Skip to content

Commit 9519e1f

Browse files
jslobodzianjslobodzian
committed
Merge branch 'main' into 2.0
2 parents 52b0311 + 237b307 commit 9519e1f

File tree

131 files changed

+7912
-1706
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

131 files changed

+7912
-1706
lines changed

‎.github/workflows/check-srpm-duplicates.yml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Copyright (c) Microsoft Corporation.
2+
# Licensed under the MIT License.
3+
4+
# This action checks that the specs in this repo
5+
# generate SRPMs with unique names.
6+
name: SRPMs duplicates check
7+
8+
on:
9+
push:
10+
branches: [main, 2.0*, 3.0*, fasttrack/*]
11+
pull_request:
12+
branches: [main, 2.0*, 3.0*, fasttrack/*]
13+
14+
jobs:
15+
check:
16+
name: SRPMs duplicates check
17+
runs-on: ubuntu-latest
18+
strategy:
19+
matrix:
20+
# Each group is published to a different repo, thus we only need to check
21+
# for SRPM duplicates within the group.
22+
specs-dirs-groups: ["SPECS SPECS-SIGNED", "SPECS-EXTENDED"]
23+
24+
steps:
25+
# Checkout the branch of our repo that triggered this action
26+
- name: Workflow trigger checkout
27+
uses: actions/checkout@v4
28+
29+
# For consistency, we use the same major/minor version of Python that Azure Linux ships
30+
- name: Setup Python 3.9
31+
uses: actions/setup-python@v5
32+
with:
33+
python-version: 3.9
34+
35+
- name: Switch to stable toolkit
36+
run: git fetch --all && git checkout 2.0-stable -- toolkit
37+
38+
# Generate the specs.json files. They are the input for the duplicates check script.
39+
- name: Generate specs.json
40+
run: |
41+
set -euo pipefail
42+
43+
for spec_folder in ${{ matrix.specs-dirs-groups }}; do
44+
echo "Generating specs.json for spec folder '$spec_folder'."
45+
46+
sudo make -C toolkit -j$(nproc) parse-specs REBUILD_TOOLS=y SPECS_DIR=../$spec_folder
47+
cp -v build/pkg_artifacts/specs.json ${spec_folder}_specs.json
48+
done
49+
50+
- name: Check for duplicate SRPMs
51+
run: python3 toolkit/scripts/check_srpm_duplicates.py *_specs.json

‎SPECS-SIGNED/kernel-azure-signed/kernel-azure-signed.spec

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
%define uname_r %{version}-%{release}
1010
Summary: Signed Linux Kernel for Azure
1111
Name: kernel-azure-signed-%{buildarch}
12-
Version: 5.15.176.3
13-
Release: 3%{?dist}
12+
Version: 5.15.180.1
13+
Release: 1%{?dist}
1414
License: GPLv2
1515
Vendor: Microsoft Corporation
1616
Distribution: Mariner
@@ -153,6 +153,12 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
153153
%exclude /module_info.ld
154154

155155
%changelog
156+
* Wed Apr 23 2025 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.180.1-1
157+
- Auto-upgrade to 5.15.180.1
158+
159+
* Thu Apr 03 2025 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.179.1-1
160+
- Auto-upgrade to 5.15.179.1
161+
156162
* Sat Feb 22 2025 Chris Co <chrco@microsoft.com> - 5.15.176.3-3
157163
- Bump to match kernel-azure spec
158164

‎SPECS-SIGNED/kernel-hci-signed/kernel-hci-signed.spec

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
%define uname_r %{version}-%{release}
55
Summary: Signed Linux Kernel for HCI
66
Name: kernel-hci-signed-%{buildarch}
7-
Version: 5.15.176.3
8-
Release: 2%{?dist}
7+
Version: 5.15.180.1
8+
Release: 1%{?dist}
99
License: GPLv2
1010
Vendor: Microsoft Corporation
1111
Distribution: Mariner
@@ -149,6 +149,12 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
149149
%exclude /module_info.ld
150150

