Skip to content

Commit fd5e30e

Browse files
PawelWMSPawelWMS
authored
1 parent 629ddaf commit fd5e30e

14 files changed

Lines changed: 421 additions & 15 deletions

‎SPECS/application-gateway-kubernetes-ingress/CVE-2021-44716.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials)
2+
Author: Damien Neil <dneil@google.com>
3+
AuthorDate: 2021-12-06 14:31:43 -0800
4+
Commit: Filippo Valsorda <filippo@golang.org>
5+
CommitDate: 2021-12-09 12:49:13 +0000
6+
7+
http2: cap the size of the server's canonical header cache
8+
9+
The HTTP/2 server keeps a per-connection cache mapping header keys
10+
to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the
11+
maximum size of this cache to prevent a peer sending many unique
12+
header keys from causing unbounded memory growth.
13+
14+
Cap chosen arbitrarily at 32 entries. Since this cache does not
15+
include common headers (e.g., "content-type"), 32 seems like more
16+
than enough for almost all normal uses.
17+
18+
Fixes #50058
19+
Fixes CVE-2021-44716
20+
21+
Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105
22+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827
23+
Reviewed-by: Roland Shoemaker <bracewell@google.com>
24+
Reviewed-on: https://go-review.googlesource.com/c/net/+/369794
25+
Trust: Filippo Valsorda <filippo@golang.org>
26+
Run-TryBot: Filippo Valsorda <filippo@golang.org>
27+
Trust: Damien Neil <dneil@google.com>
28+
Reviewed-by: Russ Cox <rsc@golang.org>
29+
Reviewed-by: Filippo Valsorda <filippo@golang.org>
30+
TryBot-Result: Gopher Robot <gobot@golang.org>
31+
32+
diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go
33+
--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800
34+
+++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800
35+
@@ -720,7 +720,15 @@
36+
sc.canonHeader = make(map[string]string)
37+
}
38+
cv = http.CanonicalHeaderKey(v)
39+
- sc.canonHeader[v] = cv
40+
+ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
41+
+ // entries in the canonHeader cache. This should be larger than the number
42+
+ // of unique, uncommon header keys likely to be sent by the peer, while not
43+
+ // so high as to permit unreaasonable memory usage if the peer sends an unbounded
44+
+ // number of unique header keys.
45+
+ const maxCachedCanonicalHeaders = 32
46+
+ if len(sc.canonHeader) < maxCachedCanonicalHeaders {
47+
+ sc.canonHeader[v] = cv
48+
+ }
49+
return cv
50+
}
51+

‎SPECS/application-gateway-kubernetes-ingress/application-gateway-kubernetes-ingress.spec‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Application Gateway Ingress Controller
33
Name: application-gateway-kubernetes-ingress
44
Version: 1.4.0
5-
Release: 18%{?dist}
5+
Release: 19%{?dist}
66
License: MIT
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -24,9 +24,13 @@ Source0: %{name}-%{version}.tar.gz
2424
# -cf %%{name}-%%{version}-vendor.tar.gz vendor
2525
#
2626
Source1: %{name}-%{version}-vendor.tar.gz
27+
28+
# patches for vendored code >= 1000
2729
# If upstream ever upgrades client_goland to 1.11.1, we can get rid of this patch.
28-
Patch0: CVE-2022-21698.patch
29-
Patch1: CVE-2023-44487.patch
30+
Patch1000: CVE-2022-21698.patch
31+
Patch1001: CVE-2023-44487.patch
32+
Patch1002: CVE-2021-44716.patch
33+
3034
BuildRequires: golang >= 1.13
3135
%if %{with_check}
3236
BuildRequires: helm
@@ -64,6 +68,9 @@ cp appgw-ingress %{buildroot}%{_bindir}/
6468
%{_bindir}/appgw-ingress
6569

6670
%changelog
71+
* Mon Feb 05 2024 Nicolas Guibourge <nicolasg@microsoft.com> - 1.4.0-19
72+
- Patch CVE-2021-44716
73+
6774
* Thu Feb 01 2024 Daniel McIlvaney <damcilva@microsoft.com> - 1.4.0-18
6875
- Address CVE-2023-44487 by patching vendored golang.org/x/net
6976
- Add check section

