Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package google-osconfig-agent for
openSUSE:Factory checked in at 2026-07-21 23:01:31
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/google-osconfig-agent (Old)
and /work/SRC/openSUSE:Factory/.google-osconfig-agent.new.24530 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "google-osconfig-agent"
Tue Jul 21 23:01:31 2026 rev:58 rq:1366769 version:20260708.00
Changes:
--------
---
/work/SRC/openSUSE:Factory/google-osconfig-agent/google-osconfig-agent.changes
2026-07-14 13:49:07.329317925 +0200
+++
/work/SRC/openSUSE:Factory/.google-osconfig-agent.new.24530/google-osconfig-agent.changes
2026-07-21 23:01:37.464241345 +0200
@@ -1,0 +2,8 @@
+Mon Jul 20 08:49:10 UTC 2026 - Markéta Machová <[email protected]>
+
+- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only
+ Punycode-encoded labels allows for validation bypass and privilege
+ escalation (bsc#1266603)
+ * CVE-2026-39821.patch
+
+-------------------------------------------------------------------
New:
----
CVE-2026-39821.patch
----------(New B)----------
New: escalation (bsc#1266603)
* CVE-2026-39821.patch
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ google-osconfig-agent.spec ++++++
--- /var/tmp/diff_new_pack.OGcwfI/_old 2026-07-21 23:01:38.508277353 +0200
+++ /var/tmp/diff_new_pack.OGcwfI/_new 2026-07-21 23:01:38.508277353 +0200
@@ -25,6 +25,8 @@
License: Apache-2.0
Group: System/Daemons
URL: https://github.com/GoogleCloudPlatform/osconfig
+# PATCH-FIX-UPSTREAM - golang.org/x/net/idna: failure to reject ASCII-only
Punycode-encoded labels allows for validation bypass and privilege escalation
+Patch0: CVE-2026-39821.patch
Source0: %{shortname}-%{version}.tar.gz
Source1: vendor.tar.gz
Source2: rpmlintrc
@@ -37,6 +39,9 @@
%prep
%setup -n %{shortname}-%{version} -a1
+pushd vendor/golang.org/x/net
+%patch -P 0 -p1
+popd
%build
%ifnarch ppc64
++++++ CVE-2026-39821.patch ++++++
>From f05f21be5927155a88b371674c298ada54b71cf5 Mon Sep 17 00:00:00 2001
From: Damien Neil <[email protected]>
Date: Wed, 1 Jul 2026 16:00:33 -0700
Subject: [PATCH] idna: reject all-ASCII xn-- labels on all Go versions
Change generated from x/text with CL 796420 applied.
For golang/go#78760
Change-Id: Ie6233f98492821f3e42b726488d9a9856a6a6964
Reviewed-on: https://go-review.googlesource.com/c/net/+/796421
Reviewed-by: Nicholas Husin <[email protected]>
Reviewed-by: Nicholas Husin <[email protected]>
LUCI-TryBot-Result: [email protected]
<[email protected]>
---
idna/idna.go | 6 +++++-
idna/idna_test.go | 14 ++++++++++++--
2 files changed, 17 insertions(+), 3 deletions(-)
diff --git a/idna/idna.go b/idna/idna.go
index 22767125bf..e2f28fed48 100644
--- a/idna/idna.go
+++ b/idna/idna.go
@@ -400,7 +400,11 @@ func (p *Profile) process(s string, toASCII bool) (string,
error) {
// Spec says keep the old label.
continue
}
- if unicode16 && err == nil && len(u) > 0 && isASCII(u) {
+ if err == nil && len(u) > 0 && isASCII(u) {
+ // UTS 43 pre-revision 33 doesn't classify a
xn-- label
+ // which contains only ASCII characters as an
error,
+ // but that's a specification bug and a
security issue.
+ // Always return an error in this case.
err = punyError(enc)
}
isBidi = isBidi || bidirule.DirectionString(u) !=
bidi.LeftToRight
