[AutoPR- Security] Patch cmake for CVE-2025-10966, CVE-2025-14524 [MEDIUM]#15552
Conversation
fd77e86 to
f4bacc0
Compare
suresh-thelkar
left a comment
There was a problem hiding this comment.
Code changes look good to me. Since one of the patches is very huge, it is better to run full build and verify all the ptests as well.
Also, GitHub Checks are failing. Please look into it and fix them.
f4bacc0 to
74d328a
Compare
|
Passed |
kgodara912
left a comment
There was a problem hiding this comment.
The removal of wolfssh looks fine. Also, the 15224 patch looks fine. Please check the libssh.c CVEs properly.
SPECS/cmake/CVE-2025-15079.patch
Outdated
| + if(rc == SSH_OK) | ||
| + /* libssh has two separate options for this. Set both to the same file | ||
| + to avoid surprises */ | ||
| + rc = ssh_options_set(sshc->ssh_session, SSH_OPTIONS_GLOBAL_KNOWNHOSTS, |
There was a problem hiding this comment.
This doesn't seem correct because the variable sshc is not defined in this function. The condition above rc == SSH_OK check is for ssh->ssh_session and not sshc. This also means that this path is not compiling as part of package. We need to correct the variable to ssh->ssh_session instead of sshc->ssh_session. Also, if the file is not compiling then we can dispute both the CVEs of libssh.c in this PR.
There was a problem hiding this comment.
libssh and libssh2 both are not used in the cmake curl build in spec file, also "USE_LIBSSH" and USE_LIBSSH2 macros are not defined and hence the source code for affected files is not compiled. Requested dispute.
|
Buddy build after recent changes. |
|
Buddy build passed. |
|
CVE-2025-15224, CVE-2025-15079 dispute has been raised |
kgodara912
left a comment
There was a problem hiding this comment.
Buddy build is successful. Patches almost match with respective upstream references. Full build was also successful. LGTM.
Auto Patch cmake for CVE-2025-10966, CVE-2025-14524.
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1032055&view=results
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
Change Log
Does this affect the toolchain?
YES/NO
Associated issues
Links to CVEs
Test Methodology