Skip to content

[LOW] Patch for nodejs CVE-2025-5889 #14065

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

aninda-al
Copy link
Contributor

@aninda-al aninda-al commented Jun 21, 2025

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge

Summary

What does the PR accomplish, why was it needed?
Address CVE-2025-5889

Patch Modified: Yes

  • Reason: hunk FAILED
  • All changes from the original patch file were considered during new patch creation

Astrolabe patch reference: juliangruber/brace-expansion@a5b98a4

Change Log
  • modified: SPECS/nodejs/nodejs18.spec
  • added: SPECS/nodejs/CVE-2025-5889.patch
Does this affect the toolchain?

NO

Associated issues
  • NA
Links to CVEs
Test Methodology
  • Due to insufficient memory in vm could not get a successful build. It fails with the same error even without my changes
  • Patch applies cleanly:
    image

@aninda-al aninda-al marked this pull request as ready for review June 23, 2025 22:11
@aninda-al aninda-al requested a review from a team as a code owner June 23, 2025 22:11
Copy link
Member

@mfrw mfrw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we please check the test build.

From: Aninda <v-anipradhan@microsoft.com>
Date: Sat, 21 Jun 2025 07:40:51 -0400
Subject: [PATCH] Address CVE-2025-5889
Upstream Patch Reference: https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Patch looks good w.r.t Upstream

@@ -6,7 +6,7 @@ Name: nodejs18
# WARNINGS: MUST check and update the 'npm_version' macro for every version update of this package.
# The version of NPM can be found inside the sources under 'deps/npm/package.json'.
Version: 18.20.3
Release: 6%{?dist}
Release: 7%{?dist}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test Build fails: link

Can we please check

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is the build looking for a directory by name nodejs18. nodejs18 is the package name but resides in SPECS/nodejs directory.
image
I use the below command to build locally on my vm sudo make build-packages REBUILD_TOOLS=y SOURCE_URL="https://azurelinuxsrcstorage.blob.core.windows.net/sources/core" PACKAGE_BUILD_LIST="nodejs18" PACKAGE_REBUILD_LIST="nodejs18" SRPM_PACK_LIST="nodejs18" RUN_CHECK=y SRPM_FILE_SIGNATURE_HANDLING=update

Copy link
Member

@mfrw mfrw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test Build Triggered: PR-14065

Copy link
Member

@mfrw mfrw left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
main PR Destined for main Packaging security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants