diff --git a/SPECS/telegraf/CVE-2025-47911.patch b/SPECS/telegraf/CVE-2025-47911.patch new file mode 100644 index 00000000000..da798657188 --- /dev/null +++ b/SPECS/telegraf/CVE-2025-47911.patch @@ -0,0 +1,100 @@ +From ca2fcd298c93ce202150fafa6e48d22e41b328fd Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker +Date: Mon, 29 Sep 2025 16:33:18 -0700 +Subject: [PATCH] html: impose open element stack size limit + +The HTML specification contains a number of algorithms which are +quadratic in complexity by design. Instead of adding complicated +workarounds to prevent these cases from becoming extremely expensive in +pathological cases, we impose a limit of 512 to the size of the stack of +open elements. It is extremely unlikely that non-adversarial HTML +documents will ever hit this limit (but if we see cases of this, we may +want to make the limit configurable via a ParseOption). + +Thanks to Guido Vranken and Jakub Ciolek for both independently +reporting this issue. + +Fixes CVE-2025-47911 +Fixes golang/go#75682 + +Change-Id: I890517b189af4ffbf427d25d3fde7ad7ec3509ad +Reviewed-on: https://go-review.googlesource.com/c/net/+/709876 +Reviewed-by: Damien Neil +LUCI-TryBot-Result: Go LUCI +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/golang/net/commit/59706cdaa8f95502fdec64b67b4c61d6ca58727d.patch +--- + vendor/golang.org/x/net/html/escape.go | 2 +- + vendor/golang.org/x/net/html/parse.go | 21 +++++++++++++++++---- + 2 files changed, 18 insertions(+), 5 deletions(-) + +diff --git a/vendor/golang.org/x/net/html/escape.go b/vendor/golang.org/x/net/html/escape.go +index 04c6bec2..12f22737 100644 +--- a/vendor/golang.org/x/net/html/escape.go ++++ b/vendor/golang.org/x/net/html/escape.go +@@ -299,7 +299,7 @@ func escape(w writer, s string) error { + case '\r': + esc = " " + default: +- panic("unrecognized escape character") ++ panic("html: unrecognized escape character") + } + s = s[i+1:] + if _, err := w.WriteString(esc); err != nil { +diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go +index 979ef17e..4d12a1c1 100644 +--- a/vendor/golang.org/x/net/html/parse.go ++++ b/vendor/golang.org/x/net/html/parse.go +@@ -231,7 +231,14 @@ func (p *parser) addChild(n *Node) { + } + + if n.Type == ElementNode { +- p.oe = append(p.oe, n) ++ p.insertOpenElement(n) ++ } ++} ++ ++func (p *parser) insertOpenElement(n *Node) { ++ p.oe = append(p.oe, n) ++ if len(p.oe) > 512 { ++ panic("html: open stack of elements exceeds 512 nodes") + } + } + +@@ -810,7 +817,7 @@ func afterHeadIM(p *parser) bool { + p.im = inFramesetIM + return true + case a.Base, a.Basefont, a.Bgsound, a.Link, a.Meta, a.Noframes, a.Script, a.Style, a.Template, a.Title: +- p.oe = append(p.oe, p.head) ++ p.insertOpenElement(p.head) + defer p.oe.remove(p.head) + return inHeadIM(p) + case a.Head: +@@ -2320,9 +2327,13 @@ func (p *parser) parseCurrentToken() { + } + } + +-func (p *parser) parse() error { ++func (p *parser) parse() (err error) { ++ defer func() { ++ if panicErr := recover(); panicErr != nil { ++ err = fmt.Errorf("%s", panicErr) ++ } ++ }() + // Iterate until EOF. Any other error will cause an early return. +- var err error + for err != io.EOF { + // CDATA sections are allowed only in foreign content. + n := p.oe.top() +@@ -2351,6 +2362,8 @@ func (p *parser) parse() error { + // s. Conversely, explicit s in r's data can be silently dropped, + // with no corresponding node in the resulting tree. + // ++// Parse will reject HTML that is nested deeper than 512 elements. ++// + // The input is assumed to be UTF-8 encoded. + func Parse(r io.Reader) (*Node, error) { + return ParseWithOptions(r) +-- +2.45.4 + diff --git a/SPECS/telegraf/CVE-2025-58190.patch b/SPECS/telegraf/CVE-2025-58190.patch new file mode 100644 index 00000000000..25b54a8f8fa --- /dev/null +++ b/SPECS/telegraf/CVE-2025-58190.patch @@ -0,0 +1,126 @@ +From b55299b135a4734bfb23ba12e71b32e67aa1a79f Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker +Date: Mon, 29 Sep 2025 19:38:24 -0700 +Subject: [PATCH] html: align in row insertion mode with spec + +Update inRowIM to match the HTML specification. This fixes an issue +where a specific HTML document could cause the parser to enter an +infinite loop when trying to parse a and implied next to +each other. + +Fixes CVE-2025-58190 +Fixes golang/go#70179 + +Change-Id: Idcb133c87c7d475cc8c7eb1f1550ea21d8bdddea +Reviewed-on: https://go-review.googlesource.com/c/net/+/709875 +LUCI-TryBot-Result: Go LUCI +Reviewed-by: Damien Neil +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/golang/net/commit/6ec8895aa5f6594da7356da7d341b98133629009.patch +--- + vendor/golang.org/x/net/html/parse.go | 36 ++++++++++++++++++--------- + 1 file changed, 24 insertions(+), 12 deletions(-) + +diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go +index 5b8374bf..979ef17e 100644 +--- a/vendor/golang.org/x/net/html/parse.go ++++ b/vendor/golang.org/x/net/html/parse.go +@@ -136,7 +136,7 @@ func (p *parser) indexOfElementInScope(s scope, matchTags ...a.Atom) int { + return -1 + } + default: +- panic("unreachable") ++ panic(fmt.Sprintf("html: internal error: indexOfElementInScope unknown scope: %d", s)) + } + } + switch s { +@@ -179,7 +179,7 @@ func (p *parser) clearStackToContext(s scope) { + return + } + default: +- panic("unreachable") ++ panic(fmt.Sprintf("html: internal error: clearStackToContext unknown scope: %d", s)) + } + } + } +@@ -1674,7 +1674,7 @@ func inTableBodyIM(p *parser) bool { + return inTableIM(p) + } + +-// Section 12.2.6.4.14. ++// Section 13.2.6.4.14. + func inRowIM(p *parser) bool { + switch p.tok.Type { + case StartTagToken: +@@ -1686,7 +1686,9 @@ func inRowIM(p *parser) bool { + p.im = inCellIM + return true + case a.Caption, a.Col, a.Colgroup, a.Tbody, a.Tfoot, a.Thead, a.Tr: +- if p.popUntil(tableScope, a.Tr) { ++ if p.elementInScope(tableScope, a.Tr) { ++ p.clearStackToContext(tableRowScope) ++ p.oe.pop() + p.im = inTableBodyIM + return false + } +@@ -1696,22 +1698,28 @@ func inRowIM(p *parser) bool { + case EndTagToken: + switch p.tok.DataAtom { + case a.Tr: +- if p.popUntil(tableScope, a.Tr) { ++ if p.elementInScope(tableScope, a.Tr) { ++ p.clearStackToContext(tableRowScope) ++ p.oe.pop() + p.im = inTableBodyIM + return true + } + // Ignore the token. + return true + case a.Table: +- if p.popUntil(tableScope, a.Tr) { ++ if p.elementInScope(tableScope, a.Tr) { ++ p.clearStackToContext(tableRowScope) ++ p.oe.pop() + p.im = inTableBodyIM + return false + } + // Ignore the