Skip to content

[AUTO-CHERRYPICK] Patch promethes for CVE-2025-22868 [High] - branch 3.0-dev #12969

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jslobodzian merged 2 commits into from
Mar 27, 2025
Merged

[AUTO-CHERRYPICK] Patch promethes for CVE-2025-22868 [High] - branch 3.0-dev #12969

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
432b7e8
Patch promethes for CVE-2025-22868 [High] (#12847)
sandeepkarambelkar Mar 14, 2025
c16eeb9
Merge branch '3.0-dev' into cblmargh/cherry-pick-pr-12847-to-3.0-dev
jslobodzian Mar 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 38 additions & 0 deletions SPECS/prometheus/CVE-2025-22868.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
From 681b4d8edca1bcfea5bce685d77ea7b82ed3e7b3 Mon Sep 17 00:00:00 2001
From: Neal Patel <nealpatel@google.com>
Date: Thu, 30 Jan 2025 14:10:09 -0500
Subject: [PATCH] jws: split token into fixed number of parts

Thanks to 'jub0bs' for reporting this issue.

Fixes #71490
Fixes CVE-2025-22868

Change-Id: I2552731f46d4907f29aafe7863c558387b6bd6e2
Reviewed-on: https://go-review.googlesource.com/c/oauth2/+/652155
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
---
vendor/golang.org/x/oauth2/jws/jws.go | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/vendor/golang.org/x/oauth2/jws/jws.go b/vendor/golang.org/x/oauth2/jws/jws.go
index 95015648b..6f03a49d3 100644
--- a/vendor/golang.org/x/oauth2/jws/jws.go
+++ b/vendor/golang.org/x/oauth2/jws/jws.go
@@ -165,11 +165,11 @@ func Encode(header *Header, c *ClaimSet, key *rsa.PrivateKey) (string, error) {
// Verify tests whether the provided JWT token's signature was produced by the private key
// associated with the supplied public key.
func Verify(token string, key *rsa.PublicKey) error {
- parts := strings.Split(token, ".")
- if len(parts) != 3 {
+ if strings.Count(token, ".") != 2 {
return errors.New("jws: invalid token received, token must have 3 parts")
}

+ parts := strings.SplitN(token, ".", 3)
signedContent := parts[0] + "." + parts[1]
signatureString, err := base64.RawURLEncoding.DecodeString(parts[2])
if err != nil {
12 changes: 8 additions & 4 deletions SPECS/prometheus/prometheus.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
Summary: Prometheus monitoring system and time series database
Name: prometheus
Version: 2.45.4
Release: 8%{?dist}
Release: 9%{?dist}
License: Apache-2.0
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand All @@ -22,8 +22,9 @@ Patch1: CVE-2023-45288.patch
Patch2: CVE-2024-6104.patch
Patch3: CVE-2024-24786.patch
Patch4: CVE-2023-44487.patch
Patch5: 0001-Fix-exit-condition-of-TestQuerierIndexQueriesRace.patch
Patch6: 0002-Improve-sensitivity-of-TestQuerierIndexQueriesRace.patch
Patch5: CVE-2025-22868.patch
Patch6: 0001-Fix-exit-condition-of-TestQuerierIndexQueriesRace.patch
Patch7: 0002-Improve-sensitivity-of-TestQuerierIndexQueriesRace.patch
BuildRequires: golang
BuildRequires: nodejs
BuildRequires: nodejs-npm
Expand Down Expand Up @@ -140,9 +141,12 @@ fi
%doc README.md RELEASE.md documentation

%changelog
* Thu Mar 13 2025 Andrew Phelps <anphel@microsoft.com> - 2.45.4-8
* Thu Mar 13 2025 Andrew Phelps <anphel@microsoft.com> - 2.45.4-9
- Add patches to fix test reliability issues with TestQuerierIndexQueriesRace

* Thu Mar 06 2025 Sandeep Karambelkar <skarambelkar@microsoft.com> - 2.45.4-8
- Fix CVE-2025-22868

* Tue Mar 04 2025 corvus-callidus <108946721+corvus-callidus@users.noreply.github.com> - 2.45.4-7
- Fix CVE-2023-44487

Expand Down
Loading