Skip to content

Commit 6798528

Browse files
azurelinux-securityKanishk-Bansal
azurelinux-security
and
Kanishk-Bansal
authored
[AutoPR- Security] Patch gh for CVE-2026-24117, CVE-2025-58190, CVE-2025-47911 [MEDIUM] (#15937)
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent 1c56ad8 commit 6798528

4 files changed

Lines changed: 344 additions & 3 deletions

File tree

‎SPECS/gh/CVE-2025-47911.patch‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
From efa0c0b048d06c59902b0c9701e1ebd7ecbb98fc Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <roland@golang.org>
3+
Date: Mon, 29 Sep 2025 16:33:18 -0700
4+
Subject: [PATCH] html: impose open element stack size limit
5+
6+
The HTML specification contains a number of algorithms which are
7+
quadratic in complexity by design. Instead of adding complicated
8+
workarounds to prevent these cases from becoming extremely expensive in
9+
pathological cases, we impose a limit of 512 to the size of the stack of
10+
open elements. It is extremely unlikely that non-adversarial HTML
11+
documents will ever hit this limit (but if we see cases of this, we may
12+
want to make the limit configurable via a ParseOption).
13+
14+
Thanks to Guido Vranken and Jakub Ciolek for both independently
15+
reporting this issue.
16+
17+
Fixes CVE-2025-47911
18+
Fixes golang/go#75682
19+
20+
Change-Id: I890517b189af4ffbf427d25d3fde7ad7ec3509ad
21+
Reviewed-on: https://go-review.googlesource.com/c/net/+/709876
22+
Reviewed-by: Damien Neil <dneil@google.com>
23+
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
24+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
25+
Upstream-reference: https://github.com/golang/net/commit/59706cdaa8f95502fdec64b67b4c61d6ca58727d.patch
26+
---
27+
vendor/golang.org/x/net/html/escape.go | 2 +-
28+
vendor/golang.org/x/net/html/parse.go | 21 +++++++++++++++++----
29+
2 files changed, 18 insertions(+), 5 deletions(-)
30+
31+
diff --git a/vendor/golang.org/x/net/html/escape.go b/vendor/golang.org/x/net/html/escape.go
32+
index 04c6bec..12f2273 100644
33+
--- a/vendor/golang.org/x/net/html/escape.go
34+
+++ b/vendor/golang.org/x/net/html/escape.go
35+
@@ -299,7 +299,7 @@ func escape(w writer, s string) error {
36+
case '\r':
37+
esc = "&#13;"
38+
default:
39+
- panic("unrecognized escape character")
40+
+ panic("html: unrecognized escape character")
41+
}
42+
s = s[i+1:]
43+
if _, err := w.WriteString(esc); err != nil {
44+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
45+
index 979ef17..4d12a1c 100644
46+
--- a/vendor/golang.org/x/net/html/parse.go
47+
+++ b/vendor/golang.org/x/net/html/parse.go
48+
@@ -231,7 +231,14 @@ func (p *parser) addChild(n *Node) {
49+
}
50+
51+
if n.Type == ElementNode {
52+
- p.oe = append(p.oe, n)
53+
+ p.insertOpenElement(n)
54+
+ }
55+
+}
56+
+
57+
+func (p *parser) insertOpenElement(n *Node) {
58+
+ p.oe = append(p.oe, n)
59+
+ if len(p.oe) > 512 {
60+
+ panic("html: open stack of elements exceeds 512 nodes")
61+
}
62+
}
63+
64+
@@ -810,7 +817,7 @@ func afterHeadIM(p *parser) bool {
65+
p.im = inFramesetIM
66+
return true
67+
case a.Base, a.Basefont, a.Bgsound, a.Link, a.Meta, a.Noframes, a.Script, a.Style, a.Template, a.Title:
68+
- p.oe = append(p.oe, p.head)
69+
+ p.insertOpenElement(p.head)
70+
defer p.oe.remove(p.head)
71+
return inHeadIM(p)
72+
case a.Head:
73+
@@ -2320,9 +2327,13 @@ func (p *parser) parseCurrentToken() {
74+
}
75+
}
76+
77+
-func (p *parser) parse() error {
78+
+func (p *parser) parse() (err error) {
79+
+ defer func() {
80+
+ if panicErr := recover(); panicErr != nil {
81+
+ err = fmt.Errorf("%s", panicErr)
82+
+ }
83+
+ }()
84+
// Iterate until EOF. Any other error will cause an early return.
85+
- var err error
86+
for err != io.EOF {
87+
// CDATA sections are allowed only in foreign content.
88+
n := p.oe.top()
89+
@@ -2351,6 +2362,8 @@ func (p *parser) parse() error {
90+
// <tag>s. Conversely, explicit <tag>s in r's data can be silently dropped,
91+
// with no corresponding node in the resulting tree.
92+
//
93+
+// Parse will reject HTML that is nested deeper than 512 elements.
94+
+//
95+
// The input is assumed to be UTF-8 encoded.
96+
func Parse(r io.Reader) (*Node, error) {
97+
return ParseWithOptions(r)
98+
--
99+
2.45.4
100+

