Skip to content

Commit 93945db

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch vitess for CVE-2025-47911, CVE-2025-58190 [MEDIUM] (#15889)
1 parent 5ae2748 commit 93945db

3 files changed

Lines changed: 232 additions & 1 deletion

File tree

‎SPECS/vitess/CVE-2025-47911.patch‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
From a0f02e7474fe9cac9cbebcbd92b7a94787954c00 Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <roland@golang.org>
3+
Date: Mon, 29 Sep 2025 16:33:18 -0700
4+
Subject: [PATCH] html: impose open element stack size limit
5+
6+
The HTML specification contains a number of algorithms which are
7+
quadratic in complexity by design. Instead of adding complicated
8+
workarounds to prevent these cases from becoming extremely expensive in
9+
pathological cases, we impose a limit of 512 to the size of the stack of
10+
open elements. It is extremely unlikely that non-adversarial HTML
11+
documents will ever hit this limit (but if we see cases of this, we may
12+
want to make the limit configurable via a ParseOption).
13+
14+
Thanks to Guido Vranken and Jakub Ciolek for both independently
15+
reporting this issue.
16+
17+
Fixes CVE-2025-47911
18+
Fixes golang/go#75682
19+
20+
Change-Id: I890517b189af4ffbf427d25d3fde7ad7ec3509ad
21+
Reviewed-on: https://go-review.googlesource.com/c/net/+/709876
22+
Reviewed-by: Damien Neil <dneil@google.com>
23+
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
24+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
25+
Upstream-reference: https://github.com/golang/net/commit/59706cdaa8f95502fdec64b67b4c61d6ca58727d.patch
26+
---
27+
vendor/golang.org/x/net/html/escape.go | 2 +-
28+
vendor/golang.org/x/net/html/parse.go | 21 +++++++++++++++++----
29+
2 files changed, 18 insertions(+), 5 deletions(-)
30+
31+
diff --git a/vendor/golang.org/x/net/html/escape.go b/vendor/golang.org/x/net/html/escape.go
32+
index 04c6bec..12f2273 100644
33+
--- a/vendor/golang.org/x/net/html/escape.go
34+
+++ b/vendor/golang.org/x/net/html/escape.go
35+
@@ -299,7 +299,7 @@ func escape(w writer, s string) error {
36+
case '\r':
37+
esc = "&#13;"
38+
default:
39+
- panic("unrecognized escape character")
40+
+ panic("html: unrecognized escape character")
41+
}
42+
s = s[i+1:]
43+
if _, err := w.WriteString(esc); err != nil {
44+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
45+
index 979ef17..4d12a1c 100644
46+
--- a/vendor/golang.org/x/net/html/parse.go
47+
+++ b/vendor/golang.org/x/net/html/parse.go
48+
@@ -231,7 +231,14 @@ func (p *parser) addChild(n *Node) {
49+
}
50+
51+
if n.Type == ElementNode {
52+
- p.oe = append(p.oe, n)
53+
+ p.insertOpenElement(n)
54+
+ }
55+
+}
56+
+
57+
+func (p *parser) insertOpenElement(n *Node) {
58+
+ p.oe = append(p.oe, n)
59+
+ if len(p.oe) > 512 {
60+
+ panic("html: open stack of elements exceeds 512 nodes")
61+
}
62+
}
63+
64+
@@ -810,7 +817,7 @@ func afterHeadIM(p *parser) bool {
65+
p.im = inFramesetIM
66+
return true
67+
case a.Base, a.Basefont, a.Bgsound, a.Link, a.Meta, a.Noframes, a.Script, a.Style, a.Template, a.Title:
68+
- p.oe = append(p.oe, p.head)
69+
+ p.insertOpenElement(p.head)
70+
defer p.oe.remove(p.head)
71+
return inHeadIM(p)
72+
case a.Head:
73+
@@ -2320,9 +2327,13 @@ func (p *parser) parseCurrentToken() {
74+
}
75+
}
76+
77+
-func (p *parser) parse() error {
78+
+func (p *parser) parse() (err error) {
79+
+ defer func() {
80+
+ if panicErr := recover(); panicErr != nil {
81+
+ err = fmt.Errorf("%s", panicErr)
82+
+ }
83+
+ }()
84+
// Iterate until EOF. Any other error will cause an early return.
85+
- var err error
86+
for err != io.EOF {
87+
// CDATA sections are allowed only in foreign content.
88+
n := p.oe.top()
89+
@@ -2351,6 +2362,8 @@ func (p *parser) parse() error {
90+
// <tag>s. Conversely, explicit <tag>s in r's data can be silently dropped,
91+
// with no corresponding node in the resulting tree.
92+
//
93+
+// Parse will reject HTML that is nested deeper than 512 elements.
94+
+//
95+
// The input is assumed to be UTF-8 encoded.
96+
func Parse(r io.Reader) (*Node, error) {
97+
return ParseWithOptions(r)
98+
--
99+
2.45.4
100+

