Skip to content

Commit d91c52f

Browse files
akhila-gurujuakhila-guruju
authored
[Medium] Patch rook for CVE-2025-11065 (#15693)
1 parent 93207ea commit d91c52f

3 files changed

Lines changed: 225 additions & 7 deletions

File tree

‎SPECS/rook/CVE-2021-44716.patch‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,9 @@ Reviewed-by: Russ Cox <rsc@golang.org>
2929
Reviewed-by: Filippo Valsorda <filippo@golang.org>
3030
TryBot-Result: Gopher Robot <gobot@golang.org>
3131

32-
diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go
33-
--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800
34-
+++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800
32+
diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go
33+
--- a/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800
34+
+++ b/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800
3535
@@ -720,7 +720,15 @@
3636
sc.canonHeader = make(map[string]string)
3737
}
@@ -48,4 +48,4 @@ diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/
4848
+ }
4949
return cv
5050
}
51-
51+

‎SPECS/rook/CVE-2025-11065.patch‎

Lines changed: 216 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
From 742921c9ba2854d27baa64272487fc5075d2c39c Mon Sep 17 00:00:00 2001
2+
From: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
3+
Date: Sat, 12 Jul 2025 07:25:50 +0200
4+
Subject: [PATCH] fix: error message leaks
5+
6+
Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
7+
8+
Upstream Patch reference: https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c.patch
9+
---
10+
.../mitchellh/mapstructure/decode_hooks.go | 12 ++-
11+
.../mitchellh/mapstructure/error.go | 90 +++++++++++++++++++
12+
.../mitchellh/mapstructure/mapstructure.go | 10 +--
13+
3 files changed, 103 insertions(+), 9 deletions(-)
14+
15+
diff --git a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
16+
index 1f0abc6..4f70b03 100644
17+
--- a/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
18+
+++ b/vendor/github.com/mitchellh/mapstructure/decode_hooks.go
19+
@@ -113,7 +113,9 @@ func StringToTimeDurationHookFunc() DecodeHookFunc {
20+
}
21+
22+
// Convert it by parsing
23+
- return time.ParseDuration(data.(string))
24+
+ d, err := time.ParseDuration(data.(string))
25+
+
26+
+ return d, wrapTimeParseDurationError(err)
27+
}
28+
}
29+
30+
@@ -134,7 +136,7 @@ func StringToIPHookFunc() DecodeHookFunc {
31+
// Convert it by parsing
32+
ip := net.ParseIP(data.(string))
33+
if ip == nil {
34+
- return net.IP{}, fmt.Errorf("failed parsing ip %v", data)
35+
+ return net.IP{}, fmt.Errorf("failed parsing ip")
36+
}
37+
38+
return ip, nil
39+
@@ -157,7 +159,7 @@ func StringToIPNetHookFunc() DecodeHookFunc {
40+
41+
// Convert it by parsing
42+
_, net, err := net.ParseCIDR(data.(string))
43+
- return net, err
44+
+ return net, wrapNetParseError(err)
45+
}
46+
}
47+
48+
@@ -176,7 +178,9 @@ func StringToTimeHookFunc(layout string) DecodeHookFunc {
49+
}
50+
51+
// Convert it by parsing
52+
- return time.Parse(layout, data.(string))
53+
+ ti, err := time.Parse(layout, data.(string))
54+
+
55+
+ return ti, wrapTimeParseError(err)
56+
}
57+
}
58+
59+
diff --git a/vendor/github.com/mitchellh/mapstructure/error.go b/vendor/github.com/mitchellh/mapstructure/error.go
60+
index 47a99e5..c5ac764 100644
61+
--- a/vendor/github.com/mitchellh/mapstructure/error.go
62+
+++ b/vendor/github.com/mitchellh/mapstructure/error.go
63+
@@ -3,8 +3,11 @@ package mapstructure
64+
import (
65+
"errors"
66+
"fmt"
67+
+ "net"
68+
"sort"
69+
+ "strconv"
70+
"strings"
71+
+ "time"
72+
)
73+
74+
// Error implements the error interface and can represents multiple
75+
@@ -48,3 +51,90 @@ func appendErrors(errors []string, err error) []string {
76+
return append(errors, e.Error())
77+
}
78+
}
79+
+
80+
+func wrapStrconvNumError(err error) error {
81+
+ if err == nil {
82+
+ return nil
83+
+ }
84+
+
85+
+ if err, ok := err.(*strconv.NumError); ok {
86+
+ return &strconvNumError{Err: err}
87+
+ }
88+
+
89+
+ return err
90+
+}
91+
+
92+
+type strconvNumError struct {
93+
+ Err *strconv.NumError
94+
+}
95+
+
96+
