[Medium] Patch libsoup for CVE-2025-32909, CVE-2025-32910, CVE-2025-32912, CVE-2025-4476 #13496
Conversation
microsoft-github-policy-service
bot
added
Packaging
specs-extended
My apologies, must have been bad muscle memory I think. Ought to be all straightened out now. |
|
Fixed merge conflicts and numbered the patches as per #13446 (comment) |
Kanishk-Bansal
added
security
and removed
3.0
SPECS/libsoup/libsoup.spec
Outdated
| * Fri Apr 25 2025 Kshitiz Godara <kgodara@microsoft.com> - 3.0.4-4 | ||
| - Add patch for CVE-2025-32914 | ||
|
|
||
|
|
There was a problem hiding this comment.
- Buddy Build
- patch applied during the build (check
rpm.log) - patch include an upstream reference
- PR has security tag
SPECS/libsoup/libsoup.spec
Outdated
| @@ -129,9 +135,15 @@ find %{buildroot} -type f -name "*.la" -delete -print | |||
| %defattr(-,root,root) | |||
|
|
|||
| %changelog | |||
| * Fri Apr 28 2025 Kevin Lockwood <v-klockwood@microsoft.com> - 3.0.4-4 | |||
There was a problem hiding this comment.
Could you please update release number, here and above release tag?
There was a problem hiding this comment.
Forgot to bump the release number during the merge, I'll fix that now.
SPECS/libsoup/libsoup.spec
Outdated
| @@ -129,9 +135,15 @@ find %{buildroot} -type f -name "*.la" -delete -print | |||
| %defattr(-,root,root) | |||
|
|
|||
| %changelog | |||
| * Fri Apr 28 2025 Kevin Lockwood <v-klockwood@microsoft.com> - 3.0.4-4 | |||
There was a problem hiding this comment.
Forgot to bump the release number during the merge, I'll fix that now.
SPECS/libsoup/libsoup.spec
Outdated
| * Fri Apr 25 2025 Kshitiz Godara <kgodara@microsoft.com> - 3.0.4-4 | ||
| - Add patch for CVE-2025-32914 | ||
|
|
||
|
|
There was a problem hiding this comment.
Sorry to bother you again, actually for CVE-2025-32912, there are 3 patches from the issue request,
Fix: !417 (merged) and !434 (merged) and 910ebdcd
Out of three patches, you only took one which was also later modified as from
if (!soup_auth_get_realm (auth) || !g_hash_table_contains (auth_params, "nonce")) to
if (!soup_auth_get_realm (auth) || !g_hash_table_lookup (auth_params, "nonce"))
Please check all the relevant fixes for CVEs from above fix list of the issue https://gitlab.gnome.org/GNOME/libsoup/-/issues/434 and confirm once if this is the one only needed to fix the CVE. Remaining two look ok.
|
Buddy build. After rebase to tip, the patches in this PR don't apply cleanly. Please ensure that patches apply cleanly after rebasing. |
|
@kevin-b-lockwood |
Of the three patchsets mentioned:
|
kevin-b-lockwood
changed the title
I didn't make any changes to the patch for CVE-2025-4476, I downloaded the patch, renamed the patch file, and added it to the spec file. |
There was a problem hiding this comment.
Test cases aren't included as part of two CVE patches. Any reason for excluding them from patches? Buddy build
I didn't exclude them, the source patches simply didn't include any updates to the tests that I could find. I just went through and compared the patches in the PR and the patches in the upstream and I didn't see any where I had removed any tests. Please tell me which patches if I missed any. |
|
@kgodara912 Please clarify which tests are missing so I can get this PR moving again |
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./SPECS/LICENSES-AND-NOTICES/data/licenses.json,./SPECS/LICENSES-AND-NOTICES/LICENSES-MAP.md,./SPECS/LICENSES-AND-NOTICES/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
Patch libsoup for CVE-2025-32909, CVE-2025-32910, CVE-2025-32912
Change Log
Does this affect the toolchain?
NO
Links to CVEs
Test Methodology