151151
%changelog
152+
* Wed Apr 23 2025 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.180.1-1
153+
- Auto-upgrade to 5.15.180.1
154+
155+
* Thu Apr 03 2025 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.179.1-1
156+
- Auto-upgrade to 5.15.179.1
157+
152158
* Tue Feb 11 2025 Rachel Menge <rachelmenge@microsoft.com> - 5.15.176.3-2
153159
- Bump release to match kernel-hci
154160

‎SPECS-SIGNED/kernel-signed/kernel-signed.spec

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,8 @@
99
%define uname_r %{version}-%{release}
1010
Summary: Signed Linux Kernel for %{buildarch} systems
1111
Name: kernel-signed-%{buildarch}
12-
Version: 5.15.176.3
13-
Release: 3%{?dist}
12+
Version: 5.15.180.1
13+
Release: 1%{?dist}
1414
License: GPLv2
1515
Vendor: Microsoft Corporation
1616
Distribution: Mariner
@@ -153,6 +153,12 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
153153
%exclude /module_info.ld
154154

155155
%changelog
156+
* Wed Apr 23 2025 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.180.1-1
157+
- Auto-upgrade to 5.15.180.1
158+
159+
* Thu Apr 03 2025 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 5.15.179.1-1
160+
- Auto-upgrade to 5.15.179.1
161+
156162
* Sat Feb 22 2025 Chris Co <chrco@microsoft.com> - 5.15.176.3-3
157163
- Bump release to match kernel
158164

‎SPECS/application-gateway-kubernetes-ingress/CVE-2024-51744.patch

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
From 703e6193f4462ef2f617387c01798035fe620250 Mon Sep 17 00:00:00 2001
2+
From: jykanase <v-jykanase@microsoft.com>
3+
Date: Fri, 28 Mar 2025 04:25:18 +0000
4+
Subject: [PATCH] CVE-2024-51744
5+
6+
Upstream patch reference: https://github.com/golang-jwt/jwt/commit/7b1c1c00a171c6c79bbdb40e4ce7d197060c1c2c
7+
---
8+
vendor/github.com/dgrijalva/jwt-go/parser.go | 37 +++++++++++---------
9+
1 file changed, 21 insertions(+), 16 deletions(-)
10+
11+
diff --git a/vendor/github.com/dgrijalva/jwt-go/parser.go b/vendor/github.com/dgrijalva/jwt-go/parser.go
12+
index d6901d9..9fddb7d 100644
13+
--- a/vendor/github.com/dgrijalva/jwt-go/parser.go
14+
+++ b/vendor/github.com/dgrijalva/jwt-go/parser.go
15+
@@ -13,13 +13,21 @@ type Parser struct {
16+
SkipClaimsValidation bool // Skip claims validation during token parsing
17+
}
18+
19+
-// Parse, validate, and return a token.
20+
-// keyFunc will receive the parsed token and should return the key for validating.
21+
-// If everything is kosher, err will be nil
22+
+// Parse parses, validates, verifies the signature and returns the parsed token. keyFunc will
23+
+// receive the parsed token and should return the key for validating.
24+
func (p *Parser) Parse(tokenString string, keyFunc Keyfunc) (*Token, error) {
25+
return p.ParseWithClaims(tokenString, MapClaims{}, keyFunc)
26+
}
27+
28+
+// ParseWithClaims parses, validates, and verifies like Parse, but supplies a default object
29+
+// implementing the Claims interface. This provides default values which can be overridden and
30+
+// allows a caller to use their own type, rather than the default MapClaims implementation of
31+
+// Claims.
32+
+//
33+
+// Note: If you provide a custom claim implementation that embeds one of the standard claims (such
34+
+// as RegisteredClaims), make sure that a) you either embed a non-pointer version of the claims or
35+
+// b) if you are using a pointer, allocate the proper memory for it before passing in the overall
36+
+// claims, otherwise you might run into a panic.
37+
func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc) (*Token, error) {
38+
token, parts, err := p.ParseUnverified(tokenString, claims)
39+
if err != nil {
40+
@@ -56,12 +64,17 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
41+
return token, &ValidationError{Inner: err, Errors: ValidationErrorUnverifiable}
42+
}
43+
44+
+ // Perform validation
45+
+ token.Signature = parts[2]
46+
+ if err := token.Method.Verify(strings.Join(parts[0:2], "."), token.Signature, key); err != nil {
47+
+ return token, &ValidationError{Inner: err, Errors: ValidationErrorSignatureInvalid}
48+
+ }
49+
+
50+
vErr := &ValidationError{}
51+
52+
// Validate Claims
53+
if !p.SkipClaimsValidation {
54+
if err := token.Claims.Valid(); err != nil {
55+
-
56+
// If the Claims Valid returned an error, check if it is a validation error,
57+
// If it was another error type, create a ValidationError with a generic ClaimsInvalid flag set
58+
if e, ok := err.(*ValidationError); !ok {
59+
@@ -69,22 +82,14 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
60+
} else {
61+
vErr = e
62+
}
63+
+ return token, vErr
64+
}
65+
}
66+
67+
- // Perform validation
68+
- token.Signature = parts[2]
69+
- if err = token.Method.Verify(strings.Join(parts[0:2], "."), token.Signature, key); err != nil {
70+
- vErr.Inner = err
71+
- vErr.Errors |= ValidationErrorSignatureInvalid
72+
- }
73+
-
74+
- if vErr.valid() {
75+
- token.Valid = true
76+
- return token, nil
77+
- }
78+
+ // No errors so far, token is valid.
79+
+ token.Valid = true
80+
81+
- return token, vErr
82+
+ return token, nil
83+
}
84+
85+
// WARNING: Don't use this method unless you know what you're doing
86+
--
87+
2.45.2
88+

‎SPECS/application-gateway-kubernetes-ingress/application-gateway-kubernetes-ingress.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Application Gateway Ingress Controller
33
Name: application-gateway-kubernetes-ingress
44
Version: 1.4.0
5-
Release: 24%{?dist}
5+
Release: 25%{?dist}
66
License: MIT
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -31,6 +31,7 @@ Patch1: CVE-2023-44487.patch
3131
Patch2: CVE-2021-44716.patch
3232
Patch3: CVE-2022-32149.patch
3333
Patch4: CVE-2024-45338.patch
34+
Patch5: CVE-2024-51744.patch
3435

3536
BuildRequires: golang
3637
%if %{with_check}
@@ -69,6 +70,9 @@ cp appgw-ingress %{buildroot}%{_bindir}/
6970
%{_bindir}/appgw-ingress
7071

7172
%changelog
73+
* Fri Mar 28 2025 Jyoti Kanase <v-jykanase@microsoft.com> - 1.4.0-25
74+
- Fix CVE-2024-51744
75+
7276
* Thu Jan 02 2025 Sumedh Sharma <sumsharma@microsoft.com> - 1.4.0-24
7377
- Add patch for CVE-2024-45338.
7478

‎SPECS/augeas/CVE-2025-2588.patch

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
From 42632cb7d0103fbf871fb698e7648ba925eec254 Mon Sep 17 00:00:00 2001
2+
From: Alexander Bokovoy <abokovoy@redhat.com>
3+
Date: Mon, 24 Mar 2025 09:48:19 +0200
4+
Subject: [PATCH] CVE-2025-2588: return _REG_ENOSYS if no specific error was
5+
set yet parse_regexp failed
6+
7+
parse_regexp() supposed to set an error on the parser state in case of a
8+
failure. If no specific error was set, return _REG_ENOSYS to indicate a
9+
generic failure.
10+
11+
Fixes: https://github.com/hercules-team/augeas/issues/671
12+
Fixes: https://github.com/hercules-team/augeas/issues/778
13+
Fixes: https://github.com/hercules-team/augeas/issues/852
14+
15+
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
16+
---
17+
src/fa.c | 3 +++
18+
src/fa.h | 3 ++-
19+
tests/fatest.c | 6 ++++++
20+
3 files changed, 11 insertions(+), 1 deletion(-)
21+
22+
diff --git a/src/fa.c b/src/fa.c
23+
index 66ac70784..14f2472ad 100644
24+
--- a/src/fa.c
25+
+++ b/src/fa.c
26+
@@ -32,6 +32,7 @@
27+
#include <config.h>
28+
#include <limits.h>
29+
#include <ctype.h>
30+
+#include <regex.h>
31+
#include <stdbool.h>
32+
33+
#include "internal.h"
34+
@@ -3550,6 +3551,8 @@ static struct re *parse_regexp(struct re_parse *parse) {
35+
return re;
36+
37+
error:
38+
+ if (re == NULL && parse->error == REG_NOERROR)
39+
+ parse->error = _REG_ENOSYS;
40+
re_unref(re);
41+
return NULL;
42+
}
43+
diff --git a/src/fa.h b/src/fa.h
44+
