[AutoPR- Security] Patch erlang for CVE-2026-59250, CVE-2026-55950, CVE-2026-53422 [HIGH]

SPECS/erlang/CVE-2026-53422.patch

@@ -0,0 +1,54 @@
+From a43049b60752ab652f93a7b1dfa106506648f775 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20W=C4=85sowski?= <michal@erlang.org>
+Date: Thu, 25 Jun 2026 13:53:00 +0200
+Subject: [PATCH] Fix realpath path existence oracle
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/erlang/otp/commit/86622cfaacf57a02c7645d1999f946846b504c94.patch
+---
+ lib/ssh/src/ssh_sftpd.erl | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/lib/ssh/src/ssh_sftpd.erl b/lib/ssh/src/ssh_sftpd.erl
+index ea29fb7..52b2cda 100644
+--- a/lib/ssh/src/ssh_sftpd.erl
++++ b/lib/ssh/src/ssh_sftpd.erl
+@@ -274,19 +274,24 @@ handle_op(?SSH_FXP_INIT, Version, B, State) when is_binary(B) ->
+     ssh_xfer:xf_send_reply(XF1, ?SSH_FXP_VERSION, <<?UINT32(Vsn)>>),
+     State#state{xf = XF1};
+ handle_op(?SSH_FXP_REALPATH, ReqId,
+-	  <<?UINT32(RLen), RPath:RLen/binary>>,
+-	  State0) ->
++          <<?UINT32(RLen), RPath:RLen/binary>>,
++          State0) ->
+     RelPath = relate_file_name(RPath, State0, _Canonicalize=false),
+-    {Res, State} = resolve_symlinks(RelPath, State0),
++    {Res, #state{root = Root} = State} = resolve_symlinks(RelPath, State0),
+     case Res of
+-	{ok, AbsPath} ->
+-	    NewAbsPath = chroot_filename(AbsPath, State),
+-	    XF = State#state.xf,
+-	    Attr = #ssh_xfer_attr{type=directory},
+-	    ssh_xfer:xf_send_name(XF, ReqId, NewAbsPath, Attr),
+-	    State;
+-	{error, _} = Error ->
+-	    send_status(Error, ReqId, State)
++        {ok, AbsPath} ->
++            case Root =:= "" orelse is_within_root(Root, AbsPath) of
++                true ->
++                    NewAbsPath = chroot_filename(AbsPath, State),
++                    XF = State#state.xf,
++                    Attr = #ssh_xfer_attr{type=directory},
++                    ssh_xfer:xf_send_name(XF, ReqId, NewAbsPath, Attr),
++                    State;
++                false ->
++                    send_status({error, enoent}, ReqId, State)
++            end;
++        {error, _} = Error ->
++            send_status(Error, ReqId, State)
+     end;
+ handle_op(?SSH_FXP_OPENDIR, ReqId,
+ 	 <<?UINT32(RLen), RPath:RLen/binary>>,
+-- 
+2.45.4
+

SPECS/erlang/CVE-2026-55950.patch

@@ -0,0 +1,38 @@
+From 5d8315fcefad315ba733e6fcfdbf104807cac439 Mon Sep 17 00:00:00 2001
+From: Ingela Anderton Andin <ingela@erlang.org>
+Date: Thu, 25 Jun 2026 14:11:06 +0200
+Subject: [PATCH] ssl: Fix DTLS race condition
+
+Could be used to DoS attack DTLS servers.
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/erlang/otp/commit/e44d2bf01c4473ef2ea7f09e3523cf96de6e4a04.patch
+---
+ lib/ssl/src/dtls_packet_demux.erl | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/ssl/src/dtls_packet_demux.erl b/lib/ssl/src/dtls_packet_demux.erl
+index 3e9ce07..7043f2e 100644
+--- a/lib/ssl/src/dtls_packet_demux.erl
++++ b/lib/ssl/src/dtls_packet_demux.erl
+@@ -160,7 +160,7 @@ handle_call({new_connection, Old, _Pid}, _,
+             case kv_lookup(Old, MsgQs0) of
+                 {value, OldQueue} ->
+                     MsgQs1 = kv_delete(Old, MsgQs0),
+-                    MsgQs = kv_insert({old,Old}, OldQueue, MsgQs1),
++                    MsgQs = kv_enter({old,Old}, OldQueue, MsgQs1),
+                     {reply, true, State#state{dtls_msq_queues = MsgQs}};
+                 none ->
+                     %% Already set as old
+@@ -363,6 +363,8 @@ kv_lookup(Key, Store) ->
+     gb_trees:lookup(Key, Store).
+ kv_insert(Key, Value, Store) ->
+     gb_trees:insert(Key, Value, Store).
++kv_enter(Key, Value, Store) ->
++    gb_trees:enter(Key, Value, Store).
+ kv_get(Key, Store) ->
+     gb_trees:get(Key, Store).
+ kv_delete(Key, Store) ->
+-- 
+2.45.4
+

