diff --git a/SPECS/mysql/CVE-2026-63379.patch b/SPECS/mysql/CVE-2026-63379.patch new file mode 100644 index 00000000000..52ae72916d9 --- /dev/null +++ b/SPECS/mysql/CVE-2026-63379.patch @@ -0,0 +1,95 @@ +From b847071141b3827900d536594ec9045eb0a4c485 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 11:04:48 -0400 +Subject: [PATCH] http: Discard trailers. + +Previously, we would insert any trailers directly into the header +list. But this was incorrect, since trailers are not supposed to be +treated as normal headers. This behavior could lead to conflicting +interpretation between HTTP servers and proxies, and enable +different kinds of attacks. + +Fixes GHSA-2gmv-p5m7-98p6. + +Reported by @sebastianosrt. + +Tracking: X13. + +Upstream Patch reference: https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485.patch +--- + extra/libevent/libevent-2.1.11-stable/http.c | 25 ++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c +index 5331602a..409b02e0 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http.c ++++ b/extra/libevent/libevent-2.1.11-stable/http.c +@@ -181,6 +181,10 @@ static evutil_socket_t bind_socket_ai(struct evutil_addrinfo *, int reuse); + static evutil_socket_t bind_socket(const char *, ev_uint16_t, int reuse); + static void name_from_addr(struct sockaddr *, ev_socklen_t, char **, char **); + static struct evhttp_uri *evhttp_uri_parse_authority(char *source_uri); ++static enum message_read_status evhttp_parse_headers_impl_( ++ struct evhttp_request *req, ++ struct evbuffer *buffer, ++ struct evkeyvalq *headers); + static int evhttp_associate_new_request_with_connection( + struct evhttp_connection *evcon); + static void evhttp_connection_start_detectclose( +@@ -988,8 +992,10 @@ static void + evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) + { + struct evbuffer *buf = bufferevent_get_input(evcon->bufev); ++ struct evkeyvalq tmp_headers; ++ TAILQ_INIT(&tmp_headers); + +- switch (evhttp_parse_headers_(req, buf)) { ++ switch (evhttp_parse_headers_impl_(req, buf, &tmp_headers)) { + case DATA_CORRUPTED: + case DATA_TOO_LONG: + evhttp_connection_fail_(evcon, EVREQ_HTTP_DATA_TOO_LONG); +@@ -1003,6 +1009,8 @@ evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) + default: + break; + } ++ ++ evhttp_clear_headers(&tmp_headers); + } + + static void +@@ -2083,14 +2091,17 @@ evhttp_append_to_last_header(struct evkeyvalq *headers, char *line) + return (0); + } + +-enum message_read_status +-evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) ++/* As `evhttp_parse_headers_`, but put any headers we find into `headers`. */ ++static enum message_read_status ++evhttp_parse_headers_impl_( ++ struct evhttp_request *req, ++ struct evbuffer *buffer, ++ struct evkeyvalq *headers) + { + enum message_read_status errcode = DATA_CORRUPTED; + char *line; + enum message_read_status status = MORE_DATA_EXPECTED; + +- struct evkeyvalq* headers = req->input_headers; + size_t len; + while ((line = evbuffer_readln(buffer, &len, EVBUFFER_EOL_CRLF)) + != NULL) { +@@ -2146,6 +2157,12 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) + return (errcode); + } + ++enum message_read_status ++evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer *buffer) ++{ ++ return evhttp_parse_headers_impl_(req, buffer, req->input_headers); ++} ++ + static int + evhttp_get_body_length(struct evhttp_request *req) + { +-- +2.34.1 + diff --git a/SPECS/mysql/CVE-2026-63381.patch