From c5b427a13e72fcea2c7601dbde9cc73e625e260f Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Fri, 24 Apr 2026 19:28:01 +0000 Subject: [PATCH] Patch libgcrypt for CVE-2026-41989 --- SPECS/libgcrypt/CVE-2026-41989.patch | 42 +++++++++++++++++++ SPECS/libgcrypt/libgcrypt.spec | 6 ++- .../manifests/package/pkggen_core_aarch64.txt | 2 +- .../manifests/package/pkggen_core_x86_64.txt | 2 +- .../manifests/package/toolchain_aarch64.txt | 6 +-- .../manifests/package/toolchain_x86_64.txt | 6 +-- 6 files changed, 55 insertions(+), 9 deletions(-) create mode 100644 SPECS/libgcrypt/CVE-2026-41989.patch diff --git a/SPECS/libgcrypt/CVE-2026-41989.patch b/SPECS/libgcrypt/CVE-2026-41989.patch new file mode 100644 index 00000000000..d4779ed25dd --- /dev/null +++ b/SPECS/libgcrypt/CVE-2026-41989.patch @@ -0,0 +1,42 @@ +From 23cdb6434d605db7675b59fcd858c99475654a59 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Fri, 10 Apr 2026 16:58:57 +0900 +Subject: [PATCH] cipher:ecc: Fix decoding a point on Montgomery curve. + +* cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix the padding +mistake and add updating RAWMPILEN. + +-- + +Reported by Calif.io in collaboration with Claude and Anthropic +Research. + +GnuPG-bug-id: 8211 +Fixes-commit: bbe15758c893dbf546416c1a6bccdad1ab000ad7 +Suggested-by: Bronson Yen +Signed-off-by: NIIBE Yutaka +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/gpg/libgcrypt/commit/2d3d732c9bf87cc10729f69678dd9e6862f99fa3.patch +--- + cipher/ecc-misc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/cipher/ecc-misc.c b/cipher/ecc-misc.c +index 6796ba2..fd429a0 100644 +--- a/cipher/ecc-misc.c ++++ b/cipher/ecc-misc.c +@@ -438,7 +438,10 @@ _gcry_ecc_mont_decodepoint (gcry_mpi_t pk, mpi_ec_t ec, mpi_point_t result) + *--p = *buf++; + + if (rawmpilen < nbytes) +- memset (rawmpi + nbytes - rawmpilen, 0, nbytes - rawmpilen); ++ { ++ memset (rawmpi + rawmpilen, 0, nbytes - rawmpilen); ++ rawmpilen = nbytes; ++ } + } + else + { +-- +2.45.4 + diff --git a/SPECS/libgcrypt/libgcrypt.spec b/SPECS/libgcrypt/libgcrypt.spec index 4d1316e032c..55df9bb0841 100644 --- a/SPECS/libgcrypt/libgcrypt.spec +++ b/SPECS/libgcrypt/libgcrypt.spec @@ -1,13 +1,14 @@ Summary: GNU Crypto Libraries Name: libgcrypt Version: 1.10.3 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2+ and LGPLv2+ and BSD and MIT and Public Domain Vendor: Microsoft Corporation Distribution: Azure Linux Group: System Environment/Libraries URL: https://gnupg.org/related_software/libgcrypt/ Source0: https://gnupg.org/ftp/gcrypt/%{name}/%{name}-%{version}.tar.bz2 +Patch0: CVE-2026-41989.patch BuildRequires: libgpg-error-devel Requires: libgpg-error @@ -59,6 +60,9 @@ rm -rf %{buildroot}%{_infodir} %{_libdir}/pkgconfig/%{name}.pc %changelog +* Fri Apr 24 2026 Azure Linux Security Servicing Account - 1.10.3-2 +- Patch for CVE-2026-41989 + * Tue Jul 15 2025 Andrew Phelps - 1.10.3-1 - Upgrade to 1.10.3 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 48358a4649f..03308062553 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -222,7 +222,7 @@ tdnf-plugin-repogpgcheck-3.5.8-8.azl3.aarch64.rpm libassuan-2.5.6-1.azl3.aarch64.rpm libassuan-devel-2.5.6-1.azl3.aarch64.rpm libgpg-error-1.48-1.azl3.aarch64.rpm -libgcrypt-1.10.3-1.azl3.aarch64.rpm +libgcrypt-1.10.3-2.azl3.aarch64.rpm libksba-1.6.4-1.azl3.aarch64.rpm libksba-devel-1.6.4-1.azl3.aarch64.rpm libxslt-1.1.43-3.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 3200318718d..36044dfe47a 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -222,7 +222,7 @@ tdnf-plugin-repogpgcheck-3.5.8-8.azl3.x86_64.rpm libassuan-2.5.6-1.azl3.x86_64.rpm libassuan-devel-2.5.6-1.azl3.x86_64.rpm libgpg-error-1.48-1.azl3.x86_64.rpm -libgcrypt-1.10.3-1.azl3.x86_64.rpm +libgcrypt-1.10.3-2.azl3.x86_64.rpm libksba-1.6.4-1.azl3.x86_64.rpm libksba-devel-1.6.4-1.azl3.x86_64.rpm libxslt-1.1.43-3.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 2a39647c90c..926ccb770bf 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -189,9 +189,9 @@ libffi-devel-3.4.4-1.azl3.aarch64.rpm libgcc-13.2.0-7.azl3.aarch64.rpm libgcc-atomic-13.2.0-7.azl3.aarch64.rpm libgcc-devel-13.2.0-7.azl3.aarch64.rpm -libgcrypt-1.10.3-1.azl3.aarch64.rpm -libgcrypt-debuginfo-1.10.3-1.azl3.aarch64.rpm -libgcrypt-devel-1.10.3-1.azl3.aarch64.rpm +libgcrypt-1.10.3-2.azl3.aarch64.rpm +libgcrypt-debuginfo-1.10.3-2.azl3.aarch64.rpm +libgcrypt-devel-1.10.3-2.azl3.aarch64.rpm libgomp-13.2.0-7.azl3.aarch64.rpm libgomp-devel-13.2.0-7.azl3.aarch64.rpm libgpg-error-1.48-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 21c037e56d2..5dcc47fe7fc 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -197,9 +197,9 @@ libffi-devel-3.4.4-1.azl3.x86_64.rpm libgcc-13.2.0-7.azl3.x86_64.rpm libgcc-atomic-13.2.0-7.azl3.x86_64.rpm libgcc-devel-13.2.0-7.azl3.x86_64.rpm -libgcrypt-1.10.3-1.azl3.x86_64.rpm -libgcrypt-debuginfo-1.10.3-1.azl3.x86_64.rpm -libgcrypt-devel-1.10.3-1.azl3.x86_64.rpm +libgcrypt-1.10.3-2.azl3.x86_64.rpm +libgcrypt-debuginfo-1.10.3-2.azl3.x86_64.rpm +libgcrypt-devel-1.10.3-2.azl3.x86_64.rpm libgomp-13.2.0-7.azl3.x86_64.rpm libgomp-devel-13.2.0-7.azl3.x86_64.rpm libgpg-error-1.48-1.azl3.x86_64.rpm