index 1fd754ad0..89c9b17e9 100644
45+
--- a/src/fa.h
46+
+++ b/src/fa.h
47+
@@ -81,7 +81,8 @@ extern int fa_minimization_algorithm;
48+
*
49+
* On success, FA points to the newly allocated automaton constructed for
50+
* RE, and the function returns REG_NOERROR. Otherwise, FA is NULL, and the
51+
- * return value indicates the error.
52+
+ * return value indicates the error. Special value _REG_ENOSYS indicates
53+
+ * fa_compile() couldn't identify the syntax issue with regexp.
54+
*
55+
* The FA is case sensitive. Call FA_NOCASE to switch it to
56+
* case-insensitive.
57+
diff --git a/tests/fatest.c b/tests/fatest.c
58+
index 0c9ca7696..6717af8f4 100644
59+
--- a/tests/fatest.c
60+
+++ b/tests/fatest.c
61+
@@ -589,6 +589,7 @@ static void testExpandNoCase(CuTest *tc) {
62+
const char *p1 = "aB";
63+
const char *p2 = "[a-cUV]";
64+
const char *p3 = "[^a-z]";
65+
+ const char *wrong_regexp = "{&.{";
66+
char *s;
67+
size_t len;
68+
int r;
69+
@@ -607,6 +608,11 @@ static void testExpandNoCase(CuTest *tc) {
70+
CuAssertIntEquals(tc, 0, r);
71+
CuAssertStrEquals(tc, "[^A-Za-z]", s);
72+
free(s);
73+
+
74+
+ /* Test that fa_expand_nocase does return _REG_ENOSYS */
75+
+ r = fa_expand_nocase(wrong_regexp, strlen(wrong_regexp), &s, &len);
76+
+ CuAssertIntEquals(tc, _REG_ENOSYS, r);
77+
+ free(s);
78+
}
79+
80+
static void testNoCaseComplement(CuTest *tc) {

‎SPECS/augeas/augeas.spec

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
Summary: A library for changing configuration files
22
Name: augeas
33
Version: 1.12.0
4-
Release: 5%{?dist}
4+
Release: 6%{?dist}
55
License: LGPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
URL: https://augeas.net/
99
Source0: http://download.augeas.net/%{name}-%{version}.tar.gz
1010

11+
Patch0: CVE-2025-2588.patch
12+
1113
BuildRequires: gcc
1214
BuildRequires: libselinux-devel
1315
BuildRequires: libxml2-devel
@@ -50,6 +52,7 @@ read files.
5052

5153
%prep
5254
%setup -q
55+
%autopatch -p1
5356

5457
%build
5558
%configure \
@@ -106,6 +109,9 @@ rm -f %{buildroot}%{_bindir}/dump
106109
%{_libdir}/pkgconfig/augeas.pc
107110

108111
%changelog
112+
* Sun Mar 30 2025 Kshitiz Godara <kgodara@microsoft.com> - 1.12.0-6
113+
- Fix CVE-2025-2588 with an upstream patch
114+
109115
* Wed Sep 20 2023 Jon Slobodzian <joslobo@microsoft.com> - 1.12.0-5
110116
- Recompile with stack-protection fixed gcc version (CVE-2023-4039)
111117

0 commit comments

Comments
 (0)