b/SPECS/mysql/CVE-2026-63381.patch new file mode 100644 index 00000000000..9d9f7f0ca2c --- /dev/null +++ b/SPECS/mysql/CVE-2026-63381.patch @@ -0,0 +1,40 @@ +From 460c0b9d53f46fa865e45f809c6548b209844751 Mon Sep 17 00:00:00 2001 +From: Alexis +Date: Tue, 9 Jun 2026 15:09:05 +0200 +Subject: [PATCH] Fix a dangling pointer in evbuffer_add_buffer_reference. + +If `evbuffer_add_buffer_reference` was called to add a reference to +an empty buffer, the resulting code would produce dangling pointers +that could later lead to a use-after-free. + +Fixes GHSA-c2pj-cg4r-88c8. + +Tracking: X8. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c.patch +--- + extra/libevent/libevent-2.1.11-stable/buffer.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/buffer.c b/extra/libevent/libevent-2.1.11-stable/buffer.c +index a51b6c5..b878ef6 100644 +--- a/extra/libevent/libevent-2.1.11-stable/buffer.c ++++ b/extra/libevent/libevent-2.1.11-stable/buffer.c +@@ -1038,8 +1038,13 @@ evbuffer_add_buffer_reference(struct evbuffer *outbuf, struct evbuffer *inbuf) + + if (out_total_len == 0) { + /* There might be an empty chain at the start of outbuf; free +- * it. */ ++ * it. Reset the chain pointers afterwards so the subsequent ++ * APPEND_CHAIN_MULTICAST does not dereference the freed chain ++ * through outbuf->first / last_with_datap. */ + evbuffer_free_all_chains(outbuf->first); ++ outbuf->first = NULL; ++ outbuf->last = NULL; ++ outbuf->last_with_datap = &outbuf->first; + } + APPEND_CHAIN_MULTICAST(outbuf, inbuf); + +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63382.patch b/SPECS/mysql/CVE-2026-63382.patch new file mode 100644 index 00000000000..11ce3e1451c --- /dev/null +++ b/SPECS/mysql/CVE-2026-63382.patch @@ -0,0 +1,286 @@ +From ac38703b2d312200c4f967f02936af0118d384a0 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 10:37:46 -0400 +Subject: [PATCH] http: Tighten acceptable headers to prevent request + smuggling. + +Previously, we accepted a wider variety of combinations of +Content-Length and Transfer-Encoding, and we didn't parse +Transfer-Encoding according to the full rules of the relevant RFC. +This made evhttp interpret these headers in a +non-standards-compliant way that had the potential to differ from +a more compliant proxy or HTTP server. Thus, when used _as_ an +HTTP proxy, evhttp had the potential to enable http smuggling +attacks. + +Fixes GHSA-q39v-w2g7-gr8j. + +Originally reported by @xclow3n; and then by @kodareef5, +@nstaller0490, @AsafMeizneer, and @yaotushaozhu (in that order). + +(Note that this fix assumes that we have _also_ disabled support for +CR and LF in header lines.) + +Tracking: X12. + +Upstream Patch reference: +1. https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0.patch +2. https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6.patch + +--- + .../libevent-2.1.11-stable/http-internal.h | 14 ++ + extra/libevent/libevent-2.1.11-stable/http.c | 164 +++++++++++++++++- + 2 files changed, 171 insertions(+), 7 deletions(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/http-internal.h b/extra/libevent/libevent-2.1.11-stable/http-internal.h +index feaf436d..4d52504c 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http-internal.h ++++ b/extra/libevent/libevent-2.1.11-stable/http-internal.h +@@ -185,6 +185,20 @@ EVENT2_EXPORT_SYMBOL + void evhttp_connection_fail_(struct evhttp_connection *, + enum