diff --git a/SPECS/azurelinux-image-tools/CVE-2026-27141.patch b/SPECS/azurelinux-image-tools/CVE-2026-27141.patch deleted file mode 100644 index 0df16c8ead2..00000000000 --- a/SPECS/azurelinux-image-tools/CVE-2026-27141.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 09313f6d249a0c11eeb3ce16578033bdd6602fcb Mon Sep 17 00:00:00 2001 -From: Konnyaku -Date: Tue, 17 Feb 2026 21:23:54 +0800 -Subject: [PATCH] http2: fix nil panic in typeFrameParser for unassigned frame - types - -The addition of FramePriorityUpdate (0x10) in RFC 9218 introduced a gap -in the frameParsers array indices (0x0a-0x0f). These indices were -initialized to nil, causing a panic when typeFrameParser accessed them -for unassigned frame types (e.g., ALTSVC 0x0a). - -This change adds a nil check in typeFrameParser to safely fallback to -parseUnknownFrame for these unassigned types, preventing the crash. - -Fixes golang/go#77652 - -Change-Id: I14d7ad85afc1eafabc46417a9fff10f9e0a22446 -Reviewed-on: https://go-review.googlesource.com/c/net/+/746180 -LUCI-TryBot-Result: Go LUCI -Reviewed-by: Damien Neil -Auto-Submit: Damien Neil -Reviewed-by: Mark Freeman -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/golang/net/commit/19f580fd686a6bb31d4af15febe789827169bc26.patch ---- - vendor/golang.org/x/net/http2/frame.go | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/vendor/golang.org/x/net/http2/frame.go b/vendor/golang.org/x/net/http2/frame.go -index 9a4bd12..6e393e9 100644 ---- a/vendor/golang.org/x/net/http2/frame.go -+++ b/vendor/golang.org/x/net/http2/frame.go -@@ -139,7 +139,9 @@ var frameParsers = [...]frameParser{ - - func typeFrameParser(t FrameType) frameParser { - if int(t) < len(frameParsers) { -- return frameParsers[t] -+ if f := frameParsers[t]; f != nil { -+ return f -+ } - } - return parseUnknownFrame - } --- -2.45.4 - diff --git a/SPECS/azurelinux-image-tools/azurelinux-image-tools.signatures.json b/SPECS/azurelinux-image-tools/azurelinux-image-tools.signatures.json index d83beb5f5eb..223e193e3f6 100644 --- a/SPECS/azurelinux-image-tools/azurelinux-image-tools.signatures.json +++ b/SPECS/azurelinux-image-tools/azurelinux-image-tools.signatures.json @@ -1,6 +1,6 @@ { - "Signatures": { - "azurelinux-image-tools-1.2.0.tar.gz": "7bfc2abf2b8a23bdcc3828e14c830f6a3f02a8c6fce9f9876e2a39a79ec74eda", - "azurelinux-image-tools-1.2.0-vendor.tar.gz": "b46fee0371838f1a3a3f1148b14d08a17aaef33789ecd481c9c7dab0bf496f17" - } -} \ No newline at end of file + "Signatures": { + "azurelinux-image-tools-1.3.0-vendor.tar.gz": "0f8cde7b29cd24a5b8f695e9bf3f836f79d7d7ad2b02696de776843d071de291", + "azurelinux-image-tools-1.3.0.tar.gz": "a217ac57e88f07da52fe822d8423fa842901e5b9d9c1baaa2592198aa9b7a165" + } +} diff --git a/SPECS/azurelinux-image-tools/azurelinux-image-tools.spec b/SPECS/azurelinux-image-tools/azurelinux-image-tools.spec index 3cad0890004..29f3e77d97a 100644 --- a/SPECS/azurelinux-image-tools/azurelinux-image-tools.spec +++ b/SPECS/azurelinux-image-tools/azurelinux-image-tools.spec @@ -2,8 +2,8 @@ Summary: Azure Linux Image Tools Name: azurelinux-image-tools -Version: 1.2.0 -Release: 2%{?dist} +Version: 1.3.0 +Release: 1%{?dist} License: MIT URL: https://github.com/microsoft/azure-linux-image-tools/ Group: Applications/System @@ -15,8 +15,7 @@ Source0: https://github.com/microsoft/azure-linux-image-tools/archive/ref # Use generate_source_tarball.sh script with the package version to build this tarball. # Source1: %{name}-%{version}-vendor.tar.gz -Patch0: CVE-2026-27141.patch -BuildRequires: golang < 1.25 +BuildRequires: golang >= 1.25 BuildRequires: systemd-udev Requires: %{name}-imagecustomizer = %{version}-%{release} @@ -74,6 +73,7 @@ The Azure Linux OS Modifier is a tool that can modify an OS. %build export GOPATH=%{our_gopath} export GOFLAGS="-mod=vendor" +export GOEXPERIMENT=ms_nocgo_opensslcrypto make -C toolkit go-imagecustomizer REBUILD_TOOLS=y SKIP_LICENSE_SCAN=y IMAGE_CUSTOMIZER_VERSION_PREVIEW= make -C toolkit go-osmodifier REBUILD_TOOLS=y SKIP_LICENSE_SCAN=y @@ -112,6 +112,9 @@ go test -C toolkit/tools ./... %{_bindir}/osmodifier %changelog +* Tue Apr 28 2026 Aditya Singh - 1.3.0-1 +- Upgrade to version 1.3.0 which includes fixes for CVE-2026-27141, CVE-2026-29181 and CVE-2026-39882 + * Thu Mar 05 2026 Azure Linux Security Servicing Account - 1.2.0-2 - Patch for CVE-2026-27141 diff --git a/cgmanifest.json b/cgmanifest.json index 0337e51946a..a42ff463f15 100644 --- a/cgmanifest.json +++ b/cgmanifest.json @@ -915,8 +915,8 @@ "type": "other", "other": { "name": "azurelinux-image-tools", - "version": "1.2.0", - "downloadUrl": "https://github.com/microsoft/azure-linux-image-tools/archive/refs/tags/v1.2.0.tar.gz" + "version": "1.3.0", + "downloadUrl": "https://github.com/microsoft/azure-linux-image-tools/archive/refs/tags/v1.3.0.tar.gz" } } },