Upgrade etcd to 3.5.21 for CVE-2025-30204 [High] (#13197)

(cherry picked from commit 459c8b5)

Author: jslobodzian

SPECS/etcd/CVE-2023-45288.patch

@@ -1,7 +1,7 @@
 {
   "Signatures": {
     "etcd.service": "4550a4967ba35670051cbfd9b4edf1fc57c0f1d7a07e51f88351ac44c76d8066",
-    "etcd-3.5.12-vendor.tar.gz": "2427523101fa0c5ec75f8c65224cddac89de86ae2f5d6b07f14ae7ea1b195064",
-    "etcd-3.5.12.tar.gz": "90b56a7f2f43a993d420954322e607a6e6a0ca5549f1f7c7dc3567d2f56678d9"
+    "etcd-3.5.21.tar.gz": "76d7fcafe4fcc957fcd45671226b992c16e5f5e724935dea9df0190ac2b13481",
+    "etcd-3.5.21-vendor.tar.gz": "b4c072080f0ca47c1d447b6547165b943206cb5cb71dbd35a9e68079fdeac5a7"
   }
 }

SPECS/etcd/CVE-2024-24786.patch

@@ -1,7 +1,7 @@
 Summary:        A highly-available key value store for shared configuration
 Name:           etcd
-Version:        3.5.12
-Release:        6%{?dist}
+Version:        3.5.21
+Release:        1%{?dist}
 License:        ASL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -13,10 +13,8 @@ Source1:        etcd.service
 # In order to regenerate this tarball, download the source tarball and run:
 #   generate_source_tarball.sh --srcTarball <source_tarball> --pkgVersion %%{version} --outFolder .
 Source2:        %{name}-%{version}-vendor.tar.gz
-Patch0:         CVE-2023-45288.patch
-Patch1:         CVE-2024-24786.patch
 
-BuildRequires:  golang
+BuildRequires:  msft-golang
 
 %description
 A highly-available key value store for shared configuration and service discovery.
@@ -32,7 +30,7 @@ The etcd-tools package contains the etcd-dump-db and etcd-dump-logs diagnostic
 tools.
 
 %prep
-%autosetup -N -p1
+%autosetup -N
 tar --no-same-owner -xf %{SOURCE2}
 
 %build
@@ -43,7 +41,6 @@ mkdir -p %{ETCD_OUT_DIR}
 for component in server etcdctl etcdutl; do
     pushd $component
     tar --no-same-owner -xf %{_builddir}/%{name}-%{version}/vendor-$component.tar.gz
-    patch -p1 -s --fuzz=0 --no-backup-if-mismatch -f --input %{PATCH0}
     go build \
         -o %{ETCD_OUT_DIR} \
         -ldflags=-X=go.etcd.io/etcd/api/v3/version.GitSHA=v%{version}
@@ -57,7 +54,6 @@ mkdir -p %{ETCD_TOOLS_OUT_DIR}
 for component in etcd-dump-db etcd-dump-logs; do
     pushd tools/$component
     tar --no-same-owner -xf %{_builddir}/%{name}-%{version}/vendor-$component.tar.gz
-    patch -p1 -s --fuzz=0 --no-backup-if-mismatch -f --input %{PATCH0}
     go build \
         -o %{ETCD_TOOLS_OUT_DIR}
     popd
@@ -119,6 +115,10 @@ install -vdm755 %{buildroot}%{_sharedstatedir}/etcd
 /%{_docdir}/%{name}-%{version}-tools/*
 
 %changelog
+* Sun Mar 30 2025 Kanishk Bansal <kanbansal@microsoft.com> - 3.5.21-1
+- Upgrade to 3.5.21 for CVE-2025-30204
+- Remove previously applied patches
+
 * Mon Dec 09 2024 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> - 3.5.12-6
 - Patch for CVE-2024-24786
 

SPECS/etcd/etcd.signatures.json

@@ -3358,8 +3358,8 @@
         "type": "other",
         "other": {
           "name": "etcd",
-          "version": "3.5.12",
-          "downloadUrl": "https://github.com/etcd-io/etcd/archive/v3.5.12.tar.gz"
+          "version": "3.5.21",
+          "downloadUrl": "https://github.com/etcd-io/etcd/archive/v3.5.21.tar.gz"
         }
       }
     },