Skip to content

Commit 073df86

Browse files
jslobodzianjslobodzian
authored
Merge pull request #5184 from microsoft/joslobo/mariner-1.0-march-update2
Merge for Mariner 1.0 March 2023 Update 2
2 parents 847aa9b + 32e6a56 commit 073df86

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+329
-209
lines changed

‎SPECS-SIGNED/kernel-signed/kernel-signed.spec

+4-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
%define uname_r %{version}-%{release}
1010
Summary: Signed Linux Kernel for %{buildarch} systems
1111
Name: kernel-signed-%{buildarch}
12-
Version: 5.10.172.1
12+
Version: 5.10.174.1
1313
Release: 1%{?dist}
1414
License: GPLv2
1515
Vendor: Microsoft Corporation
@@ -147,6 +147,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg
147147
%endif
148148

149149
%changelog
150+
* Tue Mar 14 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.174.1-1
151+
- Auto-upgrade to 5.10.174.1
152+
150153
* Mon Mar 06 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.172.1-1
151154
- Auto-upgrade to 5.10.172.1
152155

‎SPECS/curl/CVE-2022-43551.patch

-27
This file was deleted.

‎SPECS/curl/CVE-2022-43552.patch

-94
This file was deleted.

‎SPECS/curl/curl.signatures.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"Signatures": {
3-
"curl-7.86.0.tar.gz": "3dfdd39ba95e18847965cd3051ea6d22586609d9011d91df7bc5521288987a82"
3+
"curl-7.88.1.tar.gz": "cdb38b72e36bc5d33d5b8810f8018ece1baa29a8f215b4495e495ded82bbf3c7"
44
}
55
}

‎SPECS/curl/curl.spec

+6-4
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,14 @@
11
Summary: An URL retrieval utility and library
22
Name: curl
33
# Heads up: 7.87 breaks perl-WWW-Curl (see #4588).
4-
Version: 7.86.0
5-
Release: 3%{?dist}
4+
Version: 7.88.1
5+
Release: 1%{?dist}
66
License: MIT
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
99
Group: System Environment/NetworkingLibraries
1010
URL: https://curl.haxx.se
1111
Source0: https://curl.haxx.se/download/%{name}-%{version}.tar.gz
12-
Patch0: CVE-2022-43551.patch
13-
Patch1: CVE-2022-43552.patch
1412
BuildRequires: krb5-devel
1513
BuildRequires: libssh2-devel
1614
BuildRequires: openssl-devel
@@ -91,6 +89,10 @@ find %{buildroot} -type f -name "*.la" -delete -print
9189
%{_libdir}/libcurl.so.4*
9290

9391
%changelog
92+
* Thu Mar 09 2023 Mykhailo Bykhovtsev <[email protected]> - 7.88.1-1
93+
- Upgrade to version 7.88.1 to fix CVE-2023-23914, CVE-2023-23915, CVE-2023-23916
94+
- Removing old patches that are fixed in version 7.87.0
95+
9496
* Mon Feb 13 2023 Dallas Delaney <[email protected]> - 7.86.0-3
9597
- Apply patch to fix CVE-2022-43552
9698

‎SPECS/dnsmasq/CVE-2023-28450.patch

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
From 11d7325dc418e2ca30c13f64ce237c4a5de3dd56 Mon Sep 17 00:00:00 2001
2+
From: Simon Kelley <[email protected]>
3+
Date: Wed, 8 Mar 2023 03:37:46 +0530
4+
Subject: [PATCH] Set the default maximum DNS UDP packet size to 1232
5+
6+
Backported by @rohitrawat from upstream on 2023-03-23
7+
Applies on v2.85 cleanly
8+
9+
Signed-off-by: Rohit Rawat <[email protected]>
10+
---
11+
man/dnsmasq.8 | 3 ++-
12+
src/config.h | 2 +-
13+
2 files changed, 3 insertions(+), 2 deletions(-)
14+
15+
diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
16+
index fce580f..4b0b180 100644
17+
--- a/man/dnsmasq.8
18+
+++ b/man/dnsmasq.8
19+
@@ -171,7 +171,8 @@ to zero completely disables DNS function, leaving only DHCP and/or TFTP.
20+
.TP
21+
.B \-P, --edns-packet-max=<size>
22+
Specify the largest EDNS.0 UDP packet which is supported by the DNS
23+
-forwarder. Defaults to 4096, which is the RFC5625-recommended size.
24+
+forwarder. Defaults to 1232, which is the recommended size following the
25+
+DNS flag day in 2020. Only increase if you know what you are doing.
26+
.TP
27+
.B \-Q, --query-port=<query_port>
28+
Send outbound DNS queries from, and listen for their replies on, the
29+
diff --git a/src/config.h b/src/config.h
30+
index 8c41943..62b7fa1 100644
31+
--- a/src/config.h
32+
+++ b/src/config.h
33+
@@ -19,7 +19,7 @@
34+
#define CHILD_LIFETIME 150 /* secs 'till terminated (RFC1035 suggests > 120s) */
35+
#define TCP_MAX_QUERIES 100 /* Maximum number of queries per incoming TCP connection */
36+
#define TCP_BACKLOG 32 /* kernel backlog limit for TCP connections */
37+
-#define EDNS_PKTSZ 4096 /* default max EDNS.0 UDP packet from RFC5625 */
38+
+#define EDNS_PKTSZ 1232 /* default max EDNS.0 UDP packet from from /dnsflagday.net/2020 */
39+
#define SAFE_PKTSZ 1280 /* "go anywhere" UDP packet size */
40+
#define KEYBLOCK_LEN 40 /* choose to minimise fragmentation when storing DNSSEC keys */
41+
#define DNSSEC_WORK 50 /* Max number of queries to validate one question */
42+
--
43+
2.17.1
44+

