Skip to content

Commit ab34d3d

Browse files
azurelinux-securityakhila-guruju
azurelinux-security
and
akhila-guruju
authored
[AutoPR- Security] Patch moby-cli for CVE-2025-11065 [MEDIUM] (#15700)
Co-authored-by: Akhila Guruju <v-guakhila@microsoft.com>
1 parent 308958d commit ab34d3d

2 files changed

Lines changed: 291 additions & 3 deletions

File tree

‎SPECS/moby-cli/CVE-2025-11065.patch‎

Lines changed: 285 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,285 @@
1+
From 396539974d1d1b6c19e7f80b4efea0c0cb8feaba Mon Sep 17 00:00:00 2001
2+
From: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
3+
Date: Sat, 12 Jul 2025 07:25:50 +0200
4+
Subject: [PATCH] fix: error message leaks
5+
6+
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
7+
8+
Upstream Patch reference: https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c.patch
9+
10+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
11+
Upstream-reference: https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c.patch
12+
---
13+
.../mitchellh/mapstructure/decode_hooks.go | 12 +-
14+
.../mitchellh/mapstructure/error.go | 156 ++++++++++++++++++
15+
.../mitchellh/mapstructure/mapstructure.go | 10 +-
16+
3 files changed, 169 insertions(+), 9 deletions(-)
17+
18+
diff --git a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
19+
index 1f0abc6..4f70b03 100644
20+
--- a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
21+
+++ b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
22+
@@ -113,7 +113,9 @@ func StringToTimeDurationHookFunc() DecodeHookFunc {
23+
}
24+
25+
// Convert it by parsing
26+
- return time.ParseDuration(data.(string))
27+
+ d, err := time.ParseDuration(data.(string))
28+
+
29+
+ return d, wrapTimeParseDurationError(err)
30+
}
31+
}
32+
33+
@@ -134,7 +136,7 @@ func StringToIPHookFunc() DecodeHookFunc {
34+
// Convert it by parsing
35+
ip := net.ParseIP(data.(string))
36+
if ip == nil {
37+
- return net.IP{}, fmt.Errorf("failed parsing ip %v", data)
38+
+ return net.IP{}, fmt.Errorf("failed parsing ip")
39+
}
40+
41+
return ip, nil
42+
@@ -157,7 +159,7 @@ func StringToIPNetHookFunc() DecodeHookFunc {
43+
44+
// Convert it by parsing
45+
_, net, err := net.ParseCIDR(data.(string))
46+
- return net, err
47+
+ return net, wrapNetParseError(err)
48+
}
49+
}
50+
51+
@@ -176,7 +178,9 @@ func StringToTimeHookFunc(layout string) DecodeHookFunc {
52+
}
53+
54+
// Convert it by parsing
55+
- return time.Parse(layout, data.(string))
56+
+ ti, err := time.Parse(layout, data.(string))
57+
+
58+
+ return ti, wrapTimeParseError(err)
59+
}
60+
}
61+
62+
diff --git a/vendor/github.com/mitchellh/mapstructure/error.go b/vendor/github.com/mitchellh/mapstructure/error.go
63+
index 47a99e5..8c3b078 100644
64+
--- a/vendor/github.com/mitchellh/mapstructure/error.go
65+
+++ b/vendor/github.com/mitchellh/mapstructure/error.go
66+
@@ -3,8 +3,12 @@ package mapstructure
67+
import (
68+
"errors"
69+
"fmt"
70+
+ "net"
71+
+ "net/url"
72+
"sort"
73+
+ "strconv"
74+
"strings"
75+
+ "time"
76+
)
77+
78+
// Error implements the error interface and can represents multiple
79+
@@ -48,3 +52,155 @@ func appendErrors(errors []string, err error) []string {
80+
return append(errors, e.Error())
81+
}
82+
}
83+
+
84+
+func wrapStrconvNumError(err error) error {
85+
+ if err == nil {
86+
+ return nil
87+
+ }
88+
+
89+
+ if err, ok := err.(*strconv.NumError); ok {
90+
+ return &strconvNumError{Err: err}
91+
+ }
92+
+
93+
+ return err
94+
+}
95+
+
96+
+type strconvNumError struct {
97+
+ Err *strconv.NumError
98+
+}
99+
+
100+
+func (e *strconvNumError) Error() string {
101+
+ return "strconv." + e.Err.Func + ": " + e.Err.Err.Error()
102+
+}
103+
+
104+
+func (e *strconvNumError) Unwrap() error { return e.Err }
105+
+
106+
+func wrapUrlError(err error) error {
107+
+ if err == nil {
108+
+ return nil
109+
+ }
110+
+
111+
+ if err, ok := err.(*url.Error); ok {
112+
+ return &urlError{Err: err}
113+
+ }
114+
+
115+
+ return err
116+
+}
117+
+
118+
+type urlError struct {
119+
+ Err *url.Error
120+
+}
121+
+
122+
+func (e *urlError) Error() string {
123+
+ return fmt.Sprintf("%s", e.Err.Err)
124+
+}
125+
+
126+
+func (e *urlError) Unwrap() error { return e.Err }
127+
+
128+
+func wrapNetParseError(err error) error {
129+
+ if err == nil {
130+
+ return nil
131+
+ }
132+
+
133+
+ if err, ok := err.(*net.ParseError); ok {
134+
+ return &netParseError{Err: err}
135+
+ }
136+
+
137+
+ return err
138+
+}
139+
+
140+
+type netParseError struct {
141+
+ Err *net.ParseError
142+
+}
143+
+
144+
+func (e *netParseError) Error() string {
145+
+ return "invalid " + e.Err.Type
