From 829dbbc5e45ec9d7a9ffdf41fd74a9ac3b5d253a Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Wed, 27 May 2026 12:23:39 +0000 Subject: [PATCH 1/5] Patch dasel for CVE-2026-42506 --- SPECS/dasel/CVE-2026-42506.patch | 76 ++++++++++++++++++++++++++++++++ SPECS/dasel/dasel.spec | 6 ++- 2 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 SPECS/dasel/CVE-2026-42506.patch diff --git a/SPECS/dasel/CVE-2026-42506.patch b/SPECS/dasel/CVE-2026-42506.patch new file mode 100644 index 00000000000..783c7f88941 --- /dev/null +++ b/SPECS/dasel/CVE-2026-42506.patch @@ -0,0 +1,76 @@ +From ecb9114eae8ee2ca5a5eedcbcf02f5edaef93560 Mon Sep 17 00:00:00 2001 +From: Roland Shoemaker +Date: Fri, 8 May 2026 11:58:29 -0700 +Subject: [PATCH] html: properly check namespace in "in body" any other end tag + +When processing "any other end tag" in the "in body" insertion mode, +when searching for a matching start tag, properly check that said tag is +in the HTML namespace. + +Thanks to ensy for reporting this issue. + +Fixes CVE-2026-42506 + +Change-Id: Ia05867b3d8f8df69f7e9410a85d126fe0b092875 +Reviewed-on: https://go-review.googlesource.com/c/net/+/781700 +Auto-Submit: Gopher Robot +TryBot-Bypass: Roland Shoemaker +Reviewed-by: Nicholas Husin +Reviewed-by: Nicholas Husin +Reviewed-by: Neal Patel +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/golang/net/commit/0dc5b7a5f81d7155ade6d5e9db35992998679932.patch +--- + vendor/golang.org/x/net/html/parse.go | 4 +--- + .../x/net/html/testdata/go/in_body_end.dat | 17 +++++++++++++++++ + 2 files changed, 18 insertions(+), 3 deletions(-) + create mode 100644 vendor/golang.org/x/net/html/testdata/go/in_body_end.dat + +diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go +index 4d12a1c..3392845 100644 +--- a/vendor/golang.org/x/net/html/parse.go ++++ b/vendor/golang.org/x/net/html/parse.go +@@ -1368,8 +1368,6 @@ func (p *parser) inBodyEndTagFormatting(tagAtom a.Atom, tagName string) { + } + + // inBodyEndTagOther performs the "any other end tag" algorithm for inBodyIM. +-// "Any other end tag" handling from 12.2.6.5 The rules for parsing tokens in foreign content +-// https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inforeign + func (p *parser) inBodyEndTagOther(tagAtom a.Atom, tagName string) { + for i := len(p.oe) - 1; i >= 0; i-- { + // Two element nodes have the same tag if they have the same Data (a +@@ -1379,7 +1377,7 @@ func (p *parser) inBodyEndTagOther(tagAtom a.Atom, tagName string) { + // Uncommon (custom) tags get a zero DataAtom. + // + // The if condition here is equivalent to (p.oe[i].Data == tagName). +- if (p.oe[i].DataAtom == tagAtom) && ++ if p.oe[i].Namespace == "" && (p.oe[i].DataAtom == tagAtom) && + ((tagAtom != 0) || (p.oe[i].Data == tagName)) { + p.oe = p.oe[:i] + break +diff --git a/vendor/golang.org/x/net/html/testdata/go/in_body_end.dat b/vendor/golang.org/x/net/html/testdata/go/in_body_end.dat +new file mode 100644 +index 0000000..5e14b34 +--- /dev/null ++++ b/vendor/golang.org/x/net/html/testdata/go/in_body_end.dat +@@ -0,0 +1,17 @@ ++#data ++--> ++#errors ++#document ++| ++| ++| ++| ++| ++| ++| ++|