Skip to content

Commit 790a28c

Browse files
azurelinux-securityarchana25-ms
azurelinux-security
and
archana25-ms
authored
[AutoPR- Security] Patch rust for CVE-2024-11738 [MEDIUM] (#14459)
Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com>
1 parent 615d3c2 commit 790a28c

9 files changed

Lines changed: 68 additions & 8 deletions

File tree

‎SPECS-EXTENDED/389-ds-base/389-ds-base.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ ExcludeArch: i686
6868
Summary: 389 Directory Server (%{variant})
6969
Name: 389-ds-base
7070
Version: 3.1.1
71-
Release: 6%{?dist}
71+
Release: 7%{?dist}
7272
License: GPL-3.0-or-later AND (0BSD OR Apache-2.0 OR MIT) AND (Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT) AND (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR MIT OR Zlib) AND (Apache-2.0 OR MIT) AND (CC-BY-4.0 AND MIT) AND (MIT OR Apache-2.0) AND Unicode-DFS-2016 AND (MIT OR CC0-1.0) AND (MIT OR Unlicense) AND 0BSD AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT AND MIT AND ISC AND MPL-2.0 AND PSF-2.0
7373
URL: https://www.port389.org
7474
Vendor: Microsoft Corporation
@@ -732,6 +732,9 @@ exit 0
732732
%endif
733733

734734
%changelog
735+
* Fri Aug 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.1.1-7
736+
- Bump release to rebuild with rust
737+
735738
* Mon Jul 21 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 3.1.1-6
736739
- Bump release to rebuild with rust
737740

‎SPECS-EXTENDED/ripgrep/ripgrep.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020

2121
Name: ripgrep
2222
Version: 13.0.0
23-
Release: 9%{?dist}
23+
Release: 10%{?dist}
2424
Summary: A search tool that combines ag with grep
2525
License: MIT AND Unlicense
2626
Vendor: Microsoft Corporation
@@ -104,6 +104,9 @@ install -Dm 644 complete/_rg %{buildroot}%{_datadir}/zsh/site-functions/_rg
104104
%{_datadir}/zsh
105105

106106
%changelog
107+
* Fri Aug 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 13.0.0-10
108+
- Bump release to rebuild with rust
109+
107110
* Mon Jul 21 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 13.0.0-9
108111
- Bump release to rebuild with rust
109112

‎SPECS-EXTENDED/rust-cbindgen/rust-cbindgen.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Tool for generating C bindings to Rust code
33
Name: rust-cbindgen
44
Version: 0.24.3
5-
Release: 5%{?dist}
5+
Release: 6%{?dist}
66
License: MIT
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
@@ -96,6 +96,9 @@ RUSTFLAGS=%{rustflags} cargo test --release
9696
%endif
9797

9898
%changelog
99+
* Fri Aug 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 0.24.3-6
100+
- Bump release to rebuild with rust
101+
99102
* Mon Jul 21 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 0.24.3-5
100103
- Bump release to rebuild with rust
101104

‎SPECS-EXTENDED/tardev-snapshotter/tardev-snapshotter.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: Tardev Snapshotter for containerd
44
Name: tardev-snapshotter
55
Version: 3.2.0.tardev1
6-
Release: 3%{?dist}
6+
Release: 4%{?dist}
77
License: ASL 2.0
88
Group: Tools/Container
99
Vendor: Microsoft Corporation
@@ -67,6 +67,9 @@ fi
6767
%config(noreplace) %{_unitdir}/%{name}.service
6868

6969
%changelog
70+
* Fri Aug 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.2.0.tardev1-4
71+
- Bump release to rebuild with rust
72+
7073
* Mon Jul 21 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 3.2.0.tardev1-3
7174
- Bump release to rebuild with rust
7275

‎SPECS/cloud-hypervisor-cvm/cloud-hypervisor-cvm.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
Name: cloud-hypervisor-cvm
66
Summary: Cloud Hypervisor CVM is an open source Virtual Machine Monitor (VMM) that enables running SEV SNP enabled VMs on top of MSHV using the IGVM file format as payload.
77
Version: 41.0.79
8-
Release: 3%{?dist}
8+
Release: 4%{?dist}
99
License: ASL 2.0 OR BSD-3-clause
1010
Vendor: Microsoft Corporation
1111
Distribution: Azure Linux
@@ -136,6 +136,9 @@ cargo build --release --target=%{rust_musl_target} %{cargo_pkg_feature_opts} %{c
136136
%license LICENSES/CC-BY-4.0.txt
137137

138138
%changelog
139+
* Fri Aug 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 41.0.79-4
140+
- Bump release to rebuild with rust
141+
139142
* Mon Jul 21 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 41.0.79-3
140143
- Bump release to rebuild with rust
141144

‎SPECS/kata-containers-cc/kata-containers-cc.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
Name: kata-containers-cc
55
Version: 3.15.0.aks0
6-
Release: 4%{?dist}
6+
Release: 5%{?dist}
77
Summary: Kata Confidential Containers package developed for Confidential Containers on AKS
88
License: ASL 2.0
99
URL: https://github.com/microsoft/kata-containers
@@ -150,6 +150,9 @@ fi
150150
%{tools_pkg}/tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-agent.service
151151

152152
%changelog
153+
* Fri Aug 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.15.0-aks0-5
154+
- Bump release to rebuild with rust
155+
153156
* Tue Jul 22 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 3.15.0.aks0-4
154157
- Bump release to rebuild with rust
155158

‎SPECS/kata-containers/kata-containers.spec‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
Name: kata-containers
44
Version: 3.18.0.kata0
5-
Release: 3%{?dist}
5+
Release: 4%{?dist}
66
Summary: Kata Containers package developed for Pod Sandboxing on AKS
77
License: ASL 2.0
88
URL: https://github.com/microsoft/kata-containers
@@ -115,6 +115,9 @@ popd
115115
%{tools_pkg}/tools/osbuilder/node-builder/azure-linux/agent-install/usr/lib/systemd/system/kata-agent.service
116116

117117
%changelog
118+
* Fri Aug 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.18.0.kata0-4
119+
- Bump release to rebuild with rust
120+
118121
* Tue Jul 22 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 3.18.0.kata0-3
119122
- Bump release to rebuild with rust
120123

‎SPECS/rust/CVE-2024-11738.patch‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
From 874dd834f5444394deda1f7fcc19cc09afebf6bd Mon Sep 17 00:00:00 2001
2+
From: Kevin Wang <wy721@qq.com>
3+
Date: Fri, 22 Nov 2024 20:48:01 +0800
4+
Subject: [PATCH] Record and restore the processed cursor in
5+
first_handshake_message
6+
7+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
8+
Upstream-reference: https://github.com/rustls/rustls/pull/2231.patch
9+
---
10+
vendor/rustls-0.23.13/src/conn.rs | 2 ++
11+
1 file changed, 2 insertions(+)
12+
13+
diff --git a/vendor/rustls-0.23.13/src/conn.rs b/vendor/rustls-0.23.13/src/conn.rs
14+
index 60b597ba5..d45d71fd0 100644
15+
--- a/vendor/rustls-0.23.13/src/conn.rs
16+
+++ b/vendor/rustls-0.23.13/src/conn.rs
17+
@@ -655,6 +655,7 @@ impl<Data> ConnectionCommon<Data> {
18+
/// `process_handshake_messages()` path, specialized for the first handshake message.
19+
pub(crate) fn first_handshake_message(&mut self) -> Result<Option<Message<'static>>, Error> {
20+
let mut buffer_progress = BufferProgress::default();
21+
+ buffer_progress.add_processed(self.deframer_buffer.processed);
22+
23+
let res = self
24+
.core
25+
@@ -665,6 +666,7 @@ impl<Data> ConnectionCommon<Data> {
26+
)
27+
.map(|opt| opt.map(|pm| Message::try_from(pm).map(|m| m.into_owned())));
28+
29+
+ self.deframer_buffer.processed = buffer_progress.processed();
30+
match res? {
31+
Some(Ok(msg)) => {
32+
self.deframer_buffer
33+
--
34+
2.45.4
35+

‎SPECS/rust/rust.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
Summary: Rust Programming Language
1010
Name: rust
1111
Version: 1.86.0
12-
Release: 4%{?dist}
12+
Release: 5%{?dist}
1313
License: (ASL 2.0 OR MIT) AND BSD AND CC-BY-3.0
1414
Vendor: Microsoft Corporation
1515
Distribution: Azure Linux
@@ -43,6 +43,7 @@ Source6: https://static.rust-lang.org/dist/%{release_date}/rustc-%{stage0
4343
Source7: https://static.rust-lang.org/dist/%{release_date}/rust-std-%{stage0_version}-aarch64-unknown-linux-gnu.tar.xz
4444
Patch0: CVE-2025-4574.patch
4545
Patch1: CVE-2025-53605.patch
46+
Patch2: CVE-2024-11738.patch
4647
BuildRequires: binutils
4748
BuildRequires: cmake
4849
# make sure rust relies on curl from CBL-Mariner (instead of using its vendored flavor)
@@ -180,6 +181,9 @@ rm %{buildroot}%{_docdir}/docs/html/.lock
180181
%{_mandir}/man1/*
181182

182183
%changelog
184+
* Fri Aug 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.86.0-5
185+
- Patch for CVE-2024-11738
186+
183187
* Mon Jul 21 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 1.86.0-4
184188
- patch for CVE-2025-53605
185189

0 commit comments

Comments
 (0)