‎SPECS/gh/CVE-2025-58190.patch‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
From e2c662dd99d0e7e7160fd88f3c41ccdba657f7f5 Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <roland@golang.org>
3+
Date: Mon, 29 Sep 2025 19:38:24 -0700
4+
Subject: [PATCH] html: align in row insertion mode with spec
5+
6+
Update inRowIM to match the HTML specification. This fixes an issue
7+
where a specific HTML document could cause the parser to enter an
8+
infinite loop when trying to parse a </tbody> and implied </tr> next to
9+
each other.
10+
11+
Fixes CVE-2025-58190
12+
Fixes golang/go#70179
13+
14+
Change-Id: Idcb133c87c7d475cc8c7eb1f1550ea21d8bdddea
15+
Reviewed-on: https://go-review.googlesource.com/c/net/+/709875
16+
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
17+
Reviewed-by: Damien Neil <dneil@google.com>
18+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
19+
Upstream-reference: https://github.com/golang/net/commit/6ec8895aa5f6594da7356da7d341b98133629009.patch
20+
---
21+
vendor/golang.org/x/net/html/parse.go | 36 ++++++++++++++++++---------
22+
1 file changed, 24 insertions(+), 12 deletions(-)
23+
24+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
25+
index 5b8374b..979ef17 100644
26+
--- a/vendor/golang.org/x/net/html/parse.go
27+
+++ b/vendor/golang.org/x/net/html/parse.go
28+
@@ -136,7 +136,7 @@ func (p *parser) indexOfElementInScope(s scope, matchTags ...a.Atom) int {
29+
return -1
30+
}
31+
default:
32+
- panic("unreachable")
33+
+ panic(fmt.Sprintf("html: internal error: indexOfElementInScope unknown scope: %d", s))
34+
}
35+
}
36+
switch s {
37+
@@ -179,7 +179,7 @@ func (p *parser) clearStackToContext(s scope) {
38+
return
39+
}
40+
default:
41+
- panic("unreachable")
42+
+ panic(fmt.Sprintf("html: internal error: clearStackToContext unknown scope: %d", s))
43+
}
44+
}
45+
}
46+
@@ -1674,7 +1674,7 @@ func inTableBodyIM(p *parser) bool {
47+
return inTableIM(p)
48+
}
49+
50+
-// Section 12.2.6.4.14.
51+
+// Section 13.2.6.4.14.
52+
func inRowIM(p *parser) bool {
53+
switch p.tok.Type {
54+
case StartTagToken:
55+
@@ -1686,7 +1686,9 @@ func inRowIM(p *parser) bool {
56+
p.im = inCellIM
57+
return true
58+
case a.Caption, a.Col, a.Colgroup, a.Tbody, a.Tfoot, a.Thead, a.Tr:
59+
- if p.popUntil(tableScope, a.Tr) {
60+
+ if p.elementInScope(tableScope, a.Tr) {
61+
+ p.clearStackToContext(tableRowScope)
62+
+ p.oe.pop()
63+
p.im = inTableBodyIM
64+
return false
65+
}
66+
@@ -1696,22 +1698,28 @@ func inRowIM(p *parser) bool {
67+
case EndTagToken:
68+
switch p.tok.DataAtom {
69+
case a.Tr:
70+
- if p.popUntil(tableScope, a.Tr) {
71+
+ if p.elementInScope(tableScope, a.Tr) {
72+
+ p.clearStackToContext(tableRowScope)
73+
+ p.oe.pop()
74+
p.im = inTableBodyIM
75+
return true
76+
}
77+
// Ignore the token.
78+
return true
79+
case a.Table:
80+
- if p.popUntil(tableScope, a.Tr) {
81+
+ if p.elementInScope(tableScope, a.Tr) {
82+
+ p.clearStackToContext(tableRowScope)
83+
+ p.oe.pop()
84+
p.im = inTableBodyIM
85+
return false
86+
}
87+
// Ignore the token.
88+
return true
89+
case a.Tbody, a.Tfoot, a.Thead:
90+
- if p.elementInScope(tableScope, p.tok.DataAtom) {
91+
- p.parseImpliedToken(EndTagToken, a.Tr, a.Tr.String())
92+
+ if p.elementInScope(tableScope, p.tok.DataAtom) && p.elementInScope(tableScope, a.Tr) {
93+
+ p.clearStackToContext(tableRowScope)
94+
+ p.oe.pop()
95+
+ p.im = inTableBodyIM
96+
return false
97+
}
98+
// Ignore the token.
99+
@@ -2218,16 +2226,20 @@ func parseForeignContent(p *parser) bool {
100+
p.acknowledgeSelfClosingTag()
101+
}
102+
case EndTagToken:
103+
+ if strings.EqualFold(p.oe[len(p.oe)-1].Data, p.tok.Data) {
104+
+ p.oe = p.oe[:len(p.oe)-1]
105+
+ return true
106+
+ }
107+
for i := len(p.oe) - 1; i >= 0; i-- {
108+
- if p.oe[i].Namespace == "" {
109+
- return p.im(p)
110+
- }
111+
if strings.EqualFold(p.oe[i].Data, p.tok.Data) {
112+
p.oe = p.oe[:i]
113+
+ return true
114+
+ }
115+
+ if i > 0 && p.oe[i-1].Namespace == "" {
116+
break
117+
}
118+
}
119+
- return true
120+
+ return p.im(p)
121+
default:
122+
// Ignore the token.
123+
}
124+
--
125+
2.45.4
126+

