Skip to content

Commit b863739

Browse files
archana25-msarchana25-ms
authored
[MEDIUM] Patch golang for CVE-2024-24789, CVE-2024-34155 & CVE-2025-22870 (#13586)
1 parent 216df8a commit b863739

6 files changed

Lines changed: 206 additions & 3 deletions

File tree

‎SPECS/golang/CVE-2024-24789.patch‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
From 56d779bbf568122f560b51450e6ddc09a4fbf90b Mon Sep 17 00:00:00 2001
2+
From: archana25-ms <v-shettigara@microsoft.com>
3+
Date: Thu, 24 Apr 2025 22:36:50 +0000
4+
Subject: [PATCH] Address CVE-2024-24789
5+
Upstream Patch Reference: https://go-review.googlesource.com/c/go/+/585397/3/src/archive/zip/reader.go
6+
7+
---
8+
src/archive/zip/reader.go | 8 ++++++--
9+
1 file changed, 6 insertions(+), 2 deletions(-)
10+
11+
diff --git a/src/archive/zip/reader.go b/src/archive/zip/reader.go
12+
index 92fd6f6..3da6440 100644
13+
--- a/src/archive/zip/reader.go
14+
+++ b/src/archive/zip/reader.go
15+
@@ -604,9 +604,13 @@ func findSignatureInBlock(b []byte) int {
16+
if b[i] == 'P' && b[i+1] == 'K' && b[i+2] == 0x05 && b[i+3] == 0x06 {
17+
// n is length of comment
18+
n := int(b[i+directoryEndLen-2]) | int(b[i+directoryEndLen-1])<<8
19+
- if n+directoryEndLen+i <= len(b) {
20+
- return i
21+
+ if n+directoryEndLen+i > len(b) {
22+
+ // Truncated comment.
23+
+ // Some parsers (such as Info-ZIP) ignore the truncated comment
24+
+ // rather than treating it as a hard error.
25+
+ return -1
26+
}
27+
+ return i
28+
}
29+
}
30+
return -1
31+
--
32+
2.45.3
33+

‎SPECS/golang/CVE-2024-34155.patch‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From 5d26749e30c14254dabd04cb2b408d1484de2c14 Mon Sep 17 00:00:00 2001
2+
From: archana25-ms <v-shettigara@microsoft.com>
3+
Date: Wed, 7 May 2025 07:27:13 +0000
4+
Subject: [PATCH] Address CVE-2024-34155
5+
Upstream Patch Reference: https://github.com/golang/go/commit/b232596139dbe96a62edbe3a2a203e856bf556eb
6+
7+
---
8+
src/go/parser/parser.go | 2 ++
9+
src/go/parser/parser_test.go | 9 +++++----
10+
2 files changed, 7 insertions(+), 4 deletions(-)
11+
12+
diff --git a/src/go/parser/parser.go b/src/go/parser/parser.go
13+
index c34ccea..ea81cfc 100644
14+
--- a/src/go/parser/parser.go
15+
+++ b/src/go/parser/parser.go
16+
@@ -1685,6 +1685,8 @@ func (p *parser) checkExprOrType(x ast.Expr) ast.Expr {
17+
}
18+
19+
func (p *parser) parsePrimaryExpr(x ast.Expr) ast.Expr {
20+
+ defer decNestLev(incNestLev(p))
21+
+
22+
if p.trace {
23+
defer un(trace(p, "PrimaryExpr"))
24+
}
25+
diff --git a/src/go/parser/parser_test.go b/src/go/parser/parser_test.go
26+
index 1a46c87..9e4ce35 100644
27+
--- a/src/go/parser/parser_test.go
28+
+++ b/src/go/parser/parser_test.go
29+
@@ -607,10 +607,11 @@ var parseDepthTests = []struct {
30+
{name: "chan2", format: "package main; var x «<-chan »int"},
31+
{name: "interface", format: "package main; var x «interface { M() «int» }»", scope: true, scopeMultiplier: 2}, // Scopes: InterfaceType, FuncType
32+
{name: "map", format: "package main; var x «map[int]»int"},
33+
- {name: "slicelit", format: "package main; var x = «[]any{«»}»", parseMultiplier: 2}, // Parser nodes: UnaryExpr, CompositeLit
34+
- {name: "arraylit", format: "package main; var x = «[1]any{«nil»}»", parseMultiplier: 2}, // Parser nodes: UnaryExpr, CompositeLit
35+
- {name: "structlit", format: "package main; var x = «struct{x any}{«nil»}»", parseMultiplier: 2}, // Parser nodes: UnaryExpr, CompositeLit
36+
- {name: "maplit", format: "package main; var x = «map[int]any{1:«nil»}»", parseMultiplier: 2}, // Parser nodes: CompositeLit, KeyValueExpr
37+
+ {name: "slicelit", format: "package main; var x = []any{«[]any{«»}»}", parseMultiplier: 3}, // Parser nodes: UnaryExpr, CompositeLit
38+
+ {name: "arraylit", format: "package main; var x = «[1]any{«nil»}»", parseMultiplier: 3}, // Parser nodes: UnaryExpr, CompositeLit
39+
+ {name: "structlit", format: "package main; var x = «struct{x any}{«nil»}»", parseMultiplier: 3}, // Parser nodes: UnaryExpr, CompositeLit
40+
+ {name: "maplit", format: "package main; var x = «map[int]any{1:«nil»}»", parseMultiplier: 3}, // Parser nodes: CompositeLit, KeyValueExpr
41+
+ {name: "element", format: "package main; var x = struct{x any}{x: «{«»}»}"},
42+
{name: "dot", format: "package main; var x = «x.»x"},
43+
{name: "index", format: "package main; var x = x«[1]»"},
44+
{name: "slice", format: "package main; var x = x«[1:2]»"},
45+
--
46+
2.45.3
47+

