Skip to content

Commit fea7c96

Browse files
corvus-calliduscorvus-callidus
authored
1 parent ac45317 commit fea7c96

4 files changed

Lines changed: 283 additions & 2 deletions

File tree

‎SPECS/moby-compose/CVE-2023-2253.patch‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
Backported from distribution/distribution upstream:
2+
https://github.com/distribution/distribution/commit/521ea3d973cb0c7089ebbcdd4ccadc34be941f54
3+
4+
Modified to apply to vendored code by: corvus-callidus <108946721+corvus-callidus@users.noreply.github.com>
5+
- Adjusted paths
6+
- Removed references to files which are not present in the vendored code
7+
8+
9+
From 521ea3d973cb0c7089ebbcdd4ccadc34be941f54 Mon Sep 17 00:00:00 2001
10+
From: "Jose D. Gomez R" <jose.gomez@suse.com>
11+
Date: Mon, 24 Apr 2023 18:52:27 +0200
12+
Subject: [PATCH] Fix runaway allocation on /v2/_catalog
13+
MIME-Version: 1.0
14+
Content-Type: text/plain; charset=UTF-8
15+
Content-Transfer-Encoding: 8bit
16+
17+
Introduced a Catalog entry in the configuration struct. With it,
18+
it's possible to control the maximum amount of entries returned
19+
by /v2/catalog (`GetCatalog` in registry/handlers/catalog.go).
20+
21+
It's set to a default value of 1000.
22+
23+
`GetCatalog` returns 100 entries by default if no `n` is
24+
provided. When provided it will be validated to be between `0`
25+
and `MaxEntries` defined in Configuration. When `n` is outside
26+
the aforementioned boundary, ErrorCodePaginationNumberInvalid is
27+
returned.
28+
29+
`GetCatalog` now handles `n=0` gracefully with an empty response
30+
as well.
31+
32+
Signed-off-by: José D. Gómez R. <1josegomezr@gmail.com>
33+
Co-authored-by: Cory Snider <corhere@gmail.com>
34+
---
35+
vendor/github.com/docker/distribution/registry/api/v2/descriptors.go | 17 ++
36+
vendor/github.com/docker/distribution/registry/api/v2/errors.go | 9 +
37+
2 files changed, 26 insertions(+)
38+
39+
diff --git a/vendor/github.com/docker/distribution/registry/api/v2/descriptors.go b/vendor/github.com/docker/distribution/registry/api/v2/descriptors.go
40+
index a9616c58ad..c3bf90f71d 100644
41+
--- a/vendor/github.com/docker/distribution/registry/api/v2/descriptors.go
42+
+++ b/vendor/github.com/docker/distribution/registry/api/v2/descriptors.go
43+
@@ -134,6 +134,19 @@ var (
44+
},
45+
}
46+
47+
+ invalidPaginationResponseDescriptor = ResponseDescriptor{
48+
+ Name: "Invalid pagination number",
49+
+ Description: "The received parameter n was invalid in some way, as described by the error code. The client should resolve the issue and retry the request.",
50+
+ StatusCode: http.StatusBadRequest,
51+
+ Body: BodyDescriptor{
52+
+ ContentType: "application/json",
53+
+ Format: errorsBody,
54+
+ },
55+
+ ErrorCodes: []errcode.ErrorCode{
56+
+ ErrorCodePaginationNumberInvalid,
57+
+ },
58+
+ }
59+
+
60+
repositoryNotFoundResponseDescriptor = ResponseDescriptor{
61+
Name: "No Such Repository Error",
62+
StatusCode: http.StatusNotFound,
63+
@@ -490,6 +503,7 @@ var routeDescriptors = []RouteDescriptor{
64+
},
65+
},
66+
Failures: []ResponseDescriptor{
67+
+ invalidPaginationResponseDescriptor,
68+
unauthorizedResponseDescriptor,
69+
repositoryNotFoundResponseDescriptor,
70+
deniedResponseDescriptor,
71+
@@ -1578,6 +1592,9 @@ var routeDescriptors = []RouteDescriptor{
72+
},
73+
},
74+
},
75+
+ Failures: []ResponseDescriptor{
76+
+ invalidPaginationResponseDescriptor,
77+
+ },
78+
},
79+
},
80+
},
81+
diff --git a/vendor/github.com/docker/distribution/registry/api/v2/errors.go b/vendor/github.com/docker/distribution/registry/api/v2/errors.go
82+
index 97d6923aa0..87e9f3c14b 100644
83+
--- a/vendor/github.com/docker/distribution/registry/api/v2/errors.go
84+
+++ b/vendor/github.com/docker/distribution/registry/api/v2/errors.go
85+
@@ -133,4 +133,13 @@ var (
86+
longer proceed.`,
87+
HTTPStatusCode: http.StatusNotFound,
88+
})
89+
+
90+
+ ErrorCodePaginationNumberInvalid = errcode.Register(errGroup, errcode.ErrorDescriptor{
91+
+ Value: "PAGINATION_NUMBER_INVALID",
92+
+ Message: "invalid number of results requested",
93+
+ Description: `Returned when the "n" parameter (number of results
94+
+ to return) is not an integer, "n" is negative or "n" is bigger than
95+
+ the maximum allowed.`,
96+
+ HTTPStatusCode: http.StatusBadRequest,
97+
+ })
98+
)