‎SPECS/gh/CVE-2026-24117.patch‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
From c6fd08c83115ce2f69a82923499c60794ebc3908 Mon Sep 17 00:00:00 2001
2+
From: Hayden <8418760+Hayden-IO@users.noreply.github.com>
3+
Date: Wed, 21 Jan 2026 16:52:44 -0800
4+
Subject: [PATCH] Drop support for fetching public keys by URL in the search
5+
index (#2731)
6+
7+
This mitigates blind SSRF. Note that this API was marked as experimental
8+
so while this is a breaking change to the API, we offered no guarantee
9+
of stability.
10+
11+
Fixes GHSA-4c4x-jm2x-pf9j
12+
13+
Signed-off-by: Hayden <8418760+Hayden-IO@users.noreply.github.com>
14+
15+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
16+
Upstream Patch reference: https://github.com/sigstore/rekor/commit/60ef2bceba192c5bf9327d003bceea8bf1f8275f.patch
17+
---
18+
.../client/entries/entries_client.go | 2 +-
19+
.../pkg/generated/models/search_index.go | 20 -------------------
20+
.../sigstore/rekor/pkg/util/fetch.go | 10 +++++++---
21+
3 files changed, 8 insertions(+), 24 deletions(-)
22+
23+
diff --git a/vendor/github.com/sigstore/rekor/pkg/generated/client/entries/entries_client.go b/vendor/github.com/sigstore/rekor/pkg/generated/client/entries/entries_client.go
24+
index fe2630e..668ec29 100644
25+
--- a/vendor/github.com/sigstore/rekor/pkg/generated/client/entries/entries_client.go
26+
+++ b/vendor/github.com/sigstore/rekor/pkg/generated/client/entries/entries_client.go
27+
@@ -58,7 +58,7 @@ type ClientService interface {
28+
/*
29+
CreateLogEntry creates an entry in the transparency log
30+
31+
-Creates an entry in the transparency log for a detached signature, public key, and content. Items can be included in the request or fetched by the server when URLs are specified.
32+
+Creates an entry in the transparency log for a detached signature, public key, and content.
33+
*/
34+
func (a *Client) CreateLogEntry(params *CreateLogEntryParams, opts ...ClientOption) (*CreateLogEntryCreated, error) {
35+
// TODO: Validate the params before sending
36+
diff --git a/vendor/github.com/sigstore/rekor/pkg/generated/models/search_index.go b/vendor/github.com/sigstore/rekor/pkg/generated/models/search_index.go
37+
index bb1cccc..e731a3b 100644
38+
--- a/vendor/github.com/sigstore/rekor/pkg/generated/models/search_index.go
39+
+++ b/vendor/github.com/sigstore/rekor/pkg/generated/models/search_index.go
40+
@@ -229,10 +229,6 @@ type SearchIndexPublicKey struct {
41+
// Required: true
42+
// Enum: [pgp x509 minisign ssh tuf]
43+
Format *string `json:"format"`
44+
-
45+
- // url
46+
- // Format: uri
47+
- URL strfmt.URI `json:"url,omitempty"`
48+
}
49+
50+
// Validate validates this search index public key
51+
@@ -243,10 +239,6 @@ func (m *SearchIndexPublicKey) Validate(formats strfmt.Registry) error {
52+
res = append(res, err)
53+
}
54+
55+
- if err := m.validateURL(formats); err != nil {
56+
- res = append(res, err)
57+
- }
58+
-
59+
if len(res) > 0 {
60+
return errors.CompositeValidationError(res...)
61+
}
62+
@@ -305,18 +297,6 @@ func (m *SearchIndexPublicKey) validateFormat(formats strfmt.Registry) error {
63+
return nil
64+
}
65+
66+
-func (m *SearchIndexPublicKey) validateURL(formats strfmt.Registry) error {
67+
- if swag.IsZero(m.URL) { // not required
68+
- return nil
69+
- }
70+
-
71+
- if err := validate.FormatOf("publicKey"+"."+"url", "body", "uri", m.URL.String(), formats); err != nil {
72+
- return err
73+
- }
74+
-
75+
- return nil
76+
-}
77+
-
78+
// ContextValidate validates this search index public key based on context it is used
79+
func (m *SearchIndexPublicKey) ContextValidate(ctx context.Context, formats strfmt.Registry) error {
80+
return nil
81+
diff --git a/vendor/github.com/sigstore/rekor/pkg/util/fetch.go b/vendor/github.com/sigstore/rekor/pkg/util/fetch.go
82+
index 7f8e93f..5c5c464 100644
83+
--- a/vendor/github.com/sigstore/rekor/pkg/util/fetch.go
84+
+++ b/vendor/github.com/sigstore/rekor/pkg/util/fetch.go
85+
@@ -21,14 +21,18 @@ import (
86+
"fmt"
87+
"io"
88+
"net/http"
89+
+ "time"
90+
)
91+
92+
-// FileOrURLReadCloser Note: caller is responsible for closing ReadCloser returned from method!
93+
+// FileOrURLReadCloser reads content either from a URL or a byte slice
94+
+// Note: Caller is responsible for closing the returned ReadCloser
95+
+// Note: This must never be called from any server codepath to prevent SSRF
96+
func FileOrURLReadCloser(ctx context.Context, url string, content []byte) (io.ReadCloser, error) {
97+
var dataReader io.ReadCloser
98+
if url != "" {
99+
- //TODO: set timeout here, SSL settings?
100+
- client := &http.Client{}
101+
+ client := &http.Client{
102+
+ Timeout: 30 * time.Second,
103+
+ }
104+
req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
105+
if err != nil {
106+
return nil, err
107+
--
108+
2.45.4
109+