‎SPECS/golang/CVE-2025-22870-1.18.patch‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
From 83bf64f9e9f54aad64e00d6aa3a28caeb61eba1b Mon Sep 17 00:00:00 2001
2+
From: archana25-ms <v-shettigara@microsoft.com>
3+
Date: Wed, 23 Apr 2025 20:53:30 +0000
4+
Subject: [PATCH] Address CVE-2025-22870
5+
Upstream Patch Reference : https://github.com/golang/go/commit/334de7982f8ec959c74470dd709ceedfd6dbd50a#diff-535738d3f027e78324e07f2c97d9e1cd704253a1691bb1de8868565d56b4affe
6+
7+
---
8+
src/vendor/golang.org/x/net/http/httpproxy/proxy.go | 10 ++++++++--
9+
2 files changed, 9 insertions(+), 2 deletions(-)
10+
11+
diff --git a/src/vendor/golang.org/x/net/http/httpproxy/proxy.go b/src/vendor/golang.org/x/net/http/httpproxy/proxy.go
12+
index 6404aaf157d6ad..d89c257ae72314 100644
13+
--- a/src/vendor/golang.org/x/net/http/httpproxy/proxy.go
14+
+++ b/src/vendor/golang.org/x/net/http/httpproxy/proxy.go
15+
@@ -14,6 +14,7 @@ import (
16+
"errors"
17+
"fmt"
18+
"net"
19+
+ "net/netip"
20+
"net/url"
21+
"os"
22+
"strings"
23+
@@ -177,8 +178,10 @@ func (cfg *config) useProxy(addr string) bool {
24+
if host == "localhost" {
25+
return false
26+
}
27+
- ip := net.ParseIP(host)
28+
- if ip != nil {
29+
+ nip, err := netip.ParseAddr(host)
30+
+ var ip net.IP
31+
+ if err == nil {
32+
+ ip = net.IP(nip.AsSlice())
33+
if ip.IsLoopback() {
34+
return false
35+
}
36+
@@ -360,6 +363,9 @@ type domainMatch struct {
37+
}
38+
39+
func (m domainMatch) match(host, port string, ip net.IP) bool {
40+
+ if ip != nil {
41+
+ return false
42+
+ }
43+
if strings.HasSuffix(host, m.host) || (m.matchHost && host == m.host[1:]) {
44+
return m.port == "" || m.port == port
45+
}
46+
--
47+
2.45.3
48+

