Skip to content

Commit b7dea7e

Browse files
azurelinux-securityKanishk-Bansal
azurelinux-security
and
Kanishk-Bansal
authored
[AutoPR- Security] Patch dcos-cli for CVE-2025-30204 [MEDIUM] (#15888)
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent 93945db commit b7dea7e

2 files changed

Lines changed: 174 additions & 1 deletion

File tree

‎SPECS/dcos-cli/CVE-2025-30204.patch‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
From 25facac704f233f2fc77ea281cbe725fc8816b54 Mon Sep 17 00:00:00 2001
2+
From: Michael Fridman <mfridman@buf.build>
3+
Date: Fri, 21 Mar 2025 16:42:51 -0400
4+
Subject: [PATCH] Backporting 0951d18 to v4
5+
6+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
7+
Upstream-reference: https://github.com/golang-jwt/jwt/commit/2f0e9add62078527821828c76865661aa7718a84.patch
8+
---
9+
.../github.com/dgrijalva/jwt-go/jwt_test.go | 89 +++++++++++++++++++
10+
vendor/github.com/dgrijalva/jwt-go/parser.go | 36 +++++++-
11+
2 files changed, 122 insertions(+), 3 deletions(-)
12+
create mode 100644 vendor/github.com/dgrijalva/jwt-go/jwt_test.go
13+
14+
diff --git a/vendor/github.com/dgrijalva/jwt-go/jwt_test.go b/vendor/github.com/dgrijalva/jwt-go/jwt_test.go
15+
new file mode 100644
16+
index 0000000..b01e899
17+
--- /dev/null
18+
+++ b/vendor/github.com/dgrijalva/jwt-go/jwt_test.go
19+
@@ -0,0 +1,89 @@
20+
+package jwt
21+
+
22+
+import (
23+
+ "testing"
24+
+)
25+
+
26+
+func TestSplitToken(t *testing.T) {
27+
+ t.Parallel()
28+
+
29+
+ tests := []struct {
30+
+ name string
31+
+ input string
32+
+ expected []string
33+
+ isValid bool
34+
+ }{
35+
+ {
36+
+ name: "valid token with three parts",
37+
+ input: "header.claims.signature",
38+
+ expected: []string{"header", "claims", "signature"},
39+
+ isValid: true,
40+
+ },
41+
+ {
42+
+ name: "invalid token with two parts only",
43+
+ input: "header.claims",
44+
+ expected: nil,
45+
+ isValid: false,
46+
+ },
47+
+ {
48+
+ name: "invalid token with one part only",
49+
+ input: "header",
50+
+ expected: nil,
51+
+ isValid: false,
52+
+ },
53+
+ {
54+
+ name: "invalid token with extra delimiter",
55+
+ input: "header.claims.signature.extra",
56+
+ expected: nil,
57+
+ isValid: false,
58+
+ },
59+
+ {
60+
+ name: "invalid empty token",
61+
+ input: "",
62+
+ expected: nil,
63+
+ isValid: false,
64+
+ },
65+
+ {
66+
+ name: "valid token with empty parts",
67+
+ input: "..signature",
68+
+ expected: []string{"", "", "signature"},
69+
+ isValid: true,
70+
+ },
71+
+ {
72+
+ // We are just splitting the token into parts, so we don't care about the actual values.
73+
+ // It is up to the caller to validate the parts.
74+
+ name: "valid token with all parts empty",
75+
+ input: "..",
76+
+ expected: []string{"", "", ""},
77+
+ isValid: true,
78+
+ },
79+
+ {
80+
+ name: "invalid token with just delimiters and extra part",
81+
+ input: "...",
82+
+ expected: nil,
83+
+ isValid: false,
84+
+ },
85+
+ {
86+
+ name: "invalid token with many delimiters",
87+
+ input: "header.claims.signature..................",
88+
+ expected: nil,
89+
+ isValid: false,
90+
+ },
91+
+ }
92+
+
93+
+ for _, tt := range tests {
94+
+ t.Run(tt.name, func(t *testing.T) {
95+
+ parts, ok := splitToken(tt.input)
96+
+ if ok != tt.isValid {
97+
+ t.Errorf("expected %t, got %t", tt.isValid, ok)
98+
+ }
99+
+ if ok {
100+
+ for i, part := range tt.expected {
101+
+ if parts[i] != part {
102+
+ t.Errorf("expected %s, got %s", part, parts[i])