‎SPECS/cf-cli/CVE-2021-44716.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials)
2+
Author: Damien Neil <dneil@google.com>
3+
AuthorDate: 2021-12-06 14:31:43 -0800
4+
Commit: Filippo Valsorda <filippo@golang.org>
5+
CommitDate: 2021-12-09 12:49:13 +0000
6+
7+
http2: cap the size of the server's canonical header cache
8+
9+
The HTTP/2 server keeps a per-connection cache mapping header keys
10+
to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the
11+
maximum size of this cache to prevent a peer sending many unique
12+
header keys from causing unbounded memory growth.
13+
14+
Cap chosen arbitrarily at 32 entries. Since this cache does not
15+
include common headers (e.g., "content-type"), 32 seems like more
16+
than enough for almost all normal uses.
17+
18+
Fixes #50058
19+
Fixes CVE-2021-44716
20+
21+
Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105
22+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827
23+
Reviewed-by: Roland Shoemaker <bracewell@google.com>
24+
Reviewed-on: https://go-review.googlesource.com/c/net/+/369794
25+
Trust: Filippo Valsorda <filippo@golang.org>
26+
Run-TryBot: Filippo Valsorda <filippo@golang.org>
27+
Trust: Damien Neil <dneil@google.com>
28+
Reviewed-by: Russ Cox <rsc@golang.org>
29+
Reviewed-by: Filippo Valsorda <filippo@golang.org>
30+
TryBot-Result: Gopher Robot <gobot@golang.org>
31+
32+
diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go
33+
--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800
34+
+++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800
35+
@@ -720,7 +720,15 @@
36+
sc.canonHeader = make(map[string]string)
37+
}
38+
cv = http.CanonicalHeaderKey(v)
39+
- sc.canonHeader[v] = cv
40+
+ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
41+
+ // entries in the canonHeader cache. This should be larger than the number
42+
+ // of unique, uncommon header keys likely to be sent by the peer, while not
43+
+ // so high as to permit unreaasonable memory usage if the peer sends an unbounded
44+
+ // number of unique header keys.
45+
+ const maxCachedCanonicalHeaders = 32
46+
+ if len(sc.canonHeader) < maxCachedCanonicalHeaders {
47+
+ sc.canonHeader[v] = cv
48+
+ }
49+
return cv
50+
}
51+

‎SPECS/cf-cli/cf-cli.spec‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: The official command line client for Cloud Foundry.
22
Name: cf-cli
33
Version: 8.4.0
4-
Release: 15%{?dist}
4+
Release: 16%{?dist}
55
License: Apache-2.0
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -27,7 +27,10 @@ Source0: https://github.com/cloudfoundry/cli/archive/refs/tags/v%{version
2727
# See: https://reproducible-builds.org/docs/archives/
2828
# - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates.
2929
Source1: cli-%{version}-vendor.tar.gz
30-
Patch0: CVE-2023-44487.patch
30+
31+
# patches for vendored code >= 1000
32+
Patch1000: CVE-2023-44487.patch
33+
Patch1001: CVE-2021-44716.patch
3134

3235
BuildRequires: golang >= 1.18.3
3336
%global debug_package %{nil}
@@ -62,6 +65,9 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./out/cf
6265
%{_bindir}/cf
6366

6467
%changelog
68+
* Mon Feb 05 2024 Nicolas Guibourge <nicolasg@microsoft.com> - 8.4.0-16
69+
- Patch CVE-2021-44716
70+
6571
* Thu Feb 01 2024 Daniel McIlvaney <damcilva@microsoft.com> - 8.4.0-15
6672
- Address CVE-2023-44487 by patching vendored golang.org/x/net
6773