‎SPECS/vitess/CVE-2025-58190.patch‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
From dafb72b0c21140a77570110f71788fe0459ce65d Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <roland@golang.org>
3+
Date: Mon, 29 Sep 2025 19:38:24 -0700
4+
Subject: [PATCH] html: align in row insertion mode with spec
5+
6+
Update inRowIM to match the HTML specification. This fixes an issue
7+
where a specific HTML document could cause the parser to enter an
8+
infinite loop when trying to parse a </tbody> and implied </tr> next to
9+
each other.
10+
11+
Fixes CVE-2025-58190
12+
Fixes golang/go#70179
13+
14+
Change-Id: Idcb133c87c7d475cc8c7eb1f1550ea21d8bdddea
15+
Reviewed-on: https://go-review.googlesource.com/c/net/+/709875
16+
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
17+
Reviewed-by: Damien Neil <dneil@google.com>
18+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
19+
Upstream-reference: https://github.com/golang/net/commit/6ec8895aa5f6594da7356da7d341b98133629009.patch
20+
---
21+
vendor/golang.org/x/net/html/parse.go | 36 ++++++++++++++++++---------
22+
1 file changed, 24 insertions(+), 12 deletions(-)
23+
24+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
25+
index 5b8374b..979ef17 100644
26+
--- a/vendor/golang.org/x/net/html/parse.go
27+
+++ b/vendor/golang.org/x/net/html/parse.go
28+
@@ -136,7 +136,7 @@ func (p *parser) indexOfElementInScope(s scope, matchTags ...a.Atom) int {
29+
return -1
30+
}
31+
default:
32+
- panic("unreachable")
33+
+ panic(fmt.Sprintf("html: internal error: indexOfElementInScope unknown scope: %d", s))
34+
}
35+
}
36+
switch s {
37+
@@ -179,7 +179,7 @@ func (p *parser) clearStackToContext(s scope) {
38+
return
39+
}
40+
default:
41+
- panic("unreachable")
42+
+ panic(fmt.Sprintf("html: internal error: clearStackToContext unknown scope: %d", s))
43+
}
44+
}
45+
}
46+
@@ -1674,7 +1674,7 @@ func inTableBodyIM(p *parser) bool {
47+
return inTableIM(p)
48+
}
49+
50+
-// Section 12.2.6.4.14.
51+
+// Section 13.2.6.4.14.
52+
func inRowIM(p *parser) bool {
53+
switch p.tok.Type {
54+
case StartTagToken:
55+
@@ -1686,7 +1686,9 @@ func inRowIM(p *parser) bool {
56+
p.im = inCellIM
57+
return true
58+
case a.Caption, a.Col, a.Colgroup, a.Tbody, a.Tfoot, a.Thead, a.Tr:
59+
- if p.popUntil(tableScope, a.Tr) {
60+
+ if p.elementInScope(tableScope, a.Tr) {
61+
+ p.clearStackToContext(tableRowScope)
62+
+ p.oe.pop()
63+
p.im = inTableBodyIM
64+
return false
65+
}
66+
@@ -1696,22 +1698,28 @@ func inRowIM(p *parser) bool {
67+
case EndTagToken:
68+
switch p.tok.DataAtom {
69+
case a.Tr:
70+
