From 89b7d86bdfbe84ea19aecd1afd5e1dcc0e5993ac Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Fri, 14 Aug 2026 21:56:04 +0000 Subject: [PATCH] Patch cert-manager for CVE-2026-73500 --- SPECS/cert-manager/CVE-2026-73500.patch | 48 +++++++++++++++++++++++++ SPECS/cert-manager/cert-manager.spec | 6 +++- 2 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 SPECS/cert-manager/CVE-2026-73500.patch diff --git a/SPECS/cert-manager/CVE-2026-73500.patch b/SPECS/cert-manager/CVE-2026-73500.patch new file mode 100644 index 00000000000..8ea177139e3 --- /dev/null +++ b/SPECS/cert-manager/CVE-2026-73500.patch @@ -0,0 +1,48 @@ +From 5e0de5507837ccea1e83327440b3039c56095aa7 Mon Sep 17 00:00:00 2001 +From: Benjamin Wang +Date: Tue, 21 Jul 2026 10:16:47 +0100 +Subject: [PATCH] Set a tlsHandshakeTimeout for tlsListener + +Signed-off-by: Benjamin Wang +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3.patch +--- + .../etcd/client/pkg/v3/transport/listener_tls.go | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/cmd/controller/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go b/cmd/controller/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go +index 6f16009..7e009f1 100644 +--- a/cmd/controller/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go ++++ b/cmd/controller/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go +@@ -23,6 +23,12 @@ import ( + "net" + "strings" + "sync" ++ "time" ++) ++ ++const ( ++ // tlsHandshakeTimeout bounds how long a single TLS handshake may block. ++ tlsHandshakeTimeout = 10 * time.Second + ) + + // tlsListener overrides a TLS listener so it will reject client +@@ -143,6 +149,7 @@ func (l *tlsListener) acceptLoop() { + }() + + tlsConn := conn.(*tls.Conn) ++ _ = tlsConn.SetDeadline(time.Now().Add(tlsHandshakeTimeout)) + herr := tlsConn.Handshake() + pendingMu.Lock() + delete(pending, conn) +@@ -152,6 +159,7 @@ func (l *tlsListener) acceptLoop() { + l.handshakeFailure(tlsConn, herr) + return + } ++ _ = tlsConn.SetDeadline(time.Time{}) + if err := l.check(ctx, tlsConn); err != nil { + l.handshakeFailure(tlsConn, err) + return +-- +2.45.4 + diff --git a/SPECS/cert-manager/cert-manager.spec b/SPECS/cert-manager/cert-manager.spec index 8396105911f..571ba13d939 100644 --- a/SPECS/cert-manager/cert-manager.spec +++ b/SPECS/cert-manager/cert-manager.spec @@ -1,7 +1,7 @@ Summary: Automatically provision and manage TLS certificates in Kubernetes Name: cert-manager Version: 1.12.15 -Release: 11%{?dist} +Release: 12%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Azure Linux @@ -40,6 +40,7 @@ Patch23: CVE-2026-42502.patch Patch24: CVE-2026-33814.patch Patch25: CVE-2026-56852.patch Patch26: CVE-2026-63308.patch +Patch27: CVE-2026-73500.patch BuildRequires: golang Requires: %{name}-acmesolver @@ -131,6 +132,9 @@ install -D -m0755 bin/webhook %{buildroot}%{_bindir}/ %{_bindir}/webhook %changelog +* Fri Aug 14 2026 Azure Linux Security Servicing Account - 1.12.15-12 +- Patch for CVE-2026-73500 + * Tue Jul 28 2026 Azure Linux Security Servicing Account - 1.12.15-11 - Patch for CVE-2026-63308