‎SPECS/csi-driver-lvm/CVE-2021-44716.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials)
2+
Author: Damien Neil <dneil@google.com>
3+
AuthorDate: 2021-12-06 14:31:43 -0800
4+
Commit: Filippo Valsorda <filippo@golang.org>
5+
CommitDate: 2021-12-09 12:49:13 +0000
6+
7+
http2: cap the size of the server's canonical header cache
8+
9+
The HTTP/2 server keeps a per-connection cache mapping header keys
10+
to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the
11+
maximum size of this cache to prevent a peer sending many unique
12+
header keys from causing unbounded memory growth.
13+
14+
Cap chosen arbitrarily at 32 entries. Since this cache does not
15+
include common headers (e.g., "content-type"), 32 seems like more
16+
than enough for almost all normal uses.
17+
18+
Fixes #50058
19+
Fixes CVE-2021-44716
20+
21+
Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105
22+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827
23+
Reviewed-by: Roland Shoemaker <bracewell@google.com>
24+
Reviewed-on: https://go-review.googlesource.com/c/net/+/369794
25+
Trust: Filippo Valsorda <filippo@golang.org>
26+
Run-TryBot: Filippo Valsorda <filippo@golang.org>
27+
Trust: Damien Neil <dneil@google.com>
28+
Reviewed-by: Russ Cox <rsc@golang.org>
29+
Reviewed-by: Filippo Valsorda <filippo@golang.org>
30+
TryBot-Result: Gopher Robot <gobot@golang.org>
31+
32+
diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go
33+
--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800
34+
+++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800
35+
@@ -720,7 +720,15 @@
36+
sc.canonHeader = make(map[string]string)
37+
}
38+
cv = http.CanonicalHeaderKey(v)
39+
- sc.canonHeader[v] = cv
40+
+ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
41+
+ // entries in the canonHeader cache. This should be larger than the number
42+
+ // of unique, uncommon header keys likely to be sent by the peer, while not
43+
+ // so high as to permit unreaasonable memory usage if the peer sends an unbounded
44+
+ // number of unique header keys.
45+
+ const maxCachedCanonicalHeaders = 32
46+
+ if len(sc.canonHeader) < maxCachedCanonicalHeaders {
47+
+ sc.canonHeader[v] = cv
48+
+ }
49+
return cv
50+
}
51+

‎SPECS/csi-driver-lvm/csi-driver-lvm.spec‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Container storage interface for logical volume management
22
Name: csi-driver-lvm
33
Version: 0.4.1
4-
Release: 14%{?dist}
4+
Release: 15%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -19,6 +19,10 @@ Source0: https://github.com/metal-stack/%{name}/archive/refs/tags/v%{vers
1919
# --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime \
2020
# -cf %%{name}-%%{version}-govendor.tar.gz vendor
2121
Source1: %{name}-%{version}-govendor.tar.gz
22+
23+
# patches for vendored code >= 1000
24+
Patch1000: CVE-2021-44716.patch
25+
2226
BuildRequires: golang
2327
Requires: %{name}-csi-lvmplugin-provisioner
2428
Requires: %{name}-lvmplugin
@@ -39,8 +43,12 @@ Summary: csi-driver-lvm's lvmplugin binary
3943
lvmplugin collects the size of logical volumes (LV) and free space inside a volume group (VG) from Linux' Logical Volume Manager (LVM).
4044

4145
%prep
42-
%autosetup
43-
%setup -q -T -D -a 1
46+
%autosetup -N
47+
48+
# Apply vendor before patching
49+
tar --no-same-owner -xf %{SOURCE1}
50+
51+
%autopatch -p1
4452

4553
%build
4654
%make_build
@@ -63,6 +71,9 @@ install -D -m0755 bin/lvmplugin %{buildroot}%{_bindir}/
6371
%{_bindir}/lvmplugin
6472

6573
%changelog
74+
* Mon Feb 05 2024 Nicolas Guibourge <nicolasg@microsoft.com> - 0.4.1-15
75+
- Patch CVE-2021-44716
76+
6677
* Mon Oct 16 2023 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 0.4.1-14
6778
- Bump release to rebuild with go 1.20.9
6879

