+
96+
+type strconvNumError struct {
97+
+ Err *strconv.NumError
98+
+}
99+
+
100+
+func (e *strconvNumError) Error() string {
101+
+ return "strconv." + e.Err.Func + ": " + e.Err.Err.Error()
102+
+}
103+
+
104+
+func (e *strconvNumError) Unwrap() error { return e.Err }
105+
+
106+
+func wrapUrlError(err error) error {
107+
+ if err == nil {
108+
+ return nil
109+
+ }
110+
+
111+
+ if err, ok := err.(*url.Error); ok {
112+
+ return &urlError{Err: err}
113+
+ }
114+
+
115+
+ return err
116+
+}
117+
+
118+
+type urlError struct {
119+
+ Err *url.Error
120+
+}
121+
+
122+
+func (e *urlError) Error() string {
123+
+ return fmt.Sprintf("%s", e.Err.Err)
124+
+}
125+
+
126+
+func (e *urlError) Unwrap() error { return e.Err }
127+
+
128+
+func wrapNetParseError(err error) error {
129+
+ if err == nil {
130+
+ return nil
131+
+ }
132+
+
133+
+ if err, ok := err.(*net.ParseError); ok {
134+
+ return &netParseError{Err: err}
135+
+ }
136+
+
137+
+ return err
138+
+}
139+
+
140+
+type netParseError struct {
141+
+ Err *net.ParseError
142+
+}
143+
+
144+
+func (e *netParseError) Error() string {
145+
+ return "invalid " + e.Err.Type
146+
+}
147+
+
148+
+func (e *netParseError) Unwrap() error { return e.Err }
149+
+
150+
+func wrapTimeParseError(err error) error {
151+
+ if err == nil {
152+
+ return nil
153+
+ }
154+
+
155+
+ if err, ok := err.(*time.ParseError); ok {
156+
+ return &timeParseError{Err: err}
157+
+ }
158+
+
159+
+ return err
160+
+}
161+
+
162+
+type timeParseError struct {
163+
+ Err *time.ParseError
164+
+}
165+
+
166+
+func (e *timeParseError) Error() string {
167+
+ if e.Err.Message == "" {
168+
+ return fmt.Sprintf("parsing time as %q: cannot parse as %q", e.Err.Layout, e.Err.LayoutElem)
169+
+ }
170+
+
171+
+ return "parsing time " + e.Err.Message
172+
+}
173+
+
174+
+func (e *timeParseError) Unwrap() error { return e.Err }
175+
+
176+
+func wrapNetIPParseAddrError(err error) error {
177+
+ if err == nil {
178+
+ return nil
179+
+ }
180+
+
181+
+ if errMsg := err.Error(); strings.HasPrefix(errMsg, "ParseAddr") {
182+
+ errPieces := strings.Split(errMsg, ": ")
183+
+
184+
+ return fmt.Errorf("ParseAddr: %s", errPieces[len(errPieces)-1])
185+
+ }
186+
+
187+
+ return err
188+
+}
189+
+
190+
+func wrapNetIPParseAddrPortError(err error) error {
191+
+ if err == nil {
192+
+ return nil
193+
+ }
194+
+
195+
+ errMsg := err.Error()
196+
+ if strings.HasPrefix(errMsg, "invalid port ") {
197+
+ return errors.New("invalid port")
198+
+ } else if strings.HasPrefix(errMsg, "invalid ip:port ") {
199+
+ return errors.New("invalid ip:port")
200+
+ }
201+
+
202+
+ return err
203+
+}
204+
+
205+
+func wrapNetIPParsePrefixError(err error) error {
206+
+ if err == nil {
207+
+ return nil
208+
+ }
209+
+
210+
+ if errMsg := err.Error(); strings.HasPrefix(errMsg, "netip.ParsePrefix") {
211+
+ errPieces := strings.Split(errMsg, ": ")
212+
+
213+
+ return fmt.Errorf("netip.ParsePrefix: %s", errPieces[len(errPieces)-1])
214+
+ }
215+
+
216+
+ return err
217+
+}
218+
+
219+
+func wrapTimeParseDurationError(err error) error {
220+
+ if err == nil {
221+
+ return nil
222+
+ }
223+
+
224+
+ errMsg := err.Error()
225+
+ if strings.HasPrefix(errMsg, "time: unknown unit ") {
226+
+ return errors.New("time: unknown unit")
227+
+ } else if strings.HasPrefix(errMsg, "time: ") {
228+
+ idx := strings.LastIndex(errMsg, " ")
229+
+
230+
+ return errors.New(errMsg[:idx])
231+
+ }
232+
+
233+
+ return err
234+
+}
235+
diff --git a/vendor/github.com/mitchellh/mapstructure/mapstructure.go b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
236+
index 256ee63..8ef71ad 100644
237+
--- a/vendor/github.com/mitchellh/mapstructure/mapstructure.go
238+
+++ b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
239+
@@ -416,7 +416,7 @@ func (d *Decoder) decodeInt(name string, data interface{}, val reflect.Value) er
240+
if err == nil {
241+
val.SetInt(i)
242+
} else {
243+
- return fmt.Errorf("cannot parse '%s' as int: %s", name, err)
244+
+ return fmt.Errorf("cannot parse '%s' as int: %s", name, wrapStrconvNumError(err))
245+
}
246+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
247+
jn := data.(json.Number)
248+
@@ -467,7 +467,7 @@ func (d *Decoder) decodeUint(name string, data interface{}, val reflect.Value) e
249+
if err == nil {
250+
val.SetUint(i)
251+
} else {
252+
- return fmt.Errorf("cannot parse '%s' as uint: %s", name, err)
253+
+ return fmt.Errorf("cannot parse '%s' as uint: %s", name, wrapStrconvNumError(err))
254+
}
255+
default:
256+
return fmt.Errorf(
257+
@@ -498,7 +498,7 @@ func (d *Decoder) decodeBool(name string, data interface{}, val reflect.Value) e
258+
} else if dataVal.String() == "" {
259+
val.SetBool(false)
260+
} else {
261+
- return fmt.Errorf("cannot parse '%s' as bool: %s", name, err)
262+
+ return fmt.Errorf("cannot parse '%s' as bool: %s", name, wrapStrconvNumError(err))
263+
}
264+
default:
265+
return fmt.Errorf(
266+
@@ -532,7 +532,7 @@ func (d *Decoder) decodeFloat(name string, data interface{}, val reflect.Value)
267+
if err == nil {
268+
val.SetFloat(f)
269+
} else {
270+
- return fmt.Errorf("cannot parse '%s' as float: %s", name, err)
271+
+ return fmt.Errorf("cannot parse '%s' as float: %s", name, wrapStrconvNumError(err))
272+
}
273+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
274+
jn := data.(json.Number)
275+
--
276+
2.45.4
277+