- if p.popUntil(tableScope, a.Tr) {
71+
+ if p.elementInScope(tableScope, a.Tr) {
72+
+ p.clearStackToContext(tableRowScope)
73+
+ p.oe.pop()
74+
p.im = inTableBodyIM
75+
return true
76+
}
77+
// Ignore the token.
78+
return true
79+
case a.Table:
80+
- if p.popUntil(tableScope, a.Tr) {
81+
+ if p.elementInScope(tableScope, a.Tr) {
82+
+ p.clearStackToContext(tableRowScope)
83+
+ p.oe.pop()
84+
p.im = inTableBodyIM
85+
return false
86+
}
87+
// Ignore the token.
88+
return true
89+
case a.Tbody, a.Tfoot, a.Thead:
90+
- if p.elementInScope(tableScope, p.tok.DataAtom) {
91+
- p.parseImpliedToken(EndTagToken, a.Tr, a.Tr.String())
92+
+ if p.elementInScope(tableScope, p.tok.DataAtom) && p.elementInScope(tableScope, a.Tr) {
93+
+ p.clearStackToContext(tableRowScope)
94+
+ p.oe.pop()
95+
+ p.im = inTableBodyIM
96+
return false
97+
}
98+
// Ignore the token.
99+
@@ -2218,16 +2226,20 @@ func parseForeignContent(p *parser) bool {
100+
p.acknowledgeSelfClosingTag()
101+
}
102+
case EndTagToken:
103+
+ if strings.EqualFold(p.oe[len(p.oe)-1].Data, p.tok.Data) {
104+
+ p.oe = p.oe[:len(p.oe)-1]
105+
+ return true
106+
+ }
107+
for i := len(p.oe) - 1; i >= 0; i-- {
108+
- if p.oe[i].Namespace == "" {
109+
- return p.im(p)
110+
- }
111+
if strings.EqualFold(p.oe[i].Data, p.tok.Data) {
112+
p.oe = p.oe[:i]
113+
+ return true
114+
+ }
115+
+ if i > 0 && p.oe[i-1].Namespace == "" {
116+
break
117+
}
118+
}
119+
- return true
120+
+ return p.im(p)
121+
default:
122+
// Ignore the token.
123+
}
124+
--
125+
2.45.4
126+

‎SPECS/vitess/vitess.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
Name: vitess
55
Version: 17.0.7
6-
Release: 13%{?dist}
6+
Release: 14%{?dist}
77
Summary: Database clustering system for horizontal scaling of MySQL
88
# Upstream license specification: MIT and Apache-2.0
99
License: MIT and ASL 2.0
@@ -34,6 +34,8 @@ Patch4: CVE-2025-22870.patch
3434
# CVE-2025-22872 is fixed in go net v0.38 by https://github.com/golang/net/commit/e1fcd82abba34df74614020343be8eb1fe85f0d9
3535
Patch5: CVE-2025-22872.patch
3636
Patch6: CVE-2025-11065.patch
37+
Patch7: CVE-2025-47911.patch
38+
Patch8: CVE-2025-58190.patch
3739
BuildRequires: golang
3840

3941
%description
@@ -103,6 +105,9 @@ go test -v ./go/cmd/... \
103105
%{_bindir}/*
104106

105107
%changelog
108+
* Wed Feb 18 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 17.0.7-14
109+
- Patch for CVE-2025-47911, CVE-2025-58190
110+
106111
* Tue Feb 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 17.0.7-13
107112
- Patch for CVE-2025-11065
108113

0 commit comments

Comments
 (0)