SPECS/erlang/CVE-2026-59250.patch

@@ -0,0 +1,63 @@
+From e00c418203565bf53930f1058a6bbbd272ce15bf Mon Sep 17 00:00:00 2001
+From: Jakub Witczak <kuba@erlang.org>
+Date: Tue, 30 Jun 2026 19:37:37 +0200
+Subject: [PATCH] megaco: fix sprintf buffer overflow in flex scanner
+
+Replace all sprintf(dataP->error_msg, ...) calls with
+snprintf(dataP->error_msg, sizeof(dataP->error_msg), ...) in
+mfs_load_property_groups and mfs_alloc_failed.
+
+A property name longer than 452 bytes in a Local/Remote descriptor
+causes sprintf to write past the fixed 512-byte error_msg buffer,
+corrupting adjacent struct fields (text_buf, term_spec pointers).
+On FORTIFY_SOURCE-enabled systems this results in SIGABRT; without
+FORTIFY the corrupted pointers are later passed to FREE(), giving
+an arbitrary-free primitive.
+
+The overflow is reachable pre-auth via a single crafted H.248
+message when the flex scanner is enabled ({scanner, flex}).
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/erlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4f.patch
+---
+ lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src b/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src
+index 50cf5f7..f0895ce 100644
+--- a/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src
++++ b/lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src
+@@ -821,7 +821,7 @@ static void mfs_alloc_failed(MfsErlDrvData* dataP, char* msg, int sz)
+
+     int msg_len = strlen(msg);
+     if ((10 + 10 + msg_len) < sizeof(dataP->error_msg)) {
+-      if (0 >= sprintf(dataP->error_msg, "%s of %d bytes", msg, sz)) {
++      if (0 >= snprintf(dataP->error_msg, sizeof(dataP->error_msg), "%s of %d bytes", msg, sz)) {
+ 	mfs_fatal_error(dataP, msg);
+       }
+     } else {
+@@ -1156,8 +1156,8 @@ static void mfs_load_property_groups(MfsErlDrvData* dataP)
+              *          }).
+              */ 
+
+-            if (0 >= sprintf(dataP->error_msg, "%s %s %s", 
+-                             PG_ERR_PRE, PG_ERR1, name)) {
++            if (0 >= snprintf(dataP->error_msg, sizeof(dataP->error_msg),
++                              "%s %s %s", PG_ERR_PRE, PG_ERR1, name)) {
+               mfs_fatal_error(dataP, PG_ERR1);
+             }
+             dataP->error = TRUE;
+@@ -1237,8 +1237,8 @@ static void mfs_load_property_groups(MfsErlDrvData* dataP)
+               "property parm name not found when "
+               "nameStart = %d\n", nameStart) );
+
+-        if (0 >= sprintf(dataP->error_msg, "%s %s (name start at %d)", 
+-                         PG_ERR_PRE, PG_ERR2, nameStart)) {
++        if (0 >= snprintf(dataP->error_msg, sizeof(dataP->error_msg),
++                          "%s %s (name start at %d)", PG_ERR_PRE, PG_ERR2, nameStart)) {
+           mfs_fatal_error(dataP, PG_ERR2);
+         }
+
+-- 
+2.45.4
+

SPECS/erlang/erlang.spec

@@ -2,7 +2,7 @@
 Summary:        erlang
 Name:           erlang
 Version:        26.2.5.21
-Release:        3%{?dist}
+Release:        4%{?dist}
 License:        Apache-2.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -20,6 +20,9 @@ Patch7:         CVE-2026-55737.patch
 Patch8:         CVE-2026-55953.patch
 Patch9:         CVE-2026-58227.patch
 Patch10:        CVE-2026-59251.patch
+Patch11:        CVE-2026-53422.patch
+Patch12:        CVE-2026-55950.patch
+Patch13:        CVE-2026-59250.patch
 BuildRequires:  ncurses-devel
 BuildRequires:  openssl-devel
 BuildRequires:  unixODBC-devel
@@ -64,6 +67,9 @@ export ERL_TOP=`pwd`
 %{_libdir}/erlang/*
 
 %changelog
+* Thu Aug 13 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 26.2.5.21-4
+- Patch for CVE-2026-59250, CVE-2026-55950, CVE-2026-53422
+
 * Fri Jul 31 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 26.2.5.21-3
 - Patch for CVE-2026-59251, CVE-2026-58227, CVE-2026-55953, CVE-2026-55737, CVE-2026-42792