‎SPECS/kube-vip-cloud-provider/kube-vip-cloud-provider.spec‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: The Kube-Vip cloud provider functions as a general-purpose cloud provider for on-premises bare-metal or virtualized setups
22
Name: kube-vip-cloud-provider
33
Version: 0.0.2
4-
Release: 24%{?dist}
4+
Release: 25%{?dist}
55
License: ASL 2.0
66
URL: https://github.com/kube-vip/kube-vip-cloud-provider
77
Group: Applications/Text
@@ -29,16 +29,14 @@ Patch4: CVE-2025-27144.patch
2929
Patch5: CVE-2022-3162.patch
3030
Patch6: CVE-2024-51744.patch
3131
Patch7: CVE-2025-65637.patch
32+
Patch8: CVE-2025-11065.patch
3233
BuildRequires: golang
3334

3435
%description
3536
The Kube-Vip cloud provider functions as a general-purpose cloud provider for on-premises bare-metal or virtualized setups.
3637

3738
%prep
38-
%autosetup -N
39-
# Apply vendor before patching
40-
tar -xvf %{SOURCE1}
41-
%autopatch -p1
39+
%autosetup -a 1 -p1
4240

4341
%build
4442
go build -mod=vendor
@@ -54,6 +52,9 @@ go test -mod=vendor ./...
5452
%{_bindir}/kube-vip-cloud-provider
5553

5654
%changelog
55+
* Wed Feb 04 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 0.0.2-25
56+
- Patch for CVE-2025-11065
57+
5758
* Mon Dec 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 0.0.2-24
5859
- Patch for CVE-2025-65637
5960

0 commit comments

Comments
 (0)