[AUTO-CHERRYPICK] [Low] patch cert-manager for CVE-2024-51744 - branch main

SPECS/cert-manager/CVE-2024-51744.patch

@@ -0,0 +1,88 @@
+From 24c143f0c31c653523182e958d1e73c8e1022541 Mon Sep 17 00:00:00 2001
+From: jykanase <v-jykanase@microsoft.com>
+Date: Thu, 27 Mar 2025 11:36:04 +0000
+Subject: [PATCH] CVE-2024-51744
+
+Source Link: https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c#diff-83eb8e32639d01cf443d6d8bde24c1c8be78766090d8c5f8586c36250cfedca6R50-R51
+---
+ vendor/github.com/golang-jwt/jwt/v4/parser.go | 33 ++++++++++++-------
+ 1 file changed, 21 insertions(+), 12 deletions(-)
+
+diff --git a/vendor/github.com/golang-jwt/jwt/v4/parser.go b/vendor/github.com/golang-jwt/jwt/v4/parser.go
+index 2f61a69..e11fb89 100644
+--- a/vendor/github.com/golang-jwt/jwt/v4/parser.go
++++ b/vendor/github.com/golang-jwt/jwt/v4/parser.go
+@@ -36,12 +36,20 @@ func NewParser(options ...ParserOption) *Parser {
+ 	return p
+ }
+
+-// Parse parses, validates, verifies the signature and returns the parsed token.
+-// keyFunc will receive the parsed token and should return the key for validating.
++// Parse parses, validates, verifies the signature and returns the parsed token. keyFunc will
++// receive the parsed token and should return the key for validating.
+ func (p *Parser) Parse(tokenString string, keyFunc Keyfunc) (*Token, error) {
+ 	return p.ParseWithClaims(tokenString, MapClaims{}, keyFunc)
+ }
+-
++// ParseWithClaims parses, validates, and verifies like Parse, but supplies a default object
++// implementing the Claims interface. This provides default values which can be overridden and
++// allows a caller to use their own type, rather than the default MapClaims implementation of
++// Claims.
++//
++// Note: If you provide a custom claim implementation that embeds one of the standard claims (such
++// as RegisteredClaims), make sure that a) you either embed a non-pointer version of the claims or
++// b) if you are using a pointer, allocate the proper memory for it before passing in the overall
++// claims, otherwise you might run into a panic.
+ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc) (*Token, error) {
+ 	token, parts, err := p.ParseUnverified(tokenString, claims)
+ 	if err != nil {
+@@ -77,13 +85,18 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
+ 		}
+ 		return token, &ValidationError{Inner: err, Errors: ValidationErrorUnverifiable}
+ 	}
++	
++	// Perform validation
++ 	token.Signature = parts[2]
++ 	if err := token.Method.Verify(strings.Join(parts[0:2], "."), token.Signature, key); err != nil {
++ 		return token, &ValidationError{Inner: err, Errors: ValidationErrorSignatureInvalid}
++ 	}
+
+ 	vErr := &ValidationError{}
+
+ 	// Validate Claims
+ 	if !p.SkipClaimsValidation {
+ 		if err := token.Claims.Valid(); err != nil {
+-
+ 			// If the Claims Valid returned an error, check if it is a validation error,
+ 			// If it was another error type, create a ValidationError with a generic ClaimsInvalid flag set
+ 			if e, ok := err.(*ValidationError); !ok {
+@@ -91,22 +104,18 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
+ 			} else {
+ 				vErr = e
+ 			}
++			return token, vErr
+ 		}
+ 	}
+
+-	// Perform validation
+-	token.Signature = parts[2]
+-	if err = token.Method.Verify(strings.Join(parts[0:2], "."), token.Signature, key); err != nil {
+-		vErr.Inner = err
+-		vErr.Errors |= ValidationErrorSignatureInvalid
+-	}
+-
+ 	if vErr.valid() {
+ 		token.Valid = true
+ 		return token, nil
+ 	}
++	// No errors so far, token is valid.
++ 	token.Valid = true
+
+-	return token, vErr
++	return token, nil
+ }
+
+ // ParseUnverified parses the token but doesn't validate the signature.
+-- 
+2.45.2
+

SPECS/cert-manager/cert-manager.spec

@@ -1,7 +1,7 @@
 Summary:        Automatically provision and manage TLS certificates in Kubernetes
 Name:           cert-manager
 Version:        1.11.2
-Release:        21%{?dist}
+Release:        22%{?dist}
 License:        ASL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -35,6 +35,7 @@ Patch12:        CVE-2025-27144.patch
 Patch13:        CVE-2025-22868.patch
 Patch14:        CVE-2025-22869.patch
 Patch15:        CVE-2025-30204.patch
+Patch16:        CVE-2024-51744.patch
 
 BuildRequires:  golang
 Requires:       %{name}-acmesolver
@@ -128,6 +129,9 @@ install -D -m0755 bin/webhook %{buildroot}%{_bindir}/
 %{_bindir}/webhook
 
 %changelog
+* Mon Mar 31 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 1.11.2-22
+- Fix CVE-2024-51744
+
 * Fri Mar 28 2025 Kanishk Bansal <kanbansal@microsoft.com> - 1.11.2-21
 - Patch CVE-2025-30204