diff --git a/cheat b/cheat index 2765659..e8f7ed9 160000 --- a/cheat +++ b/cheat @@ -1 +1 @@ -Subproject commit 27656594fe76342ffab2397eac3fd0647b9227d81db63be3628c8731d4816d59 +Subproject commit e8f7ed922753c65599df4a6af4947eb1ae1d40cb5fe85f992575c3ea47d368f8 diff --git a/patchinfo.20251217091639760898.93181000773252/_patchinfo b/patchinfo.20251217091639760898.93181000773252/_patchinfo new file mode 100644 index 0000000..1f5e58d --- /dev/null +++ b/patchinfo.20251217091639760898.93181000773252/_patchinfo @@ -0,0 +1,65 @@ + + CVE-2025-21614 go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies + VUL-0: CVE-2025-21613: cheat: github.com/go-git/go-git/v5: argument injection via the URL field + VUL-0: CVE-2025-58181: TRACKERBUG: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption + VUL-0: CVE-2025-21613: TRACKERBUG: github.com/go-git/go-git/v5: argument injection via the URL field + VUL-0: CVE-2025-47913: TRACKERBUG: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or + VUL-0: CVE-2025-58181: cheat: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption + VUL-0: CVE-2025-47914: TRACKERBUG: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read + VUL-0: CVE-2025-22870: TRACKERBUG: golang.org/net/http, golang.org/x/net/proxy, golang.org/x/net/http/httpproxy: proxy bypass using IPv6 zone IDs + VUL-0: CVE-2023-48795: openssh: prefix truncation breaking ssh channel integrity aka Terrapin Attack + VUL-0: CVE-2025-47914: cheat: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read + VUL-0: CVE-2025-47913: cheat: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request + VUL-0: CVE-2025-22869: TRACKERBUG: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh + witekbedyk + important + security + Security update for cheat + This update for cheat fixes the following issues: + +- Security: + * CVE-2025-47913: Fix client process termination (bsc#1253593) + * CVE-2025-58181: Fix potential unbounded memory consumption (bsc#1253922) + * CVE-2025-47914: Fix panic due to an out of bounds read (bsc#1254051) + * Replace golang.org/x/crypto=golang.org/x/crypto@v0.45.0 + * Replace golang.org/x/net=golang.org/x/net@v0.47.0 + * Replace golang.org/x/sys=golang.org/x/sys@v0.38.0 + +- Packaging improvements: + * Drop Requires: golang-packaging. The recommended Go toolchain + dependency expression is BuildRequires: golang(API) >= 1.x or + optionally the metapackage BuildRequires: go + * Use BuildRequires: golang(API) >= 1.19 matching go.mod + * Build PIE with pattern that may become recommended procedure: + %%ifnarch ppc64 GOFLAGS="-buildmode=pie" %%endif go build + A go toolchain buildmode default config would be preferable + but none exist at this time. + * Drop mod=vendor, go1.14+ will detect vendor dir and auto-enable + * Remove go build -o output binary location and name. Default + binary has the same name as package of func main() and is + placed in the top level of the build directory. + * Add basic %check to execute binary --help + +- Packaging improvements: + * Service go_modules replace dependencies with CVEs + * Replace github.com/cloudflare/circl=github.com/cloudflare/circl@v1.6.1 + Fix GO-2025-3754 GHSA-2x5j-vhc8-9cwm + * Replace golang.org/x/net=golang.org/x/net@v0.36.0 + Fixes GO-2025-3503 CVE-2025-22870 + * Replace golang.org/x/crypto=golang.org/x/crypto@v0.35.0 + Fixes GO-2023-2402 CVE-2023-48795 GHSA-45x7-px36-x8w8 + Fixes GO-2025-3487 CVE-2025-22869 + * Replace github.com/go-git/go-git/v5=github.com/go-git/go-git/v5@v5.13.0 + Fixes GO-2025-3367 CVE-2025-21614 GHSA-r9px-m959-cxf4 + Fixes GO-2025-3368 CVE-2025-21613 GHSA-v725-9546-7q7m + * Service tar_scm set mode manual from disabled + * Service tar_scm create archive from git so we can exclude + vendor directory upstream committed to git. Committed vendor + directory contents have build issues even after go mod tidy. + * Service tar_scm exclude dir vendor + * Service set_version set mode manual from disabled + * Service set_version remove param basename not needed + + cheat + +