+func (e *strconvNumError) Error() string {
97+
+ return "strconv." + e.Err.Func + ": " + e.Err.Err.Error()
98+
+}
99+
+
100+
+func (e *strconvNumError) Unwrap() error { return e.Err }
101+
+
102+
+func wrapNetParseError(err error) error {
103+
+ if err == nil {
104+
+ return nil
105+
+ }
106+
+
107+
+ if err, ok := err.(*net.ParseError); ok {
108+
+ return &netParseError{Err: err}
109+
+ }
110+
+
111+
+ return err
112+
+}
113+
+
114+
+type netParseError struct {
115+
+ Err *net.ParseError
116+
+}
117+
+
118+
+func (e *netParseError) Error() string {
119+
+ return "invalid " + e.Err.Type
120+
+}
121+
+
122+
+func (e *netParseError) Unwrap() error { return e.Err }
123+
+
124+
+func wrapTimeParseError(err error) error {
125+
+ if err == nil {
126+
+ return nil
127+
+ }
128+
+
129+
+ if err, ok := err.(*time.ParseError); ok {
130+
+ return &timeParseError{Err: err}
131+
+ }
132+
+
133+
+ return err
134+
+}
135+
+
136+
+type timeParseError struct {
137+
+ Err *time.ParseError
138+
+}
139+
+
140+
+func (e *timeParseError) Error() string {
141+
+ if e.Err.Message == "" {
142+
+ return fmt.Sprintf("parsing time as %q: cannot parse as %q", e.Err.Layout, e.Err.LayoutElem)
143+
+ }
144+
+
145+
+ return "parsing time " + e.Err.Message
146+
+}
147+
+
148+
+func (e *timeParseError) Unwrap() error { return e.Err }
149+
+
150+
+func wrapTimeParseDurationError(err error) error {
151+
+ if err == nil {
152+
+ return nil
153+
+ }
154+
+
155+
+ errMsg := err.Error()
156+
+ if strings.HasPrefix(errMsg, "time: unknown unit ") {
157+
+ return errors.New("time: unknown unit")
158+
+ } else if strings.HasPrefix(errMsg, "time: ") {
159+
+ idx := strings.LastIndex(errMsg, " ")
160+
+
161+
+ return errors.New(errMsg[:idx])
162+
+ }
163+
+
164+
+ return err
165+
+}
166+
diff --git a/vendor/github.com/mitchellh/mapstructure/mapstructure.go b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
167+
index b384d9d..21c2264 100644
168+
--- a/vendor/github.com/mitchellh/mapstructure/mapstructure.go
169+
+++ b/vendor/github.com/mitchellh/mapstructure/mapstructure.go
170+
@@ -592,7 +592,7 @@ func (d *Decoder) decodeInt(name string, data interface{}, val reflect.Value) er
171+
if err == nil {
172+
val.SetInt(i)
173+
} else {
174+
- return fmt.Errorf("cannot parse '%s' as int: %s", name, err)
175+
+ return fmt.Errorf("cannot parse '%s' as int: %s", name, wrapStrconvNumError(err))
176+
}
177+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
178+
jn := data.(json.Number)
179+
@@ -644,14 +644,14 @@ func (d *Decoder) decodeUint(name string, data interface{}, val reflect.Value) e
180+
if err == nil {
181+
val.SetUint(i)
182+
} else {
183+
- return fmt.Errorf("cannot parse '%s' as uint: %s", name, err)
184+
+ return fmt.Errorf("cannot parse '%s' as uint: %s", name, wrapStrconvNumError(err))
185+
}
186+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
187+
jn := data.(json.Number)
188+
i, err := jn.Int64()
189+
if err != nil {
190+
return fmt.Errorf(
191+
- "error decoding json.Number into %s: %s", name, err)
192+
+ "error decoding json.Number into %s: %s", name, wrapStrconvNumError(err))
193+
}
194+
if i < 0 && !d.config.WeaklyTypedInput {
195+
return fmt.Errorf("cannot parse '%s', %d overflows uint",
196+
@@ -687,7 +687,7 @@ func (d *Decoder) decodeBool(name string, data interface{}, val reflect.Value) e
197+
} else if dataVal.String() == "" {
198+
val.SetBool(false)
199+
} else {
200+
- return fmt.Errorf("cannot parse '%s' as bool: %s", name, err)
201+
+ return fmt.Errorf("cannot parse '%s' as bool: %s", name, wrapStrconvNumError(err))
202+
}
203+
default:
204+
return fmt.Errorf(
205+
@@ -721,7 +721,7 @@ func (d *Decoder) decodeFloat(name string, data interface{}, val reflect.Value)
206+
if err == nil {
207+
val.SetFloat(f)
208+
} else {
209+
- return fmt.Errorf("cannot parse '%s' as float: %s", name, err)
210+
+ return fmt.Errorf("cannot parse '%s' as float: %s", name, wrapStrconvNumError(err))
211+
}
212+
case dataType.PkgPath() == "encoding/json" && dataType.Name() == "Number":
213+
jn := data.(json.Number)
214+
--
215+
2.43.0
216+