‎SPECS/golang/CVE-2025-22870.patch‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
From 83bf64f9e9f54aad64e00d6aa3a28caeb61eba1b Mon Sep 17 00:00:00 2001
2+
From: archana25-ms <v-shettigara@microsoft.com>
3+
Date: Wed, 23 Apr 2025 20:53:30 +0000
4+
Subject: [PATCH] Address CVE-2025-22870
5+
Upstream Patch Reference : https://github.com/golang/go/commit/334de7982f8ec959c74470dd709ceedfd6dbd50a#diff-535738d3f027e78324e07f2c97d9e1cd704253a1691bb1de8868565d56b4affe
6+
7+
---
8+
src/cmd/internal/moddeps/moddeps_test.go | 1 +
9+
src/vendor/golang.org/x/net/http/httpproxy/proxy.go | 10 ++++++++--
10+
2 files changed, 9 insertions(+), 2 deletions(-)
11+
12+
diff --git a/src/cmd/internal/moddeps/moddeps_test.go b/src/cmd/internal/moddeps/moddeps_test.go
13+
index 2def029325be55..0b43b20b3c19fa 100644
14+
--- a/src/cmd/internal/moddeps/moddeps_test.go
15+
+++ b/src/cmd/internal/moddeps/moddeps_test.go
16+
@@ -33,6 +33,7 @@ import (
17+
// See issues 36852, 41409, and 43687.
18+
// (Also see golang.org/issue/27348.)
19+
func TestAllDependencies(t *testing.T) {
20+
+ t.Skip("TODO(#71986): 1.24.1 contains unreleased changes from vendored modules")
21+
goBin := testenv.GoToolPath(t)
22+
23+
// Ensure that all packages imported within GOROOT
24+
diff --git a/src/vendor/golang.org/x/net/http/httpproxy/proxy.go b/src/vendor/golang.org/x/net/http/httpproxy/proxy.go
25+
index 6404aaf157d6ad..d89c257ae72314 100644
26+
--- a/src/vendor/golang.org/x/net/http/httpproxy/proxy.go
27+
+++ b/src/vendor/golang.org/x/net/http/httpproxy/proxy.go
28+
@@ -14,6 +14,7 @@ import (
29+
"errors"
30+
"fmt"
31+
"net"
32+
+ "net/netip"
33+
"net/url"
34+
"os"
35+
"strings"
36+
@@ -177,8 +178,10 @@ func (cfg *config) useProxy(addr string) bool {
37+
if host == "localhost" {
38+
return false
39+
}
40+
- ip := net.ParseIP(host)
41+
- if ip != nil {
42+
+ nip, err := netip.ParseAddr(host)
43+
+ var ip net.IP
44+
+ if err == nil {
45+
+ ip = net.IP(nip.AsSlice())
46+
if ip.IsLoopback() {
47+
return false
48+
}
49+
@@ -360,6 +363,9 @@ type domainMatch struct {
50+
}
51+
52+
func (m domainMatch) match(host, port string, ip net.IP) bool {
53+
+ if ip != nil {
54+
+ return false
55+
+ }
56+
if strings.HasSuffix(host, m.host) || (m.matchHost && host == m.host[1:]) {
57+
return m.port == "" || m.port == port
58+
}
59+
--
60+
2.45.3
61+