evhttp_request_error error); + ++enum evhttp_transfer_encoding_header_status { ++ /* This Transfer-Encoding line was invalid. ++ * (We consider all "chunked" encodings invalid except those at the end ++ * of the sequence.) */ ++ TE_INVALID, ++ /* This Transfer-Encoding line ended with the "chunked" encoding. */ ++ TE_ENDS_IN_CHUNKED, ++ /* This Transfer-Encoding line was valid and did not contain "chunked" */ ++ TE_NO_CHUNKED, ++}; ++int evhttp_str_is_chunked_(const char *value, const char *eos); ++enum evhttp_transfer_encoding_header_status ++evhttp_check_transfer_encoding_(const char *value); ++ + enum message_read_status; + + EVENT2_EXPORT_SYMBOL +diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c +index 409b02e0..fd9ec9e2 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http.c ++++ b/extra/libevent/libevent-2.1.11-stable/http.c +@@ -123,7 +123,6 @@ + #ifndef NI_NUMERICSERV + #define NI_NUMERICSERV 2 + #endif +- + static int + fake_getnameinfo(const struct sockaddr *sa, size_t salen, char *host, + size_t hostlen, char *serv, size_t servlen, int flags) +@@ -163,6 +162,8 @@ fake_getnameinfo(const struct sockaddr *sa, size_t salen, char *host, + + #endif + ++static int evhttp_validate_len_and_encoding_(struct evhttp_request *req); ++ + #define REQ_VERSION_BEFORE(req, major_v, minor_v) \ + ((req)->major < (major_v) || \ + ((req)->major == (major_v) && (req)->minor < (minor_v))) +@@ -920,7 +921,7 @@ evhttp_handle_chunked_read(struct evhttp_request *req, struct evbuffer *buf) + if (req->ntoread < 0) { + /* Read chunk size */ + ev_int64_t ntoread; +- char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF); ++ char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF_STRICT); + char *endp; + int error; + if (p == NULL) +@@ -1907,6 +1908,32 @@ evhttp_find_header(const struct evkeyvalq *headers, const char *key) + return (NULL); + } + ++/* Like evhttp_find_header, but set *duplicate to 1 if the header appears ++ * more than once, and to 0 otherwise. ++ */ ++static const char * ++evhttp_find_unique_header(const struct evkeyvalq *headers, const char *key, ++ int *duplicate) ++{ ++ const char *result = NULL; ++ struct evkeyval *header; ++ ++ *duplicate = 0; ++ ++ TAILQ_FOREACH(header, headers, next) { ++ if (evutil_ascii_strcasecmp(header->key, key) == 0) { ++ if (result == NULL) { ++ result = header->value; ++ } else { ++ *duplicate = 1; ++ break; ++ } ++ } ++ } ++ ++ return (result); ++} ++ + void + evhttp_clear_headers(struct evkeyvalq *headers) + { +@@ -2163,6 +2190,125 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer *buffer) + return evhttp_parse_headers_impl_(req, buffer, req->input_headers); + } + ++/* Return true if 'ch' is a single linear WS character (per the HTTP spec). ++ * We reject CR and LF elsewhere. */ ++#define IS_LWS(ch) \ ++ (((ch) == ' ' ) || ((ch) == '\t')) ++ ++/* Returns true when the string beginning at `value` and ending at `eos` ++ * (non-inclusive) is a `transfer-coding` "chunked". Case insensitive. ++ */ ++int ++evhttp_str_is_chunked_(const char *value, const char *eos) ++{ ++ /* the end of the encoding. */ ++ const char *end; ++ ++ if (eos == NULL) { ++ eos = value + strlen(value); ++ } ++ ++ while (value < eos && IS_LWS(*value)) { ++ ++value; ++ } ++ end = value; ++ /* A transfer-coding can end with OWS ; OWS to indicate a ++ * transfer-parameter. (See RFC 9110) ++ */ ++ while (end < eos && !IS_LWS(*end) && *end != ';') { ++ ++end; ++ } ++ ++ return (end - value) == strlen("chunked") ++ && evutil_ascii_strncasecmp(value, "chunked", strlen("chunked")) == 0; ++} ++ ++/* Check a single Transfer-Encoding header value. ++ * ++ * Returns an evhttp_transfer_encoding_header_status value depending ++ * on its contents. ++ */ ++enum evhttp_transfer_encoding_header_status ++evhttp_check_transfer_encoding_(const char *value) ++{ ++ const char *comma; ++ ++ while ((comma = strchr(value, ',')) != NULL) { ++ if (evhttp_str_is_chunked_(value, comma)) { ++ /* If we find that an encoding is chunked ++ * and it is followed by a comma, it is not the final ++ * encoding ++ */ ++ return TE_INVALID; ++ } ++ value = comma + 1; ++ } ++ ++ if (evhttp_str_is_chunked_(value, NULL)) { ++ return TE_ENDS_IN_CHUNKED; ++ } else { ++ return TE_NO_CHUNKED; ++ } ++} ++ ++ ++/* Return 0 if the Transfer-Encoding and Content-Length heeaders appear to be consistent, ++ * and -1 otherwise. ++ * ++ * Sets "req->chunked" if appropriate. ++ * ++ * Used to prevent request smuggling. ++ */ ++static int ++evhttp_validate_len_and_encoding_(struct evhttp_request *req) ++{ ++ struct evkeyvalq *headers = req->input_headers; ++ struct evkeyval *h = NULL; ++ int is_chunked = 0; ++ int dup_cl = 0; ++ ++ if (evhttp_find_header(headers, "Transfer-Encoding") != NULL && ++ evhttp_find_unique_header(headers, "Content-Length", &dup_cl) != NULL) { ++ /* Both TE and CL were present: Not allowed. */ ++ return -1; ++ } ++ if (dup_cl) { ++ /* CL was present twice: Not allowed. ++ * (Technically we can permit this if the values are the same, ++ * but we don't.) */ ++ return -1; ++ } ++ ++ /* Now walk through the Transfer-Encoding headers. */ ++ TAILQ_FOREACH(h, headers, next) { ++ if (evutil_ascii_strcasecmp(h->key, "Transfer-Encoding") == 0) { ++ if (is_chunked) { ++ /* We already encountered a chunked ++ encoding; no further encodings are allowed */ ++ return -1; ++ } ++ ++ switch (evhttp_check_transfer_encoding_(h->value)) ++ { ++ case TE_INVALID: ++ /* We found "chunked" somewhere not at the end. */ ++ return -1; ++ case TE_ENDS_IN_CHUNKED: ++ /* We found chunked at the end. */ ++ is_chunked = 1; ++ break; ++ case TE_NO_CHUNKED: ++ /* "chunked" didn't appear; this is fine. */ ++ break; ++ } ++ } ++ } ++ ++ req->chunked = is_chunked; ++ ++ return 0; ++} ++ + static int + evhttp_get_body_length(struct evhttp_request *req) + { +@@ -2222,8 +2368,6 @@ evhttp_method_may_have_body(enum evhttp_cmd_type type) + static void + evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) + { +- const char *xfer_enc; +- + /* If this is a request without a body, then we are done */ + if (req->kind == EVHTTP_REQUEST && + !evhttp_method_may_have_body(req->type)) { +@@ -2231,9 +2375,8 @@ evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) + return; + } + evcon->state = EVCON_READING_BODY; +- xfer_enc = evhttp_find_header(req->input_headers, "Transfer-Encoding"); +- if (xfer_enc != NULL && evutil_ascii_strcasecmp(xfer_enc, "chunked") == 0) { +- req->chunked = 1; ++ ++ if (req->chunked) { + req->ntoread = -1; + } else { + if (evhttp_get_body_length(req) == -1) { +@@ -2319,6 +2462,13 @@ evhttp_read_header(struct evhttp_connection *evcon, + return; + } + ++ if (evhttp_validate_len_and_encoding_(req) < 0) { ++ event_debug(("%s: bad combination of headers on "EV_SOCK_FMT"\n", ++ __func__, EV_SOCK_ARG(fd))); ++ evhttp_connection_fail_(evcon, EVREQ_HTTP_INVALID_HEADER); ++ return; ++ } ++ + /* Callback can shut down connection with negative return value */ + if (req->header_cb != NULL) { + if ((*req->header_cb)(req, req->cb_arg) < 0) { +-- +2.34.1 + diff --git a/SPECS/mysql/CVE-2026-63383.patch b/SPECS/mysql/CVE-2026-63383.patch new file mode 100644 index 00000000000..d83e421c82f --- /dev/null +++ b/SPECS/mysql/CVE-2026-63383.patch @@ -0,0 +1,42 @@ +From 5cb9eb4c9abe9717401631991318afae133528d8 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:53:23 -0400 +Subject: [PATCH] evrpc: Fix out-of-bounds read in decode_tag_internal + +This bug could allow an attacker to cause an evrpc client or server +to read out of bounds when decoding a tag. + +Fixes GHSA-fj29-64w6-73h6. + +Reported by @Brubbish. + +Tracking: X5. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb.patch +--- + extra/libevent/libevent-2.1.11-stable/event_tagging.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/event_tagging.c b/extra/libevent/libevent-2.1.11-stable/event_tagging.c +index 790dff3..9ee642b 100644 +--- a/extra/libevent/libevent-2.1.11-stable/event_tagging.c ++++ b/extra/libevent/libevent-2.1.11-stable/event_tagging.c +@@ -210,12 +210,13 @@ decode_tag_internal(ev_uint32_t *ptag, struct evbuffer *evbuf, int dodrain) + * the encoding of a number is at most one byte more than its + * storage size. however, it may also be much smaller. + */ ++ size_t pullup_len = len < sizeof(number) + 1 ? len : sizeof(number) + 1; + data = evbuffer_pullup( +- evbuf, len < sizeof(number) + 1 ? len : sizeof(number) + 1); ++ evbuf, pullup_len); + if (!data) + return (-1); + +- while (count++ < len) { ++ while (count++ < pullup_len) { + ev_uint8_t lower = *data++; + if (shift >= 28) { + /* Make sure it fits into 32 bits */ +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63384.patch b/SPECS/mysql/CVE-2026-63384.patch new file mode 100644 index 00000000000..03777ae1b4b --- /dev/null +++ b/SPECS/mysql/CVE-2026-63384.patch @@ -0,0 +1,54 @@ +From 506a9e9af64067dd83fa329435cff75ed957e6eb Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 10:08:22 -0400 +Subject: [PATCH] evrpc: Fix integer overflow in evtag_unmarshal_header. + +On platforms where int is 32 bits, if this function tried to decode +a header declaring a payload longer than INT_MAX bytes long, this +function would return a negative value, which could cause incorrect +behaviors, incorrect allocations, or denial-of-service. + +We solve this (for now) by rejecting any payload length larger +than INT_MAX. + +Fixes GHSA-45c6-qx49-89m8 + +Reported by @Brubbish + +Tracking: X5 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416.patch +--- + extra/libevent/libevent-2.1.11-stable/event_tagging.c | 2 +- + extra/libevent/libevent-2.1.11-stable/include/event2/tag.h | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/event_tagging.c b/extra/libevent/libevent-2.1.11-stable/event_tagging.c +index b021e8c..790dff3 100644 +--- a/extra/libevent/libevent-2.1.11-stable/event_tagging.c ++++ b/extra/libevent/libevent-2.1.11-stable/event_tagging.c +@@ -445,7 +445,7 @@ evtag_unmarshal_header(struct evbuffer *evbuf, ev_uint32_t *ptag) + + if (decode_tag_internal(ptag, evbuf, 1 /* dodrain */) == -1) + return (-1); +- if (evtag_decode_int(&len, evbuf) == -1) ++ if (evtag_decode_int(&len, evbuf) == -1 || len > INT_MAX) + return (-1); + + if (evbuffer_get_length(evbuf) < len) +diff --git