‎SPECS/git-lfs/CVE-2021-44716.patch‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
Parent: db4efeb8 (http2: deflake TestTransportGroupsPendingDials)
2+
Author: Damien Neil <dneil@google.com>
3+
AuthorDate: 2021-12-06 14:31:43 -0800
4+
Commit: Filippo Valsorda <filippo@golang.org>
5+
CommitDate: 2021-12-09 12:49:13 +0000
6+
7+
http2: cap the size of the server's canonical header cache
8+
9+
The HTTP/2 server keeps a per-connection cache mapping header keys
10+
to their canonicalized form (e.g., "foo-bar" => "Foo-Bar"). Cap the
11+
maximum size of this cache to prevent a peer sending many unique
12+
header keys from causing unbounded memory growth.
13+
14+
Cap chosen arbitrarily at 32 entries. Since this cache does not
15+
include common headers (e.g., "content-type"), 32 seems like more
16+
than enough for almost all normal uses.
17+
18+
Fixes #50058
19+
Fixes CVE-2021-44716
20+
21+
Change-Id: Ia83696dc23253c12af8f26d502557c2cc9841105
22+
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1290827
23+
Reviewed-by: Roland Shoemaker <bracewell@google.com>
24+
Reviewed-on: https://go-review.googlesource.com/c/net/+/369794
25+
Trust: Filippo Valsorda <filippo@golang.org>
26+
Run-TryBot: Filippo Valsorda <filippo@golang.org>
27+
Trust: Damien Neil <dneil@google.com>
28+
Reviewed-by: Russ Cox <rsc@golang.org>
29+
Reviewed-by: Filippo Valsorda <filippo@golang.org>
30+
TryBot-Result: Gopher Robot <gobot@golang.org>
31+
32+
diff -ru cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go cli-20.10.27/vendor/golang.org/x/net/http2/server.go
33+
--- cli-20.10.27-orig/vendor/golang.org/x/net/http2/server.go 2024-02-05 08:53:30.802532951 -0800
34+
+++ cli-20.10.27/vendor/golang.org/x/net/http2/server.go 2024-02-05 09:19:08.473430121 -0800
35+
@@ -720,7 +720,15 @@
36+
sc.canonHeader = make(map[string]string)
37+
}
38+
cv = http.CanonicalHeaderKey(v)
39+
- sc.canonHeader[v] = cv
40+
+ // maxCachedCanonicalHeaders is an arbitrarily-chosen limit on the number of
41+
+ // entries in the canonHeader cache. This should be larger than the number
42+
+ // of unique, uncommon header keys likely to be sent by the peer, while not
43+
+ // so high as to permit unreaasonable memory usage if the peer sends an unbounded
44+
+ // number of unique header keys.
45+
+ const maxCachedCanonicalHeaders = 32
46+
+ if len(sc.canonHeader) < maxCachedCanonicalHeaders {
47+
+ sc.canonHeader[v] = cv
48+
+ }
49+
return cv
50+
}
51+

‎SPECS/git-lfs/git-lfs.spec‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Git extension for versioning large files
33
Name: git-lfs
44
Version: 3.1.4
5-
Release: 16%{?dist}
5+
Release: 17%{?dist}
66
Group: System Environment/Programming
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -28,7 +28,10 @@ Source0: https://github.com/git-lfs/git-lfs/archive/v%{version}.tar.gz#/%{
2828
# See: https://reproducible-builds.org/docs/archives/
2929
# - For the value of "--mtime" use the date "2021-04-26 00:00Z" to simplify future updates.
3030
Source1: %{name}-%{version}-vendor.tar.gz
31-
Patch0: CVE-2023-44487.patch
31+
32+
# patches for vendored code >= 1000
33+
Patch1000: CVE-2023-44487.patch
34+
Patch1001: CVE-2021-44716.patch
3235

3336
BuildRequires: golang
3437
BuildRequires: which
@@ -80,6 +83,9 @@ git lfs uninstall
8083
%{_mandir}/man5/*
8184

8285
%changelog
86+
* Mon Feb 05 2024 Nicolas Guibourge <nicolasg@microsoft.com> - 3.1.4-17
87+
- Patch CVE-2021-44716
88+
8389
* Thu Feb 01 2024 Daniel McIlvaney <damcilva@microsoft.com> - 3.1.4-16
8490
- Address CVE-2023-44487 by patching vendored golang.org/x/net
8591

0 commit comments

Comments
 (0)