‎SPECS/moby-compose/CVE-2024-23650.patch‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
Backported from moby buildkit upstream:
2+
https://github.com/moby/buildkit/commit/1981eb123dc979fc71d097adeb5bbb84110aa9f4
3+
4+
Modified to apply to vendored code by: corvus-callidus <108946721+corvus-callidus@users.noreply.github.com>
5+
- Adjusted paths
6+
- Removed reference to files not present in the vendored version
7+
8+
From 8dfaf014d7f9721b501f99ab0aeb9f0ed957948d Mon Sep 17 00:00:00 2001
9+
From: Tonis Tiigi <tonistiigi@gmail.com>
10+
Date: Sun, 17 Dec 2023 20:43:57 -0800
11+
Subject: [PATCH 3/5] exporter: add validation for platforms key value
12+
13+
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
14+
(cherry picked from commit 432ece72ae124ce8a29ced6854a08206f09f3a73)
15+
---
16+
vendor/github.com/moby/buildkit/exporter/containerimage/exptypes/parse.go | 14 +++
17+
1 files changed, 14 insertions(+)
18+
19+
diff --git a/vendor/github.com/moby/buildkit/exporter/containerimage/exptypes/parse.go b/vendor/github.com/moby/buildkit/exporter/containerimage/exptypes/parse.go
20+
index 293a24ed0772..e8d9b7f0cb73 100644
21+
--- a/vendor/github.com/moby/buildkit/exporter/containerimage/exptypes/parse.go
22+
+++ b/vendor/github.com/moby/buildkit/exporter/containerimage/exptypes/parse.go
23+
@@ -17,6 +17,18 @@ func ParsePlatforms(meta map[string][]byte) (Platforms, error) {
24+
return Platforms{}, errors.Wrapf(err, "failed to parse platforms passed to provenance processor")
25+
}
26+
}
27+
+ if len(ps.Platforms) == 0 {
28+
+ return Platforms{}, errors.Errorf("invalid empty platforms index for exporter")
29+
+ }
30+
+ for i, p := range ps.Platforms {
31+
+ if p.ID == "" {
32+
+ return Platforms{}, errors.Errorf("invalid empty platform key for exporter")
33+
+ }
34+
+ if p.Platform.OS == "" || p.Platform.Architecture == "" {
35+
+ return Platforms{}, errors.Errorf("invalid platform value %v for exporter", p.Platform)
36+
+ }
37+
+ ps.Platforms[i].Platform = platforms.Normalize(p.Platform)
38+
+ }
39+
return ps, nil
40+
}
41+
42+
@@ -36,6 +48,8 @@ func ParsePlatforms(meta map[string][]byte) (Platforms, error) {
43+
OSFeatures: img.OSFeatures,
44+
Variant: img.Variant,
45+
}
46+
+ } else if img.OS != "" || img.Architecture != "" {
47+
+ return Platforms{}, errors.Errorf("invalid image config: os and architecture must be specified together")
48+
}
49+
}
50+
p = platforms.Normalize(p)
51+
52+
From 5d7d85f5a0388bb0faa0d9250f96b35814cff1f9 Mon Sep 17 00:00:00 2001
53+
From: Tonis Tiigi <tonistiigi@gmail.com>
54+
Date: Sun, 17 Dec 2023 23:39:51 -0800
55+
Subject: [PATCH 5/5] pb: add extra validation to protobuf types
56+
57+
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
58+
(cherry picked from commit 838635998dcae34bbde59e3eab129ab85bd37bef)
59+
---
60+
vendor/github.com/moby/buildkit/frontend/gateway/client/attestation.go | 6 ++++++
61+
62+
1 files changed, 6 insertions(+)
63+
64+
diff --git a/vendor/github.com/moby/buildkit/frontend/gateway/client/attestation.go b/vendor/github.com/moby/buildkit/frontend/gateway/client/attestation.go
65+
index 5ffe67233c50..c5112db9db64 100644
66+
--- a/vendor/github.com/moby/buildkit/frontend/gateway/client/attestation.go
67+
+++ b/vendor/github.com/moby/buildkit/frontend/gateway/client/attestation.go
68+
@@ -30,8 +30,14 @@ func AttestationToPB[T any](a *result.Attestation[T]) (*pb.Attestation, error) {
69+
}
70+
71+
func AttestationFromPB[T any](a *pb.Attestation) (*result.Attestation[T], error) {
72+
+ if a == nil {
73+
+ return nil, errors.Errorf("invalid nil attestation")
74+
+ }
75+
subjects := make([]result.InTotoSubject, len(a.InTotoSubjects))
76+
for i, subject := range a.InTotoSubjects {
77+
+ if subject == nil {
78+
+ return nil, errors.Errorf("invalid nil attestation subject")
79+
+ }
80+
subjects[i] = result.InTotoSubject{
81+
Kind: subject.Kind,
82+
Name: subject.Name,

