diff --git a/SPECS/libarchive/CVE-2025-25724.patch b/SPECS/libarchive/CVE-2025-25724.patch new file mode 100644 index 00000000000..b3f47eb9dda --- /dev/null +++ b/SPECS/libarchive/CVE-2025-25724.patch @@ -0,0 +1,36 @@ +From 6636f89f5fe08a20de3b2d034712c781d3a67985 Mon Sep 17 00:00:00 2001 +From: Peter Kaestle +Date: Wed, 5 Mar 2025 15:01:14 +0100 +Subject: [PATCH] tar/util.c: fix NULL pointer dereference issue on strftime + +Fix CVE-2025-25724 by detecting NULL return of localtime_r(&tim, &tmbuf), +which could happen in case tim is incredible big. + +In case this error is triggered, put an "INVALID DATE" string into the +outbuf. + +Error poc: https://github.com/Ekkosun/pocs/blob/main/bsdtarbug + +Upstream Reference : https://github.com/libarchive/libarchive/pull/2532/commits/6636f89f5fe08a20de3b2d034712c781d3a67985 + +Signed-off-by: Peter Kaestle +--- + tar/util.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tar/util.c b/tar/util.c +index 3b099cb5f..f3cbdf0bb 100644 +--- a/tar/util.c ++++ b/tar/util.c +@@ -749,7 +749,10 @@ list_item_verbose(struct bsdtar *bsdtar, FILE *out, struct archive_entry *entry) + #else + ltime = localtime(&tim); + #endif +- strftime(tmp, sizeof(tmp), fmt, ltime); ++ if (ltime) ++ strftime(tmp, sizeof(tmp), fmt, ltime); ++ else ++ sprintf(tmp, "-- -- ----"); + fprintf(out, " %s ", tmp); + safe_fprintf(out, "%s", archive_entry_pathname(entry)); + diff --git a/SPECS/libarchive/libarchive.spec b/SPECS/libarchive/libarchive.spec index 20681c9a840..1dc5e8c498b 100644 --- a/SPECS/libarchive/libarchive.spec +++ b/SPECS/libarchive/libarchive.spec @@ -1,7 +1,7 @@ Summary: Multi-format archive and compression library Name: libarchive Version: 3.6.1 -Release: 4%{?dist} +Release: 5%{?dist} # Certain files have individual licenses. For more details see contents of "COPYING". License: BSD AND Public Domain AND (ASL 2.0 OR CC0 1.0 OR OpenSSL) Vendor: Microsoft Corporation @@ -14,6 +14,7 @@ Patch1: CVE-2024-26256.patch Patch2: CVE-2024-20696.patch Patch3: CVE-2024-48958.patch Patch4: CVE-2024-48957.patch +Patch5: CVE-2025-25724.patch Provides: bsdtar = %{version}-%{release} BuildRequires: xz-libs @@ -66,6 +67,9 @@ make %{?_smp_mflags} check %{_libdir}/pkgconfig/*.pc %changelog +* Tue Mar 11 2025 Kanishk Bansal - 3.6.1-5 +- Patch CVE-2025-25724 + * Tue Oct 15 2024 Nan Liu - 3.6.1-4 - Patch CVE-2024-48957, CVE-2024-48958, CVE-2024-20696 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index d650fcc2999..f08d53c301f 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -173,8 +173,8 @@ openssl-static-1.1.1k-35.cm2.aarch64.rpm libcap-2.60-4.cm2.aarch64.rpm libcap-devel-2.60-4.cm2.aarch64.rpm debugedit-5.0-2.cm2.aarch64.rpm -libarchive-3.6.1-4.cm2.aarch64.rpm -libarchive-devel-3.6.1-4.cm2.aarch64.rpm +libarchive-3.6.1-5.cm2.aarch64.rpm +libarchive-devel-3.6.1-5.cm2.aarch64.rpm rpm-4.18.0-4.cm2.aarch64.rpm rpm-build-4.18.0-4.cm2.aarch64.rpm rpm-build-libs-4.18.0-4.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 27f5afb47b3..4bb19ed0e76 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -173,8 +173,8 @@ openssl-static-1.1.1k-35.cm2.x86_64.rpm libcap-2.60-4.cm2.x86_64.rpm libcap-devel-2.60-4.cm2.x86_64.rpm debugedit-5.0-2.cm2.x86_64.rpm -libarchive-3.6.1-4.cm2.x86_64.rpm -libarchive-devel-3.6.1-4.cm2.x86_64.rpm +libarchive-3.6.1-5.cm2.x86_64.rpm +libarchive-devel-3.6.1-5.cm2.x86_64.rpm rpm-4.18.0-4.cm2.x86_64.rpm rpm-build-4.18.0-4.cm2.x86_64.rpm rpm-build-libs-4.18.0-4.cm2.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index ddf8d2d99fe..11c436acd37 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -144,9 +144,9 @@ krb5-1.19.4-3.cm2.aarch64.rpm krb5-debuginfo-1.19.4-3.cm2.aarch64.rpm krb5-devel-1.19.4-3.cm2.aarch64.rpm krb5-lang-1.19.4-3.cm2.aarch64.rpm -libarchive-3.6.1-4.cm2.aarch64.rpm -libarchive-debuginfo-3.6.1-4.cm2.aarch64.rpm -libarchive-devel-3.6.1-4.cm2.aarch64.rpm +libarchive-3.6.1-5.cm2.aarch64.rpm +libarchive-debuginfo-3.6.1-5.cm2.aarch64.rpm +libarchive-devel-3.6.1-5.cm2.aarch64.rpm libassuan-2.5.5-2.cm2.aarch64.rpm libassuan-debuginfo-2.5.5-2.cm2.aarch64.rpm libassuan-devel-2.5.5-2.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 45f3463f286..caf00dfa514 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -150,9 +150,9 @@ krb5-1.19.4-3.cm2.x86_64.rpm krb5-debuginfo-1.19.4-3.cm2.x86_64.rpm krb5-devel-1.19.4-3.cm2.x86_64.rpm krb5-lang-1.19.4-3.cm2.x86_64.rpm -libarchive-3.6.1-4.cm2.x86_64.rpm -libarchive-debuginfo-3.6.1-4.cm2.x86_64.rpm -libarchive-devel-3.6.1-4.cm2.x86_64.rpm +libarchive-3.6.1-5.cm2.x86_64.rpm +libarchive-debuginfo-3.6.1-5.cm2.x86_64.rpm +libarchive-devel-3.6.1-5.cm2.x86_64.rpm libassuan-2.5.5-2.cm2.x86_64.rpm libassuan-debuginfo-2.5.5-2.cm2.x86_64.rpm libassuan-devel-2.5.5-2.cm2.x86_64.rpm