146+
+}
147+
+
148+
+func (e *netParseError) Unwrap() error { return e.Err }
149+
+
150+
+func wrapTimeParseError(err error) error {
151+
+ if err == nil {
152+
+ return nil
153+
+ }
154+
+
155+
+ if err, ok := err.(*time.ParseError); ok {
156+
+ return &timeParseError{Err: err}
157+
+ }
158+
+
159+
+ return err
160+
+}
161+
+
162+
+type timeParseError struct {
163+
+ Err *time.ParseError
164+
+}
165+
+
166+
+func (e *timeParseError) Error() string {
167+
+ if e.Err.Message == "" {
168+
+ return fmt.Sprintf("parsing time as %q: cannot parse as %q", e.Err.Layout, e.Err.LayoutElem)
169+
+ }
170+
+
171+
+ return "parsing time " + e.Err.Message
172+
+}
173+
+
174+
+func (e *timeParseError) Unwrap() error { return e.Err }
175+
+
176+
+func wrapNetIPParseAddrError(err error) error {
177+
+ if err == nil {
178+
+ return nil
179+
+ }
180+
+
181+
+ if errMsg := err.Error(); strings.HasPrefix(errMsg, "ParseAddr") {
182+
+ errPieces := strings.Split(errMsg, ": ")
183+
+
184+
+ return fmt.Errorf("ParseAddr: %s", errPieces[len(errPieces)-1])
185+
+ }
186+
+
187+
+ return err
188+
+}
189+
+
190+
+func wrapNetIPParseAddrPortError(err error) error {
191+
+ if err == nil {
192+
+ return nil
193+
+ }
194+
+
195+
+ errMsg := err.Error()
196+
+ if strings.HasPrefix(errMsg, "invalid port ") {
197+
+ return errors.New("invalid port")
198+
+ } else if strings.HasPrefix(errMsg, "invalid ip:port ") {
199+
+ return errors.New("invalid ip:port")
200+
+ }
201+
+
202+
+ return err
203+
+}
204+
+
205+
+func wrapNetIPParsePrefixError(err error) error {
206+
+ if err == nil {
207+
+ return nil
208+
+ }
209+
+
210+
+ if errMsg := err.Error(); strings.HasPrefix(errMsg, "netip.ParsePrefix") {
211+
+ errPieces := strings.Split(errMsg, ": ")
212+
+
213+
+ return fmt.Errorf("netip.ParsePrefix: %s", errPieces[len(errPieces)-1])
214+
+ }
215+
+
216+
+ return err
217+
+}
218+
+
219+
+func wrapTimeParseDurationError(err error) error {
220+
+ if err == nil {
221+
+ return nil
222+
+ }
223+
+
224+
+ errMsg := err.Error()
225+
+ if strings.HasPrefix(errMsg, "time: unknown unit ") {
226+
+ return errors.New("time: unknown unit")
227+
+ } else if strings.HasPrefix(errMsg, "time: ") {
228+
+ idx := strings.LastIndex(errMsg, " ")
229+
+
230+
+ return errors.New(errMsg[:idx])
231+
+ }
232+
+
233+
+ return err
234+
+}
235+
diff --git a/vendor/github.com/mitchellh/mapstructure/mapstructure.go b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
236+
index b384d9d..21c2264 100644
237+
--- a/vendor/github.com/mitchellh/mapstructure/mapstructure.go
238+
+++ b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
239+
@@ -592,7 +592,7 @@ func (d *Decoder) decodeInt(name string, data interface{}, val reflect.Value) er
240+
if err == nil {
241+
val.SetInt(i)
242+
} else {
243+
- return fmt.Errorf("cannot parse '%s' as int: %s", name, err)
244+
+ return fmt.Errorf("cannot parse '%s' as int: %s", name, wrapStrconvNumError(err))
245+
}
246+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
247+
jn := data.(json.Number)
248+
@@ -644,14 +644,14 @@ func (d *Decoder) decodeUint(name string, data interface{}, val reflect.Value) e
249+
if err == nil {
250+
val.SetUint(i)
251+
} else {
252+
- return fmt.Errorf("cannot parse '%s' as uint: %s", name, err)
253+
+ return fmt.Errorf("cannot parse '%s' as uint: %s", name, wrapStrconvNumError(err))
254+
}
255+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
256+
jn := data.(json.Number)
257+
i, err := jn.Int64()
258+
if err != nil {
259+
return fmt.Errorf(
260+
- "error decoding json.Number into %s: %s", name, err)
261+
+ "error decoding json.Number into %s: %s", name, wrapStrconvNumError(err))
262+
}
263+
if i < 0 && !d.config.WeaklyTypedInput {
264+
return fmt.Errorf("cannot parse '%s', %d overflows uint",
265+
@@ -687,7 +687,7 @@ func (d *Decoder) decodeBool(name string, data interface{}, val reflect.Value) e
266+
} else if dataVal.String() == "" {
267+
val.SetBool(false)
268+
} else {
269+
- return fmt.Errorf("cannot parse '%s' as bool: %s", name, err)
270+
+ return fmt.Errorf("cannot parse '%s' as bool: %s", name, wrapStrconvNumError(err))
271+
}
272+
default:
273+
return fmt.Errorf(
274+
@@ -721,7 +721,7 @@ func (d *Decoder) decodeFloat(name string, data interface{}, val reflect.Value)
275+
if err == nil {
276+
val.SetFloat(f)
277+
} else {
278+
- return fmt.Errorf("cannot parse '%s' as float: %s", name, err)
279+
+ return fmt.Errorf("cannot parse '%s' as float: %s", name, wrapStrconvNumError(err))
280+
}
281+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
282+
jn := data.(json.Number)
283+
--
284+
2.45.4
285+