‎SPECS/rook/rook.spec‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
Summary: Orchestrator for distributed storage systems in cloud-native environments
2020
Name: rook
2121
Version: 1.6.2
22-
Release: 28%{?dist}
22+
Release: 29%{?dist}
2323
License: Apache-2.0
2424
Vendor: Microsoft Corporation
2525
Distribution: Mariner
@@ -63,6 +63,7 @@ Patch6: CVE-2022-3162.patch
6363
Patch7: CVE-2025-27144.patch
6464
Patch8: CVE-2024-51744.patch
6565
Patch9: CVE-2025-30204.patch
66+
Patch10: CVE-2025-11065.patch
6667
# Ceph version is needed to set correct container tag in manifests
6768
BuildRequires: ceph
6869
# Rook requirements
@@ -246,11 +247,9 @@ sed -i -e "s|\(.*tag: \)VERSION|\1%{helm_appVersion}|" %{values_yaml}
246247
%files k8s-yaml
247248
%dir %{_datarootdir}/k8s-yaml
248249
%dir %{_datarootdir}/k8s-yaml/rook
249-
%dir %{_datarootdir}/k8s-yaml/rook/ceph
250250
%{_datadir}/k8s-yaml/rook/ceph/
251251

252252
%files ceph-helm-charts
253-
%doc %{_datadir}/%{name}-ceph-helm-charts/operator/README.md
254253
%{_datadir}/%{name}-ceph-helm-charts
255254

256255
################################################################################
@@ -261,6 +260,9 @@ sed -i -e "s|\(.*tag: \)VERSION|\1%{helm_appVersion}|" %{values_yaml}
261260
# bother adding docs or changelog or anything
262261

263262
%changelog
263+
* Mon Mar 09 2026 Akhila Guruju <v-guakhila@microsoft.com> - 1.6.2-29
264+
- Patch CVE-2025-11065
265+
264266
* Mon Feb 23 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.6.2-28
265267
- Patch for CVE-2025-30204
266268

0 commit comments

Comments
 (0)