103+
+ }
104+
+ }
105+
+ }
106+
+ })
107+
+ }
108+
+}
109+
diff --git a/vendor/github.com/dgrijalva/jwt-go/parser.go b/vendor/github.com/dgrijalva/jwt-go/parser.go
110+
index 72cf9ee..3943114 100644
111+
--- a/vendor/github.com/dgrijalva/jwt-go/parser.go
112+
+++ b/vendor/github.com/dgrijalva/jwt-go/parser.go
113+
@@ -7,6 +7,8 @@ import (
114+
"strings"
115+
)
116+
117+
+const tokenDelimiter = "."
118+
+
119+
type Parser struct {
120+
ValidMethods []string // If populated, only these methods will be considered valid
121+
UseJSONNumber bool // Use JSON Number format in JSON decoder
122+
@@ -92,9 +94,10 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
123+
// been checked previously in the stack) and you want to extract values from
124+
// it.
125+
func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Token, parts []string, err error) {
126+
- parts = strings.Split(tokenString, ".")
127+
- if len(parts) != 3 {
128+
- return nil, parts, NewValidationError("token contains an invalid number of segments", ValidationErrorMalformed)
129+
+ var ok bool
130+
+ parts, ok = splitToken(tokenString)
131+
+ if !ok {
132+
+ return nil, nil, NewValidationError("token contains an invalid number of segments", ValidationErrorMalformed)
133+
}
134+
135+
token = &Token{Raw: tokenString}
136+
@@ -144,3 +147,30 @@ func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Toke
137+
138+
return token, parts, nil
139+
}
140+
+
141+
+// splitToken splits a token string into three parts: header, claims, and signature. It will only
142+
+// return true if the token contains exactly two delimiters and three parts. In all other cases, it
143+
+// will return nil parts and false.
144+
+func splitToken(token string) ([]string, bool) {
145+
+ parts := make([]string, 3)
146+
+ header, remain, ok := strings.Cut(token, tokenDelimiter)
147+
+ if !ok {
148+
+ return nil, false
149+
+ }
150+
+ parts[0] = header
151+
+ claims, remain, ok := strings.Cut(remain, tokenDelimiter)
152+
+ if !ok {
153+
+ return nil, false
154+
+ }
155+
+ parts[1] = claims
156+
+ // One more cut to ensure the signature is the last part of the token and there are no more
157+
+ // delimiters. This avoids an issue where malicious input could contain additional delimiters
158+
+ // causing unecessary overhead parsing tokens.
159+
+ signature, _, unexpected := strings.Cut(remain, tokenDelimiter)
160+
+ if unexpected {
161+
+ return nil, false
162+
+ }
163+
+ parts[2] = signature
164+
+
165+
+ return parts, true
166+
+}
167+
--
168+
2.45.4
169+

‎SPECS/dcos-cli/dcos-cli.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: The command line for DC/OS
22
Name: dcos-cli
33
Version: 1.2.0
4-
Release: 23%{?dist}
4+
Release: 24%{?dist}
55
License: Apache-2.0
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -12,6 +12,7 @@ Patch0: CVE-2024-28180.patch
1212
Patch1: CVE-2025-27144.patch
1313
Patch2: CVE-2024-51744.patch
1414
Patch3: CVE-2025-65637.patch
15+
Patch4: CVE-2025-30204.patch
1516
BuildRequires: golang
1617
BuildRequires: git
1718
%global debug_package %{nil}
@@ -48,6 +49,9 @@ go test -mod=vendor
4849
%{_bindir}/dcos
4950

5051
%changelog
52+
* Wed Feb 18 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.2.0-24
53+
- Patch for CVE-2025-30204
54+
5155
* Mon Dec 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.2.0-23
5256
- Patch for CVE-2025-65637
5357

0 commit comments

Comments
 (0)