token. + return true + case a.Tbody, a.Tfoot, a.Thead: +- if p.elementInScope(tableScope, p.tok.DataAtom) { +- p.parseImpliedToken(EndTagToken, a.Tr, a.Tr.String()) ++ if p.elementInScope(tableScope, p.tok.DataAtom) && p.elementInScope(tableScope, a.Tr) { ++ p.clearStackToContext(tableRowScope) ++ p.oe.pop() ++ p.im = inTableBodyIM + return false + } + // Ignore the token. +@@ -2218,16 +2226,20 @@ func parseForeignContent(p *parser) bool { + p.acknowledgeSelfClosingTag() + } + case EndTagToken: ++ if strings.EqualFold(p.oe[len(p.oe)-1].Data, p.tok.Data) { ++ p.oe = p.oe[:len(p.oe)-1] ++ return true ++ } + for i := len(p.oe) - 1; i >= 0; i-- { +- if p.oe[i].Namespace == "" { +- return p.im(p) +- } + if strings.EqualFold(p.oe[i].Data, p.tok.Data) { + p.oe = p.oe[:i] ++ return true ++ } ++ if i > 0 && p.oe[i-1].Namespace == "" { + break + } + } +- return true ++ return p.im(p) + default: + // Ignore the token. + } +-- +2.45.4 + diff --git a/SPECS/telegraf/CVE-2026-2303.patch b/SPECS/telegraf/CVE-2026-2303.patch new file mode 100644 index 00000000000..6992facd11f --- /dev/null +++ b/SPECS/telegraf/CVE-2026-2303.patch @@ -0,0 +1,44 @@ +From fb04605cdd425ccf4dff7f7e18a11a3ad6fecf5d Mon Sep 17 00:00:00 2001 +From: Preston Vasquez +Date: Mon, 26 Jan 2026 09:48:19 -0700 +Subject: [PATCH] =?UTF-8?q?GODRIVER-3770=20Fix=20buffer=20handling=20in=20?= + =?UTF-8?q?GSSAPI=20error=20description=20and=20use=E2=80=A6=20(#2304)?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/mongodb/mongo-go-driver/commit/76ec2daba15f743989040ce2fdaf83f4a3e69bcb.patch +--- + .../x/mongo/driver/auth/internal/gssapi/gss_wrapper.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/vendor/go.mongodb.org/mongo-driver/x/mongo/driver/auth/internal/gssapi/gss_wrapper.c b/vendor/go.mongodb.org/mongo-driver/x/mongo/driver/auth/internal/gssapi/gss_wrapper.c +index 68b72541..e426037e 100644 +--- a/vendor/go.mongodb.org/mongo-driver/x/mongo/driver/auth/internal/gssapi/gss_wrapper.c ++++ b/vendor/go.mongodb.org/mongo-driver/x/mongo/driver/auth/internal/gssapi/gss_wrapper.c +@@ -72,8 +72,8 @@ int gssapi_error_desc( + free(*desc); + } + +- *desc = malloc(desc_buffer.length+1); +- memcpy(*desc, desc_buffer.value, desc_buffer.length+1); ++ *desc = calloc(1, desc_buffer.length + 1); ++ memcpy(*desc, desc_buffer.value, desc_buffer.length); + + gss_release_buffer(&local_min_stat, &desc_buffer); + } +@@ -144,8 +144,8 @@ int gssapi_client_username( + return GSSAPI_ERROR; + } + +- *username = malloc(name_buffer.length+1); +- memcpy(*username, name_buffer.value, name_buffer.length+1); ++ *username = calloc(1, name_buffer.length + 1); ++ memcpy(*username, name_buffer.value, name_buffer.length); + + gss_release_buffer(&ignored, &name_buffer); + gss_release_name(&ignored, &name); +-- +2.45.4 + diff --git a/SPECS/telegraf/CVE-2026-26014.patch b/SPECS/telegraf/CVE-2026-26014.patch new file mode 100644 index 00000000000..084f3cdbc91 --- /dev/null +++ b/SPECS/telegraf/CVE-2026-26014.patch @@ -0,0 +1,63 @@ +From d3834beb654c05530528ff450f2707818edc92fb Mon Sep 17 00:00:00 2001 +From: theodorsm +Date: Thu, 12 Feb 2026 21:13:38 +0100 +Subject: [PATCH] Backport security fix for CVE-2026-26014 + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6.patch +--- + .../github.com/pion/dtls/v2/pkg/crypto/ciphersuite/ccm.go | 6 ++---- + .../github.com/pion/dtls/v2/pkg/crypto/ciphersuite/gcm.go | 6 ++---- + 2 files changed, 4 insertions(+), 8 deletions(-) + +diff --git a/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/ccm.go b/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/ccm.go +index 24050dc9..1cf6aac0 100644 +--- a/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/ccm.go ++++ b/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/ccm.go +@@ -5,7 +5,6 @@ package ciphersuite + + import ( + "crypto/aes" +- "crypto/rand" + "encoding/binary" + "fmt" + +@@ -66,9 +65,8 @@ func (c *CCM) Encrypt(pkt *recordlayer.RecordLayer, raw []byte) ([]byte, error) + raw = raw[:recordlayer.HeaderSize] + + nonce := append(append([]byte{}, c.localWriteIV[:4]...), make([]byte, 8)...) +- if _, err := rand.Read(nonce[4:]); err != nil { +- return nil, err +- } ++ seq64 := (uint64(pkt.Header.Epoch) << 48) | (pkt.Header.SequenceNumber & 0x0000ffffffffffff) ++ binary.BigEndian.PutUint64(nonce[4:], seq64) + + additionalData := generateAEADAdditionalData(&pkt.Header, len(payload)) + encryptedPayload := c.localCCM.Seal(nil, nonce, payload, additionalData) +diff --git a/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/gcm.go b/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/gcm.go +index c0fd1f76..ce557737 100644 +--- a/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/gcm.go ++++ b/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/gcm.go +@@ -6,7 +6,6 @@ package ciphersuite + import ( + "crypto/aes" + "crypto/cipher" +- "crypto/rand" + "encoding/binary" + "fmt" + +@@ -60,9 +59,8 @@ func (g *GCM) Encrypt(pkt *recordlayer.RecordLayer, raw []byte) ([]byte, error) + + nonce := make([]byte, gcmNonceLength) + copy(nonce, g.localWriteIV[:4]) +- if _, err := rand.Read(nonce[4:]); err != nil { +- return nil, err +- } ++ seq64 := (uint64(pkt.Header.Epoch) << 48) | (pkt.Header.SequenceNumber & 0x0000ffffffffffff) ++ binary.BigEndian.PutUint64(nonce[4:], seq64) + + additionalData := generateAEADAdditionalData(&pkt.Header, len(payload)) + encryptedPayload := g.localGCM.Seal(nil, nonce, payload, additionalData) +-- +2.45.4 + diff --git a/SPECS/telegraf/telegraf.spec b/SPECS/telegraf/telegraf.spec index 908b1c6f768..4199ad0e33c 100644 --- a/SPECS/telegraf/telegraf.spec +++ b/SPECS/telegraf/telegraf.spec @@ -1,7 +1,7 @@ Summary: agent for collecting, processing, aggregating, and writing metrics. Name: telegraf Version: 1.31.0 -Release: 13%{?dist} +Release: 14%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Azure Linux @@ -26,6 +26,10 @@ Patch11: CVE-2025-22872.patch Patch12: CVE-2025-47913.patch Patch13: CVE-2025-10543.patch Patch14: CVE-2025-11065.patch +Patch15: CVE-2025-47911.patch +Patch16: CVE-2025-58190.patch +Patch17: CVE-2026-2303.patch +Patch18: CVE-2026-26014.patch BuildRequires: golang BuildRequires: systemd-devel @@ -90,6 +94,9 @@ fi %dir %{_sysconfdir}/%{name}/telegraf.d %changelog +* Thu Feb 19 2026 Azure Linux Security Servicing Account - 1.31.0-14 +- Patch for CVE-2026-26014, CVE-2026-2303, CVE-2025-58190, CVE-2025-47911 + * Tue Feb 03 2026 Azure Linux Security Servicing Account - 1.31.0-13 - Patch for CVE-2025-11065