Skip to content

Commit 80a6073

Browse files
[AutoPR- Security] Patch influxdb for CVE-2025-10543 [MEDIUM] (#15329)
1 parent 0cf25ff commit 80a6073

2 files changed

Lines changed: 37 additions & 1 deletion

File tree

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
From 2cea7c730d27e252186cdae3a74c34897d43f566 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Wed, 17 Dec 2025 05:03:42 +0000
4+
Subject: [PATCH] Fields over 65535 bytes noe encoded correctly
5+
6+
When encoding strings (1.5.3 in spec), and some other variable length fields, if the user passed in more then 65535 bytes the ouput would not be as expected (due to 16 byte header there is a hard limit). This change truncates output to 65535 bytes.
7+
8+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
9+
Upstream-reference: AI Backport of https://patch-diff.githubusercontent.com/raw/eclipse-paho/paho.mqtt.golang/pull/714.patch
10+
---
11+
.../github.com/eclipse/paho.mqtt.golang/packets/packets.go | 5 +++++
12+
1 file changed, 5 insertions(+)
13+
14+
diff --git a/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go b/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go
15+
index 42eeb46..c185c83 100644
16+
--- a/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go
17+
+++ b/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go
18+
@@ -304,6 +304,11 @@ func decodeBytes(b io.Reader) ([]byte, error) {
19+
}
20+
21+
func encodeBytes(field []byte) []byte {
22+
+ // Attempting to encode more than 65,535 bytes would lead to an unexpected 16-bit length and extra data written
23+
+ // (which would be parsed as later parts of the message). The safest option is to truncate.
24+
+ if len(field) > 65535 {
25+
+ field = field[0:65535]
26+
+ }
27+
fieldLength := make([]byte, 2)
28+
binary.BigEndian.PutUint16(fieldLength, uint16(len(field)))
29+
return append(fieldLength, field...)
30+
--
31+
2.45.4
32+

SPECS/influxdb/influxdb.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
Summary: Scalable datastore for metrics, events, and real-time analytics
1919
Name: influxdb
2020
Version: 2.6.1
21-
Release: 25%{?dist}
21+
Release: 26%{?dist}
2222
License: MIT
2323
Vendor: Microsoft Corporation
2424
Distribution: Mariner
@@ -64,6 +64,7 @@ Patch5: CVE-2025-27144.patch
6464
Patch6: CVE-2025-22870.patch
6565
Patch7: CVE-2024-51744.patch
6666
Patch8: CVE-2025-65637.patch
67+
Patch9: CVE-2025-10543.patch
6768
BuildRequires: clang
6869
BuildRequires: golang <= 1.18.8
6970
BuildRequires: kernel-headers
@@ -153,6 +154,9 @@ go test ./...
153154
%{_tmpfilesdir}/influxdb.conf
154155

155156
%changelog
157+
* Wed Dec 17 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.6.1-26
158+
- Patch for CVE-2025-10543
159+
156160
* Mon Dec 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.6.1-25
157161
- Patch for CVE-2025-65637
158162

0 commit comments

Comments
 (0)