‎SPECS/moby-compose/CVE-2024-24786.patch‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
Backported from protobuf upstream:
2+
https://go-review.googlesource.com/c/protobuf/+/569356
3+
4+
Modified to apply to vendored code by: corvus-callidus <108946721+corvus-callidus@users.noreply.github.com>
5+
- Adjusted paths
6+
- Removed references to protobuf/encoding/protojson/decode_test.go and
7+
protobuf/internal/encoding/json/decode_test.go which are not present in the vendored code
8+
- Modified json.EOF check to apply to our older version of skipJSONValue
9+
10+
11+
From f01a588e5810b90996452eec4a28f22a0afae023 Mon Sep 17 00:00:00 2001
12+
From: Damien Neil <dneil@google.com>
13+
Date: Tue, 05 Mar 2024 08:54:24 -0800
14+
Subject: [PATCH] encoding/protojson, internal/encoding/json: handle missing object values
15+
16+
In internal/encoding/json, report an error when encountering a }
17+
when we are expecting an object field value. For example, the input
18+
`{"":}` now correctly results in an error at the closing } token.
19+
20+
In encoding/protojson, check for an unexpected EOF token in
21+
skipJSONValue. This is redundant with the check in internal/encoding/json,
22+
but adds a bit more defense against any other similar bugs that
23+
might exist.
24+
25+
Fixes CVE-2024-24786
26+
27+
Change-Id: I03d52512acb5091c8549e31ca74541d57e56c99d
28+
Reviewed-on: https://go-review.googlesource.com/c/protobuf/+/569356
29+
TryBot-Bypass: Damien Neil <dneil@google.com>
30+
Reviewed-by: Roland Shoemaker <roland@golang.org>
31+
Commit-Queue: Damien Neil <dneil@google.com>
32+
---
33+
34+
diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
35+
index 25329b7..4b177c8 100644
36+
--- a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
37+
+++ b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
38+
@@ -328,6 +328,10 @@ func (d decoder) skipJSONValue() error {
39+
if err := d.skipJSONValue(); err != nil {
40+
return err
41+
}
42+
+ case json.EOF:
43+
+ // This can only happen if there's a bug in Decoder.Read.
44+
+ // Avoid an infinite loop if this does happen.
45+
+ return errors.New("unexpected EOF")
46+
}
47+
}
48+
49+
@@ -341,6 +345,10 @@ func (d decoder) skipJSONValue() error {
50+
case json.ArrayClose:
51+
d.Read()
52+
return nil
53+
+ case json.EOF:
54+
+ // This can only happen if there's a bug in Decoder.Read.
55+
+ // Avoid an infinite loop if this does happen.
56+
+ return errors.New("unexpected EOF")
57+
default:
58+
// Skip array item.
59+
if err := d.skipJSONValue(); err != nil {
60+
@@ -348,6 +356,10 @@ func (d decoder) skipJSONValue() error {
61+
}
62+
}
63+
}
64+
+ case json.EOF:
65+
+ // This can only happen if there's a bug in Decoder.Read.
66+
+ // Avoid an infinite loop if this does happen.
67+
+ return errors.New("unexpected EOF")
68+
}
69+
return nil
70+
}
71+
diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
72+
index d043a6e..d2b3ac0 100644
73+
--- a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
74+
+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
75+
@@ -121,7 +121,7 @@
76+
77+
case ObjectClose:
78+
if len(d.openStack) == 0 ||
79+
- d.lastToken.kind == comma ||
80+
+ d.lastToken.kind&(Name|comma) != 0 ||
81+
d.openStack[len(d.openStack)-1] != ObjectOpen {
82+
return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
83+
}