a/extra/libevent/libevent-2.1.11-stable/include/event2/tag.h b/extra/libevent/libevent-2.1.11-stable/include/event2/tag.h +index 2f73bfc..ac13049 100644 +--- a/extra/libevent/libevent-2.1.11-stable/include/event2/tag.h ++++ b/extra/libevent/libevent-2.1.11-stable/include/event2/tag.h +@@ -64,6 +64,8 @@ void evtag_init(void); + /** + Unmarshals the header and returns the length of the payload + ++ Returns an error if the payload length is above INT_MAX. ++ + @param evbuf the buffer from which to unmarshal data + @param ptag a pointer in which the tag id is being stored + @returns -1 on failure or the number of bytes in the remaining payload. +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63385.patch b/SPECS/mysql/CVE-2026-63385.patch new file mode 100644 index 00000000000..399da1139ef --- /dev/null +++ b/SPECS/mysql/CVE-2026-63385.patch @@ -0,0 +1,46 @@ +From cf97e6ba789c9caf743db3575995bfcc037a9c63 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 09:08:47 -0400 +Subject: [PATCH] http: Reject headers containing CRLF. + +This causes us to reject obfs-fold, which is deprecated in RFC 9112. + +Otherwise, we would have a header injection opportunity for +certain proxy chains. + +Reported by @AsafMeizner + +Part of GHSA-jcwh-pvf2-73p2 + +Tracking: X10. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2.patch +--- + extra/libevent/libevent-2.1.11-stable/http.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c +index 073c8c1..4ea6c25 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http.c ++++ b/extra/libevent/libevent-2.1.11-stable/http.c +@@ -1946,13 +1946,11 @@ evhttp_header_is_valid_value(const char *value) + { + const char *p = value; + +- while ((p = strpbrk(p, "\r\n")) != NULL) { +- /* we really expect only one new line */ +- p += strspn(p, "\r\n"); +- /* we expect a space or tab for continuation */ +- if (*p != ' ' && *p != '\t') +- return (0); ++ if (strpbrk(p, "\r\n") != NULL) { ++ /* Reject any header containing CR or LF. */ ++ return (0); + } ++ + return (1); + } + +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63387.patch b/SPECS/mysql/CVE-2026-63387.patch new file mode 100644 index 00000000000..3280374f89f --- /dev/null +++ b/SPECS/mysql/CVE-2026-63387.patch @@ -0,0 +1,43 @@ +From 91374085713ebfa1d1e5093f45bcfe5689f1eecb Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:08:43 -0400 +Subject: [PATCH] evdns: Fix out-of-bounds write in dnsname_to_labels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This bug would cause the program to write a single 0 byte off the +end of a stack buffer, if the code ever tried to make a DNS response +exactly 2^16 + 1 bytes long, ending with a DNS name. + +Resolves issue GHSA-58rx-7448-jw47. + +This issue was identified by Michał Majchrowicz and +Marcin Wyczechowski, members of the AFINE Team. + +Tracking: X1 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/377b9022c3ac61aa4540b5dc4b70c60bf74c663d.patch +--- + extra/libevent/libevent-2.1.11-stable/evdns.