‎SPECS/gh/gh.spec‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: GitHub official command line tool
22
Name: gh
33
Version: 2.62.0
4-
Release: 12%{?dist}
4+
Release: 13%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -27,6 +27,9 @@ Patch11: CVE-2025-58183.patch
2727
Patch12: CVE-2026-23991.patch
2828
Patch13: CVE-2026-23992.patch
2929
Patch14: CVE-2025-11065.patch
30+
Patch15: CVE-2025-47911.patch
31+
Patch16: CVE-2025-58190.patch
32+
Patch17: CVE-2026-24117.patch
3033

3134
BuildRequires: golang < 1.24
3235
BuildRequires: git
@@ -71,6 +74,9 @@ make test
7174
%{_datadir}/zsh/site-functions/_gh
7275

7376
%changelog
77+
* Fri Feb 20 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.62.0-13
78+
- Patch for CVE-2026-24117, CVE-2025-58190, CVE-2025-47911
79+
7480
* Tue Feb 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.62.0-12
7581
- Patch for CVE-2025-11065
7682

@@ -92,10 +98,10 @@ make test
9298
* Fri Feb 21 2025 Kshitiz Godara <kgodara@microsoft.com> - 2.62.0-6
9399
- Patch CVE-2025-25204
94100

95-
* Wed Jan 21 2025 Sandeep Karambelkar <skarambelkar@microsoft.com> - 2.62.0-5
101+
* Tue Jan 21 2025 Sandeep Karambelkar <skarambelkar@microsoft.com> - 2.62.0-5
96102
- Patch CVE-2024-53859, CVE-2024-53858
97103

98-
* Tue Dec 31 2024 Rohit Rawat <rohitrawat@microsoft.com> - 2.62.0-4
104+
* Sat Jan 18 2025 Rohit Rawat <rohitrawat@microsoft.com> - 2.62.0-4
99105
- Add patch for CVE-2024-45338
100106

101107
* Wed Jan 08 2025 Muhammad Falak <mwani@microsoft.com> - 2.62.0-3

0 commit comments

Comments
 (0)