‎SPECS/moby-compose/moby-compose.spec‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Define and run multi-container applications with Docker
22
Name: moby-compose
33
Version: 2.17.3
4-
Release: 4%{?dist}
4+
Release: 5%{?dist}
55
License: ASL 2.0
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -19,6 +19,22 @@ Patch2: Change-server-stream-context-handling.patch
1919
Patch3: prohibit-more-than-MaxConcurrentStreams-handlers.patch
2020
Patch4: CVE-2023-45288.patch
2121
Patch5: CVE-2023-48795.patch
22+
Patch6: CVE-2024-24786.patch
23+
# Patch for CVE-2024-23650 (buildkit) must be redone if the package is updated and
24+
# the vendored code begins including any of the following modules:
25+
# github.com/moby/buildkit/control (for control.go)
26+
# github.com/moby/buildkit/exporter/containerimage (for writer.go)
27+
# github.com/moby/buildkit/frontend/gateway (for gateway.go)
28+
# github.com/moby/buildkit/solver/llbsolver (for bridge.go and solver.go)
29+
# github.com/moby/buildkit/sourcepolicy (for matcher.go)
30+
# github.com/moby/buildkit/util/tracing/transform (for attribute.go and span.go)
31+
Patch7: CVE-2024-23650.patch
32+
# Patch for CVE-2023-2253 (distribution/distribution) must be redone if the package is updated and
33+
# the vendored code begins including any of the following modules:
34+
# github.com/docker/distribution/configuration (for configuration.go)
35+
# github.com/docker/distribution/catalog (for catalog.go)
36+
Patch8: CVE-2023-2253.patch
37+
2238

2339
# Leverage the `generate_source_tarball.sh` to create the vendor sources
2440
# NOTE: govendor-v1 format is for inplace CVE updates so that we do not have to overwrite in the blob-store.
@@ -27,7 +43,6 @@ Source1: %{name}-%{version}-govendor-v1.tar.gz
2743
BuildRequires: golang
2844
Requires: moby-cli
2945

30-
3146
%description
3247
Compose is a tool for defining and running multi-container Docker applications.
3348
With Compose, you use a YAML file to configure your application’s services.
@@ -57,6 +72,9 @@ install -D -m0755 bin/build/docker-compose %{buildroot}/%{_libexecdir}/docker/cl
5772
%{_libexecdir}/docker/cli-plugins/docker-compose
5873

5974
%changelog
75+
* Tue May 28 2024 corvus-callidus <108946721+corvus-callidus@users.noreply.github.com> - 2.17.3-5
76+
- Fix for CVE-2024-24786, CVE-2024-23650, CVE-2023-2253
77+
6078
* Tue May 28 2024 Bala <balakumaran.kannan@microsoft.com> - 2.17.3-4
6179
- Fix for CVE-2023-48795
6280

0 commit comments

Comments
 (0)