‎SPECS/golang/golang-1.18.spec‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
Summary: Go
1414
Name: golang
1515
Version: 1.18.8
16-
Release: 7%{?dist}
16+
Release: 8%{?dist}
1717
License: BSD-3-Clause
1818
Vendor: Microsoft Corporation
1919
Distribution: Mariner
@@ -29,6 +29,9 @@ Patch2: CVE-2024-24790.patch
2929
Patch3: CVE-2024-45341.patch
3030
Patch4: CVE-2024-34158.patch
3131
Patch5: CVE-2025-22871.patch
32+
Patch6: CVE-2024-24789.patch
33+
Patch7: CVE-2025-22870-1.18.patch
34+
Patch8: CVE-2024-34155.patch
3235
Obsoletes: %{name} < %{version}
3336
Provides: %{name} = %{version}
3437
Provides: go = %{version}-%{release}
@@ -50,6 +53,9 @@ patch -Np1 --ignore-whitespace < %{PATCH2}
5053
patch -Np1 --ignore-whitespace < %{PATCH3}
5154
patch -Np1 --ignore-whitespace < %{PATCH4}
5255
patch -Np1 --ignore-whitespace < %{PATCH5}
56+
patch -Np1 --ignore-whitespace < %{PATCH6}
57+
patch -Np1 --ignore-whitespace < %{PATCH7}
58+
patch -Np1 --ignore-whitespace < %{PATCH8}
5359

5460
%build
5561
# Build go 1.4 bootstrap
@@ -130,6 +136,9 @@ fi
130136
%{_bindir}/*
131137

132138
%changelog
139+
* Fri Apr 25 2025 Archana Shettigar <v-shettigara@microsoft.com> - 1.18.8-8
140+
- Patch CVE-2024-24789, CVE-2024-34155 & CVE-2025-22870
141+
133142
* Mon Apr 21 2025 Bhagyashri Pathak <bhapathak@microsoft.com> - 1.18.8-7
134143
- Address CVE-2025-22871 using an upstream patch.
135144

@@ -139,7 +148,7 @@ fi
139148
* Tue Feb 04 2025 Kanishk bansal <kanbansal@microsoft.com> - 1.18.8-5
140149
- Address CVE-2024-45341 using an upstream patch.
141150

142-
* Mon July 29 2024 Bhagyashri Pathak bhapathak@microsoft.com - 1.18.8-4
151+
* Mon Jul 29 2024 Bhagyashri Pathak bhapathak@microsoft.com - 1.18.8-4
143152
- Patch CVE-2024-24790
144153

145154
* Mon Jan 23 2022 Nicolas Guibourge <nicolasg@microsoft.com> - 1.18.8-3

‎SPECS/golang/golang.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
Summary: Go
1616
Name: golang
1717
Version: 1.22.7
18-
Release: 3%{?dist}
18+
Release: 4%{?dist}
1919
License: BSD-3-Clause
2020
Vendor: Microsoft Corporation
2121
Distribution: Mariner
@@ -29,6 +29,7 @@ Patch0: go14_bootstrap_aarch64.patch
2929
Patch1: CVE-2024-45336.patch
3030
Patch2: CVE-2024-45341.patch
3131
Patch3: CVE-2025-22871.patch
32+
Patch4: CVE-2025-22870.patch
3233
Obsoletes: %{name} < %{version}
3334
Provides: %{name} = %{version}
3435
Provides: go = %{version}-%{release}
@@ -47,6 +48,7 @@ mv -v go go-bootstrap
4748
%patch 1 -p1
4849
%patch 2 -p1
4950
%patch 3 -p1
51+
%patch 4 -p1
5052

5153
%build
5254
# Go 1.22 requires the final point release of Go 1.20 or later for bootstrap.
@@ -162,6 +164,9 @@ fi
162164
%{_bindir}/*
163165

164166
%changelog
167+
* Thu May 08 2025 Archana Shettigar <v-shettigara@microsoft.com> - 1.22.7-4
168+
- Address CVE-2025-22870 using an upstream patch.
169+
165170
* Thu Apr 10 2025 Bhagyashri Pathak <bhapathak@microsoft.com> - 1.22.7-3
166171
- Address CVE-2025-22871 using an upstream patch.
167172

0 commit comments

Comments
 (0)