Skip to content

[Low] Patch python3 for CVE-2025-1795 #12859

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
jslobodzian merged 5 commits into from
Apr 9, 2025
Merged

[Low] Patch python3 for CVE-2025-1795 #12859

jslobodzian merged 5 commits into from
Apr 9, 2025

Conversation

@v-smalavathu
Copy link
Contributor

@v-smalavathu v-smalavathu commented Mar 7, 2025 •
edited
Loading

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge
Summary

python3: Patch for CVE-2025-1795

Change Log
  • new file: SPECS/python3/CVE-2025-1795.patch
  • modified: SPECS/python3/python3.spec
  • modified: toolkit/resources/manifests/package/pkggen_core_aarch64.txt
  • modified: toolkit/resources/manifests/package/pkggen_core_x86_64.txt
  • modified: toolkit/resources/manifests/package/toolchain_aarch64.txt
  • modified: toolkit/resources/manifests/package/toolchain_x86_64.txt
Does this affect the toolchain?

NO

Associated issues
  • #xxxx
Links to CVEs
Test Methodology
  • Pipeline build id: xxxx

@v-smalavathu v-smalavathu requested a review from a team as a code owner March 7, 2025 20:40
@microsoft-github-policy-service microsoft-github-policy-service bot added Packaging fasttrack/2.0 PRs Destined for Azure Linux 2.0 labels Mar 7, 2025
dmcilvaney
dmcilvaney requested changes Mar 11, 2025
View reviewed changes
Copy link
Contributor

@dmcilvaney dmcilvaney left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/microsoft/azurelinux/tree/2.0/toolkit/resources/manifests/package these manifests also need updating for toolchain packages. The PR check should list the expected changes.

@v-smalavathu v-smalavathu changed the title python3: Patch for CVE-2025-1795 [Low] [Low] Patch python3 for CVE-2025-1795 Mar 14, 2025
@v-smalavathu
Copy link
Contributor Author

v-smalavathu commented Mar 24, 2025

https://github.com/microsoft/azurelinux/tree/2.0/toolkit/resources/manifests/package these manifests also need updating for toolchain packages. The PR check should list the expected changes.

I didn't change these manifests though this PR. Just I checked out stable version of toolchain, using the following command

"git checkout -f 2.0-stable -- resources/manifests"
-Thanks

@dmcilvaney
Copy link
Contributor

dmcilvaney commented Mar 24, 2025

The manifest files track which packages we use as our toolchain. Python is one of those packages, so the manifests need to match the new version-release in the .spec file.

When you do git checkout -f 2.0-stable -- resources/manifests it resets the toolchain to use the stable release, but since you are working with python (which is part of those manifests), the final PR will need to change those files as well.

@v-smalavathu
Copy link
Contributor Author

v-smalavathu commented Mar 25, 2025

The manifest files track which packages we use as our toolchain. Python is one of those packages, so the manifests need to match the new version-release in the .spec file.

When you do git checkout -f 2.0-stable -- resources/manifests it resets the toolchain to use the stable release, but since you are working with python (which is part of those manifests), the final PR will need to change those files as well.

Yes, Fixed,
Uploaded new changes.
-Thanks

Kanishk-Bansal
Kanishk-Bansal requested changes Mar 26, 2025
View reviewed changes
Copy link
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kindly resolve merge conflicts

@v-smalavathu
Copy link
Contributor Author

v-smalavathu commented Mar 26, 2025

fyi

image

Did rebase on this PR.
-Thanks

@Kanishk-Bansal
Copy link
Contributor

Kanishk-Bansal commented Mar 26, 2025

/azurepipelines run

@azure-pipelines
Copy link

azure-pipelines bot commented Mar 26, 2025

Azure Pipelines successfully started running 1 pipeline(s).

dmcilvaney
dmcilvaney reviewed Mar 26, 2025
View reviewed changes
toolkit/resources/manifests/package/pkggen_core_aarch64.txt Outdated
@@ -1,5 +1,5 @@
filesystem-1.1-20.cm2.aarch64.rpm
kernel-headers-5.15.176.3-3.cm2.noarch.rpm
kernel-headers-5.15.167.1-1.cm2.noarch.rpm
Copy link
Contributor

@dmcilvaney dmcilvaney Mar 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These versions shouldn't be rolled back, merge/rebase may have gone wrong?

Copy link
Contributor Author

@v-smalavathu v-smalavathu Mar 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated with latest manifest files.

@v-smalavathu
Addressing CVE-2025-1795
ca7d1f8 
Signed-off-by: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>
@v-smalavathu
Update toolchain
21c0450
@v-smalavathu v-smalavathu force-pushed the v-smalavathu/python3/CVE-2025-1795 branch from 89d10af to 21c0450 Compare March 27, 2025 19:02
@Kanishk-Bansal
Copy link
Contributor

Kanishk-Bansal commented Mar 27, 2025

/azurepipelines run

@azure-pipelines
Copy link

azure-pipelines bot commented Mar 27, 2025

Azure Pipelines successfully started running 1 pipeline(s).

@Kanishk-Bansal
Copy link
Contributor

Kanishk-Bansal commented Apr 1, 2025

/azurepipelines run

@azure-pipelines
Copy link

azure-pipelines bot commented Apr 1, 2025

Azure Pipelines successfully started running 1 pipeline(s).

Kanishk-Bansal
Kanishk-Bansal approved these changes Apr 1, 2025
View reviewed changes
Copy link
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Buddy Build
  • Patch getting applied during the build in rpm.log : Yes
  • test failures (if any) : NO
  • Upstream Patch Reference is there in the Patch : Yes
  • Has security tag : Yes

@Kanishk-Bansal Kanishk-Bansal self-requested a review April 1, 2025 14:42
@jslobodzian jslobodzian merged commit a5b423f into microsoft:fasttrack/2.0 Apr 9, 2025
10 checks passed
CBL-Mariner-Bot pushed a commit that referenced this pull request Apr 9, 2025
@v-smalavathu @Kanishk-Bansal
@jslobodzian @CBL-Mariner-Bot
[Low] Patch python3 for CVE-2025-1795 (#12859)
c36fd12 
Signed-off-by: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
Co-authored-by: jslobodzian <joslobo@microsoft.com>
(cherry picked from commit a5b423f)
@CBL-Mariner-Bot CBL-Mariner-Bot mentioned this pull request Apr 9, 2025
Merged
@CBL-Mariner-Bot
Copy link
Collaborator

CBL-Mariner-Bot commented Apr 9, 2025

Auto cherry-pick results:

Auto cherry-pick pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=783634&view=results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jslobodzian jslobodzian jslobodzian approved these changes

@Kanishk-Bansal Kanishk-Bansal Kanishk-Bansal approved these changes

@dmcilvaney dmcilvaney Awaiting requested review from dmcilvaney

Assignees

No one assigned

Labels

fasttrack/2.0 PRs Destined for Azure Linux 2.0 Packaging security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@v-smalavathu @dmcilvaney @Kanishk-Bansal @CBL-Mariner-Bot @jslobodzian