Skip to content

Commit f44d988

Browse files
[AutoPR- Security] Patch telegraf for CVE-2025-10543 [MEDIUM] (#15273)
1 parent e2a8f0b commit f44d988

2 files changed

Lines changed: 37 additions & 1 deletion

File tree

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
From 8facc4d18c3aa37db07861d3085051f45db72f6a Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Mon, 8 Dec 2025 12:25:03 +0000
4+
Subject: [PATCH] Fields over 65535 bytes now encoded correctly
5+
6+
When encoding strings (1.5.3 in spec), and some other variable length fields, if the user passed in more than 65535 bytes the output would not be as expected (due to 16 byte header there is a hard limit). This change truncates output to 65535 bytes.
7+
8+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
9+
Upstream-reference: AI Backport of https://github.com/eclipse-paho/paho.mqtt.golang/commit/3162447fa892038e82256e918b681dc0c63a21ff.patch
10+
---
11+
.../github.com/eclipse/paho.mqtt.golang/packets/packets.go | 5 +++++
12+
1 file changed, 5 insertions(+)
13+
14+
diff --git a/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go b/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go
15+
index b2d7ed1b..7cc3c6d8 100644
16+
--- a/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go
17+
+++ b/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go
18+
@@ -330,6 +330,11 @@ func decodeBytes(b io.Reader) ([]byte, error) {
19+
}
20+
21+
func encodeBytes(field []byte) []byte {
22+
+ // Attempting to encode more than 65,535 bytes would lead to an unexpected 16-bit length and extra data written
23+
+ // (which would be parsed as later parts of the message). The safest option is to truncate.
24+
+ if len(field) > 65535 {
25+
+ field = field[0:65535]
26+
+ }
27+
fieldLength := make([]byte, 2)
28+
binary.BigEndian.PutUint16(fieldLength, uint16(len(field)))
29+
return append(fieldLength, field...)
30+
--
31+
2.45.4
32+

SPECS/telegraf/telegraf.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: agent for collecting, processing, aggregating, and writing metrics.
22
Name: telegraf
33
Version: 1.29.4
4-
Release: 17%{?dist}
4+
Release: 18%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -27,6 +27,7 @@ Patch13: CVE-2025-22870.patch
2727
Patch14: CVE-2024-51744.patch
2828
Patch15: CVE-2025-30215.patch
2929
Patch16: CVE-2025-22872.patch
30+
Patch17: CVE-2025-10543.patch
3031
BuildRequires: golang
3132
BuildRequires: iana-etc
3233
BuildRequires: systemd-devel
@@ -97,6 +98,9 @@ fi
9798
%dir %{_sysconfdir}/%{name}/telegraf.d
9899

99100
%changelog
101+
* Mon Dec 08 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.29.4-18
102+
- Patch for CVE-2025-10543
103+
100104
* Thu Sep 04 2025 Akhila Guruju <v-guakhila@microsoft.com> - 1.29.4-17
101105
- Bump release to rebuild with golang
102106

0 commit comments

Comments
 (0)