diff --git a/SPECS/erlang/CVE-2026-53422.patch b/SPECS/erlang/CVE-2026-53422.patch new file mode 100644 index 00000000000..e8c5ed21206 --- /dev/null +++ b/SPECS/erlang/CVE-2026-53422.patch @@ -0,0 +1,54 @@ +From a43049b60752ab652f93a7b1dfa106506648f775 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20W=C4=85sowski?= +Date: Thu, 25 Jun 2026 13:53:00 +0200 +Subject: [PATCH] Fix realpath path existence oracle + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94.patch +--- + lib/ssh/src/ssh_sftpd.erl | 27 ++++++++++++++++----------- + 1 file changed, 16 insertions(+), 11 deletions(-) + +diff --git a/lib/ssh/src/ssh_sftpd.erl b/lib/ssh/src/ssh_sftpd.erl +index ea29fb7..52b2cda 100644 +--- a/lib/ssh/src/ssh_sftpd.erl ++++ b/lib/ssh/src/ssh_sftpd.erl +@@ -274,19 +274,24 @@ handle_op(?SSH_FXP_INIT, Version, B, State) when is_binary(B) -> + ssh_xfer:xf_send_reply(XF1, ?SSH_FXP_VERSION, <>), + State#state{xf = XF1}; + handle_op(?SSH_FXP_REALPATH, ReqId, +- <>, +- State0) -> ++ <>, ++ State0) -> + RelPath = relate_file_name(RPath, State0, _Canonicalize=false), +- {Res, State} = resolve_symlinks(RelPath, State0), ++ {Res, #state{root = Root} = State} = resolve_symlinks(RelPath, State0), + case Res of +- {ok, AbsPath} -> +- NewAbsPath = chroot_filename(AbsPath, State), +- XF = State#state.xf, +- Attr = #ssh_xfer_attr{type=directory}, +- ssh_xfer:xf_send_name(XF, ReqId, NewAbsPath, Attr), +- State; +- {error, _} = Error -> +- send_status(Error, ReqId, State) ++ {ok, AbsPath} -> ++ case Root =:= "" orelse is_within_root(Root, AbsPath) of ++ true -> ++ NewAbsPath = chroot_filename(AbsPath, State), ++ XF = State#state.xf, ++ Attr = #ssh_xfer_attr{type=directory}, ++ ssh_xfer:xf_send_name(XF, ReqId, NewAbsPath, Attr), ++ State; ++ false -> ++ send_status({error, enoent}, ReqId, State) ++ end; ++ {error, _} = Error -> ++ send_status(Error, ReqId, State) + end; + handle_op(?SSH_FXP_OPENDIR, ReqId, + <>, +-- +2.45.4 + diff --git a/SPECS/erlang/CVE-2026-55950.patch b/SPECS/erlang/CVE-2026-55950.patch new file mode 100644 index 00000000000..3fe5ba9775e --- /dev/null +++ b/SPECS/erlang/CVE-2026-55950.patch @@ -0,0 +1,38 @@ +From 5d8315fcefad315ba733e6fcfdbf104807cac439 Mon Sep 17 00:00:00 2001 +From: Ingela Anderton Andin +Date: Thu, 25 Jun 2026 14:11:06 +0200 +Subject: [PATCH] ssl: Fix DTLS race condition + +Could be used to DoS attack DTLS servers. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/erlang/otp/commit/e44d2bf01c4473ef2ea7f09e3523cf96de6e4a04.patch +--- + lib/ssl/src/dtls_packet_demux.erl | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/lib/ssl/src/dtls_packet_demux.erl b/lib/ssl/src/dtls_packet_demux.erl +index 3e9ce07..7043f2e 100644 +--- a/lib/ssl/src/dtls_packet_demux.erl ++++ b/lib/ssl/src/dtls_packet_demux.erl +@@ -160,7 +160,7 @@ handle_call({new_connection, Old, _Pid}, _, + case kv_lookup(Old, MsgQs0) of + {value, OldQueue} -> + MsgQs1 = kv_delete(Old, MsgQs0), +- MsgQs = kv_insert({old,Old}, OldQueue, MsgQs1), ++ MsgQs = kv_enter({old,Old}, OldQueue, MsgQs1), + {reply, true, State#state{dtls_msq_queues = MsgQs}}; + none -> + %% Already set as old +@@ -363,6 +363,8 @@ kv_lookup(Key, Store) -> + gb_trees:lookup(Key, Store). + kv_insert(Key, Value, Store) -> + gb_trees:insert(Key, Value, Store). ++kv_enter(Key, Value, Store) -> ++ gb_trees:enter(Key, Value, Store). + kv_get(Key, Store) -> + gb_trees:get(Key, Store). + kv_delete(Key, Store) -> +-- +2.45.4 + diff --git a/SPECS/erlang/CVE-2026-59250.patch b/SPECS/erlang/CVE-2026-59250.patch new file mode 100644 index 00000000000..a67a7e608ff --- /dev/null +++ b/SPECS/erlang/CVE-2026-59250.patch @@ -0,0 +1,63 @@ +From e00c418203565bf53930f1058a6bbbd272ce15bf Mon Sep 17 00:00:00 2001 +From: Jakub Witczak +Date: Tue, 30 Jun 2026 19:37:37 +0200 +Subject: [PATCH] megaco: fix sprintf buffer overflow in flex scanner + +Replace all sprintf(dataP->error_msg, ...) calls with +snprintf(dataP->error_msg, sizeof(dataP->error_msg), ...) in +mfs_load_property_groups and mfs_alloc_failed. + +A property name longer than 452 bytes in a Local/Remote descriptor +causes sprintf to write past the fixed 512-byte error_msg buffer, +corrupting adjacent struct fields (text_buf, term_spec pointers). +On FORTIFY_SOURCE-enabled systems this results in SIGABRT; without +FORTIFY the corrupted pointers are later passed to FREE(), giving +an arbitrary-free primitive. + +The overflow is reachable pre-auth via a single crafted H.248 +message when the flex scanner is enabled ({scanner, flex}). + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/erlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4f.patch +--- + lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src b/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src +index 50cf5f7..f0895ce 100644 +--- a/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src ++++ b/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src +@@ -821,7 +821,7 @@ static void mfs_alloc_failed(MfsErlDrvData* dataP, char* msg, int sz) + + int msg_len = strlen(msg); + if ((10 + 10 + msg_len) < sizeof(dataP->error_msg)) { +- if (0 >= sprintf(dataP->error_msg, "%s of %d bytes", msg, sz)) { ++ if (0 >= snprintf(dataP->error_msg, sizeof(dataP->error_msg), "%s of %d bytes", msg, sz)) { + mfs_fatal_error(dataP, msg); + } + } else { +@@ -1156,8 +1156,8 @@ static void mfs_load_property_groups(MfsErlDrvData* dataP) + * }). + */ + +- if (0 >= sprintf(dataP->error_msg, "%s %s %s", +- PG_ERR_PRE, PG_ERR1, name)) { ++ if (0 >= snprintf(dataP->error_msg, sizeof(dataP->error_msg), ++ "%s %s %s", PG_ERR_PRE, PG_ERR1, name)) { + mfs_fatal_error(dataP, PG_ERR1); + } + dataP->error = TRUE; +@@ -1237,8 +1237,8 @@ static void mfs_load_property_groups(MfsErlDrvData* dataP) + "property parm name not found when " + "nameStart = %d\n", nameStart) ); + +- if (0 >= sprintf(dataP->error_msg, "%s %s (name start at %d)", +- PG_ERR_PRE, PG_ERR2, nameStart)) { ++ if (0 >= snprintf(dataP->error_msg, sizeof(dataP->error_msg), ++ "%s %s (name start at %d)", PG_ERR_PRE, PG_ERR2, nameStart)) { + mfs_fatal_error(dataP, PG_ERR2); + } + +-- +2.45.4 + diff --git a/SPECS/erlang/erlang.spec b/SPECS/erlang/erlang.spec index bd1f364ab31..38ee548fd8d 100644 --- a/SPECS/erlang/erlang.spec +++ b/SPECS/erlang/erlang.spec @@ -2,7 +2,7 @@ Summary: erlang Name: erlang Version: 26.2.5.21 -Release: 3%{?dist} +Release: 4%{?dist} License: Apache-2.0 Vendor: Microsoft Corporation Distribution: Azure Linux @@ -20,6 +20,9 @@ Patch7: CVE-2026-55737.patch Patch8: CVE-2026-55953.patch Patch9: CVE-2026-58227.patch Patch10: CVE-2026-59251.patch +Patch11: CVE-2026-53422.patch +Patch12: CVE-2026-55950.patch +Patch13: CVE-2026-59250.patch BuildRequires: ncurses-devel BuildRequires: openssl-devel BuildRequires: unixODBC-devel @@ -64,6 +67,9 @@ export ERL_TOP=`pwd` %{_libdir}/erlang/* %changelog +* Thu Aug 13 2026 Azure Linux Security Servicing Account - 26.2.5.21-4 +- Patch for CVE-2026-59250, CVE-2026-55950, CVE-2026-53422 + * Fri Jul 31 2026 Azure Linux Security Servicing Account - 26.2.5.21-3 - Patch for CVE-2026-59251, CVE-2026-58227, CVE-2026-55953, CVE-2026-55737, CVE-2026-42792