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/evdns.c b/extra/libevent/libevent-2.1.11-stable/evdns.c +index de3848a..b03bea6 100644 +--- a/extra/libevent/libevent-2.1.11-stable/evdns.c ++++ b/extra/libevent/libevent-2.1.11-stable/evdns.c +@@ -1671,7 +1671,10 @@ dnsname_to_labels(u8 *const buf, size_t buf_len, off_t j, + /* the labels must be terminated by a 0. */ + /* It's possible that the name ended in a . */ + /* in which case the zero is already there */ +- if (!j || buf[j-1]) buf[j++] = 0; ++ if ((size_t)j >= buf_len) ++ return -2; ++ if (!j || buf[j-1]) ++ buf[j++] = 0; + return j; + overflow: + return (-2); +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63388.patch b/SPECS/mysql/CVE-2026-63388.patch new file mode 100644 index 00000000000..a6b81610702 --- /dev/null +++ b/SPECS/mysql/CVE-2026-63388.patch @@ -0,0 +1,138 @@ +From 2e497e917a8a0260b59954ae169cad2c942187de Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:33:02 -0400 +Subject: [PATCH] bufferevent: Fix heap out-of-bounds write via + AF_UNIX+http+NDEBUG + +When running an evhttp server over an AF_UNIX socket, +on a copy of libevent compiled with NDEBUG, +it was possible for an attacker to use a crafted AF_UNIX address to +cause a heap overflow when recording the address. + +This issue could also be triggered by direct calls +to the internal function bufferevent_socket_set_conn_address_ +on a copy of libevent compiled with NDEBUG. + +This bug still affected copies of libevent compiled without NDEBUG: +except that under those conditions, it would cause an assertion +failure with an abort() rather than a heap overflow. + +As a fix: + - We check the length of the provided address unconditionally + (regardless of NDEBUG) + - We handle failures caused by the provided address being too long. + - We allocate enough room to store an AF_UNIX address. + +Resolves GHSA-cvq5-vrvr-j338. + +Reported by @mat-mo. + +Tracking: X3 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72.patch +--- + .../bufferevent-internal.h | 11 ++++++----- + .../libevent-2.1.11-stable/bufferevent_sock.c | 17 ++++++++++++----- + extra/libevent/libevent-2.1.11-stable/http.c | 4 +++- + 3 files changed, 21 insertions(+), 11 deletions(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/bufferevent-internal.h b/extra/libevent/libevent-2.1.11-stable/bufferevent-internal.h +index 87ab9ad..3802b59 100644 +--- a/extra/libevent/libevent-2.1.11-stable/bufferevent-internal.h ++++ b/extra/libevent/libevent-2.1.11-stable/bufferevent-internal.h +@@ -34,6 +34,7 @@ extern "C" { + #include "event2/event_struct.h" + #include "evconfig-private.h" + #include "event2/util.h" ++#include "util-internal.h" + #include "defer-internal.h" + #include "evthread-internal.h" + #include "event2/thread.h" +@@ -224,10 +225,10 @@ struct bufferevent_private { + * So we need to save it, just after we connected to remote server, or + * after resolving (to avoid extra dns requests during retrying, since UDP + * is slow) */ +- union { +- struct sockaddr_in6 in6; +- struct sockaddr_in in; +- } conn_address; ++ /* NOTE: it might be nice to use fewer bytes here, but we need to store ++ * sockaddr_un sometimes in order to make AF_UNIX sockets work as expected ++ * with extra/libevent/libevent-2.1.11-stable/http.c. */ ++ struct sockaddr_storage conn_address; + + struct evdns_getaddrinfo_request *dns_request; + }; +@@ -449,7 +450,7 @@ void + bufferevent_socket_set_conn_address_fd_(struct bufferevent *bev, evutil_socket_t fd); + + EVENT2_EXPORT_SYMBOL +-void ++int + bufferevent_socket_set_conn_address_(struct bufferevent *bev, struct sockaddr *addr, size_t addrlen); + + +diff --git a/extra/libevent/libevent-2.1.11-stable/bufferevent_sock.c b/extra/libevent/libevent-2.1.11-stable/bufferevent_sock.c +index f275b02..d244617 100644 +--- a/extra/libevent/libevent-2.1.11-stable/bufferevent_sock.c ++++ b/extra/libevent/libevent-2.1.11-stable/bufferevent_sock.c +@@ -116,13 +116,17 @@ bufferevent_socket_set_conn_address_fd_(struct bufferevent *bev, + getpeername(fd, addr, &len); + } + +-void ++int + bufferevent_socket_set_conn_address_(struct bufferevent *bev, + struct sockaddr *addr, size_t addrlen) + { + struct bufferevent_private *bev_p = BEV_UPCAST(bev); +- EVUTIL_ASSERT(addrlen <= sizeof(bev_p->conn_address)); +- memcpy(&bev_p->conn_address, addr, addrlen); ++ if (addrlen <= sizeof(bev_p->conn_address)) { ++ memcpy(&bev_p->conn_address, addr, addrlen); ++ return 0; ++ } else { ++ return EVUTIL_EAI_FAIL; ++ } + } + + static void +@@ -472,6 +476,11 @@ bufferevent_connect_getaddrinfo_cb(int result, struct evutil_addrinfo *ai, + bufferevent_decref_and_unlock_(bev); + return; + } ++ if (result == 0) { ++ /* XXX use the other addrinfos? */ ++ result = bufferevent_socket_set_conn_address_( ++ bev, ai->ai_addr, (int)ai->ai_addrlen); ++ } + if (result != 0) { + bev_p->dns_error = result; + bufferevent_run_eventcb_(bev, BEV_EVENT_ERROR, 0); +@@ -481,8 +490,6 @@ bufferevent_connect_getaddrinfo_cb(int result, struct evutil_addrinfo *ai, + return; + } + +- /* XXX use the other addrinfos? */ +- bufferevent_socket_set_conn_address_(bev, ai->ai_addr, (int)ai->ai_addrlen); + r = bufferevent_socket_connect(bev, ai->ai_addr, (int)ai->ai_addrlen); + if (r < 0) + bufferevent_run_eventcb_(bev, BEV_EVENT_ERROR, 0); +diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c +index 5331602..073c8c1 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http.c ++++ b/extra/libevent/libevent-2.1.11-stable/http.c +@@ -4261,7 +4261,9 @@ evhttp_get_request_connection( + goto err; + if (bufferevent_disable(evcon->bufev, EV_WRITE)) + goto err; +- bufferevent_socket_set_conn_address_(evcon->bufev, sa, salen); ++ if (bufferevent_socket_set_conn_address_(evcon->bufev, sa, salen)) { ++ goto err; ++ } + + return (evcon); + +-- +2.45.4 + diff --git a/SPECS/mysql/mysql.spec b/SPECS/mysql/mysql.spec index f4e745be819..bfc70cfdc0c 100644 --- a/SPECS/mysql/mysql.spec +++ b/SPECS/mysql/mysql.spec @@ -3,7 +3,7 @@ Summary: MySQL. Name: mysql Version: 8.0.46 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2 with exceptions AND LGPLv2 AND BSD Vendor: Microsoft Corporation Distribution: Azure Linux @@ -18,8 +18,16 @@ Patch3: CVE-2025-62813.patch Patch4: CVE-2025-0838.patch # Patch to skip failing ptests on x86 architecture %ifarch x86_64 -Patch5: skip-failing-ptests.patch +Patch5: skip-failing-ptests.patch %endif +Patch6: CVE-2026-63379.patch +Patch7: CVE-2026-63381.patch +Patch8: CVE-2026-63382.patch +Patch9: CVE-2026-63383.patch +Patch10: CVE-2026-63384.patch +Patch11: CVE-2026-63385.patch +Patch12: CVE-2026-63387.patch +Patch13: CVE-2026-63388.patch BuildRequires: cmake BuildRequires: libtirpc-devel @@ -115,6 +123,9 @@ sudo -u test ctest --exclude-regex merge_large_tests || { cat Testing/Temporary/ %{_libdir}/pkgconfig/mysqlclient.pc %changelog +* Tue Aug 25 2026 Azure Linux Security Servicing Account - 8.0.46-2 +- Patch for CVE-2026-63388, CVE-2026-63387, CVE-2026-63385, CVE-2026-63384, CVE-2026-63383, CVE-2026-63382, CVE-2026-63381, CVE-2026-63379 + * Wed Apr 22 2026 Kanishk Bansal - 8.0.46-1 - Upgrade to fix CVE-2026-6409, CVE-2026-34278, CVE-2026-35239, CVE-2026-21998, CVE-2026-35237, CVE-2026-22009, CVE-2026-34270, CVE-2026-34293, CVE-2026-34271, CVE-2026-22002, CVE-2026-22017,