‎SPECS/moby-cli/moby-cli.spec‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: The open-source application container engine client.
44
Name: moby-cli
55
Version: 24.0.9
6-
Release: 7%{?dist}
6+
Release: 8%{?dist}
77
License: ASL 2.0
88
Vendor: Microsoft Corporation
99
Distribution: Azure Linux
@@ -15,6 +15,7 @@ Patch0: disable_manpage_vendor.patch
1515
Patch1: CVE-2023-45288.patch
1616
Patch2: CVE-2024-36623.patch
1717
Patch3: CVE-2024-24786.patch
18+
Patch4: CVE-2025-11065.patch
1819
BuildRequires: git
1920
BuildRequires: go-md2man
2021
BuildRequires: golang
@@ -27,8 +28,7 @@ Requires: xz
2728
%{summary}
2829

2930
%prep
30-
%autosetup -p1 -n cli-%{version}
31-
%setup -q -n cli-%{version} -T -D -a 1
31+
%autosetup -p1 -a1 -n cli-%{version}
3232

3333
mkdir -p %{OUR_GOPATH}/src/github.com/docker
3434
ln -sfT %{_builddir}/cli-%{version} %{OUR_GOPATH}/src/github.com/docker/cli
@@ -80,6 +80,9 @@ install -p -m 644 contrib/completion/fish/docker.fish %{buildroot}%{_datadir}/fi
8080
%{_datadir}/fish/vendor_completions.d/docker.fish
8181

8282
%changelog
83+
* Tue Feb 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 24.0.9-8
84+
- Patch for CVE-2025-11065
85+
8386
* Thu Sep 04 2025 Akhila Guruju <v-guakhila@microsoft.com> - 24.0.9-7
8487
- Bump release to rebuild with golang
8588

0 commit comments

Comments
 (0)