‎SPECS/dnsmasq/dnsmasq.spec

+5-1
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
Summary: DNS proxy with integrated DHCP server
22
Name: dnsmasq
33
Version: 2.85
4-
Release: 1%{?dist}
4+
Release: 2%{?dist}
55
License: GPLv2 or GPLv3
66
Group: System Environment/Daemons
77
URL: http://www.thekelleys.org.uk/dnsmasq/
88
Source0: http://www.thekelleys.org.uk/%{name}/%{name}-%{version}.tar.xz
99
Vendor: Microsoft Corporation
1010
Distribution: Mariner
1111
Patch0: fix-missing-ioctl-SIOCGSTAMP-add-sockios-header-linux-5.2.patch
12+
Patch1: CVE-2023-28450.patch
1213

1314
BuildRequires: kernel-headers
1415

@@ -69,6 +70,9 @@ rm -rf %{buildroot}
6970
%config /usr/share/dnsmasq/trust-anchors.conf
7071

7172
%changelog
73+
* Thu Mar 23 2023 Rohit Rawat <[email protected]> - 2.85-2
74+
- Patch CVE-2023-28450
75+
7276
* Fri Apr 23 2021 Thomas Crain <[email protected]> - 2.85-1
7377
- Upgrade to version 2.85 to fix CVE-2021-3348
7478

‎SPECS/heimdal/CVE-2022-45142.patch

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
diff --color --color -ruN a/lib/gssapi/krb5/arcfour.c b/lib/gssapi/krb5/arcfour.c
2+
--- a/lib/gssapi/krb5/arcfour.c 2023-03-15 00:23:03.051530897 +0000
3+
+++ b/lib/gssapi/krb5/arcfour.c 2023-03-15 00:23:46.771143241 +0000
4+
@@ -365,7 +365,7 @@
5+
return GSS_S_FAILURE;
6+
}
7+
8+
- cmp = (ct_memcmp(cksum_data, p + 8, 8) == 0);
9+
+ cmp = (ct_memcmp(cksum_data, p + 8, 8) != 0);
10+
if (cmp) {
11+
*minor_status = 0;
12+
return GSS_S_BAD_MIC;
13+
@@ -730,7 +730,7 @@
14+
return GSS_S_FAILURE;
15+
}
16+
17+
- cmp = (ct_memcmp(cksum_data, p0 + 16, 8) == 0); /* SGN_CKSUM */
18+
+ cmp = (ct_memcmp(cksum_data, p0 + 16, 8) != 0); /* SGN_CKSUM */
19+
if (cmp) {
20+
_gsskrb5_release_buffer(minor_status, output_message_buffer);
21+
*minor_status = 0;

‎SPECS/heimdal/heimdal.spec

+5-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
Summary: A Kerberos 5 implementation without export restrictions
1313
Name: heimdal
1414
Version: 7.7.1
15-
Release: 1%{?dist}
15+
Release: 2%{?dist}
1616
License: BSD AND MIT
1717
Vendor: Microsoft Corporation
1818
Distribution: Mariner
@@ -42,6 +42,7 @@ Patch1: heimdal-1.6.0-c25f45a-rename-commands.patch
4242
# Use Python2 explicity.
4343
Patch3: heimdal-7.7.1-explicit-python2.patch
4444
Patch4: heimdal-7.7.0-configure.patch
45+
Patch5: CVE-2022-45142.patch
4546
BuildRequires: bison
4647
#libcom_err-devel is in
4748
#BuildRequires: libcom_err-devel
@@ -486,6 +487,9 @@ fi
486487
%{_sysconfdir}/profile.d/%{name}.csh
487488

488489
%changelog
490+
* Tue Mar 14 2023 Thien Trung Vuong <[email protected]> - 7.7.1-2
491+
- Add patch for CVE-2022-45142
492+
489493
* Wed Jan 04 2023 CBL-Mariner Servicing Account <[email protected]> - 7.7.1-1
490494
- Auto-upgrade to 7.7.1 - to fix CVE-2022-41916
491495

‎SPECS/httpd/httpd.signatures.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"Signatures": {
3-
"httpd-2.4.55.tar.bz2": "11d6ba19e36c0b93ca62e47e6ffc2d2f2884942694bce0f23f39c71bdc5f69ac"
3+
"httpd-2.4.56.tar.bz2": "d8d45f1398ba84edd05bb33ca7593ac2989b17cb9c7a0cafe5442d41afdb2d7c"
44
}
5-
}
5+
}

‎SPECS/httpd/httpd.spec

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Summary: The Apache HTTP Server
22
Name: httpd
3-
Version: 2.4.55
3+
Version: 2.4.56
44
Release: 1%{?dist}
55
License: Apache-2.0
66
URL: https://httpd.apache.org/
@@ -10,7 +10,7 @@ Distribution: Mariner
1010
Source0: https://archive.apache.org/dist/%{name}/%{name}-%{version}.tar.bz2
1111

1212
# Patch0 is taken from:
13-
# https://www.linuxfromscratch.org/patches/blfs/svn/httpd-2.4.53-blfs_layout-3.patch
13+
# https://www.linuxfromscratch.org/patches/blfs/svn/httpd-2.4.56-blfs_layout-3.patch
1414
Patch0: httpd-2.4.53-blfs_layout-3.patch
1515
Patch1: httpd-uncomment-ServerName.patch
1616

@@ -207,6 +207,9 @@ fi
207207
%{_bindir}/dbmmanage
208208

209209
%changelog
210+
* Tue Mar 14 2023 Thien Trung Vuong <[email protected]> - 2.4.56-1
211+
- Upgrade to version 2.4.56 - Fixes CVE-2023-27522, CVE-2023-25690
212+
210213
* Mon Feb 06 2023 Dan Streetman <[email protected]> - 2.4.55-1
211214
- Upgrade to version 2.4.55 - Fixes CVE-2022-36760
212215

‎SPECS/hyperv-daemons/hyperv-daemons.signatures.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,6 @@
77
"hypervkvpd.service": "25339871302f7a47e1aecfa9fc2586c78bc37edb98773752f0a5dec30f0ed3a1",
88
"hypervvss.rules": "94cead44245ef6553ab79c0bbac8419e3ff4b241f01bcec66e6f508098cbedd1",
99
"hypervvssd.service": "22270d9f0f23af4ea7905f19c1d5d5495e40c1f782cbb87a99f8aec5a011078d",
10-
"kernel-5.10.172.1.tar.gz": "eaaa625153c397d420824408ef7bc5d50364c8d30c8fe5fecaf15bd03d3a241b"
10+
"kernel-5.10.174.1.tar.gz": "41a516c957c274ee9da65d0c58c4e65161ec17a33c5740d102c20e798f336bc2"
1111
}
1212
}

‎SPECS/hyperv-daemons/hyperv-daemons.spec

+4-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
%global udev_prefix 70
99
Summary: Hyper-V daemons suite
1010
Name: hyperv-daemons
11-
Version: 5.10.172.1
11+
Version: 5.10.174.1
1212
Release: 1%{?dist}
1313
License: GPLv2+
1414
Vendor: Microsoft Corporation
@@ -221,6 +221,9 @@ fi
221221
%{_sbindir}/lsvmbus
222222

223223
%changelog
224+
* Tue Mar 14 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.174.1-1
225+
- Auto-upgrade to 5.10.174.1
226+
224227
* Mon Mar 06 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.172.1-1
225228
- Auto-upgrade to 5.10.172.1
226229

‎SPECS/kernel-headers/kernel-headers.signatures.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"Signatures": {
3-
"kernel-5.10.172.1.tar.gz": "eaaa625153c397d420824408ef7bc5d50364c8d30c8fe5fecaf15bd03d3a241b"
3+
"kernel-5.10.174.1.tar.gz": "41a516c957c274ee9da65d0c58c4e65161ec17a33c5740d102c20e798f336bc2"
44
}
55
}

‎SPECS/kernel-headers/kernel-headers.spec

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
Summary: Linux API header files
22
Name: kernel-headers
3-
Version: 5.10.172.1
3+
Version: 5.10.174.1
44
Release: 1%{?dist}
55
License: GPLv2
66
Vendor: Microsoft Corporation
@@ -36,6 +36,9 @@ cp -rv usr/include/* /%{buildroot}%{_includedir}
3636
%{_includedir}/*
3737

3838
%changelog
39+
* Tue Mar 14 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.174.1-1
40+
- Auto-upgrade to 5.10.174.1
41+
3942
* Mon Mar 06 2023 CBL-Mariner Servicing Account <[email protected]> - 5.10.172.1-1
4043
- Auto-upgrade to 5.10.172.1
4144

0 commit comments

Comments
 (0)