Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package google-guest-agent for openSUSE:Factory checked in at 2026-07-21 23:01:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/google-guest-agent (Old) and /work/SRC/openSUSE:Factory/.google-guest-agent.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "google-guest-agent" Tue Jul 21 23:01:25 2026 rev:65 rq:1366767 version:20260529.00 Changes: -------- --- /work/SRC/openSUSE:Factory/google-guest-agent/google-guest-agent.changes 2026-06-15 19:54:01.242029295 +0200 +++ /work/SRC/openSUSE:Factory/.google-guest-agent.new.24530/google-guest-agent.changes 2026-07-21 23:01:30.431998804 +0200 @@ -1,0 +2,8 @@ +Mon Jul 20 08:49:10 UTC 2026 - Markéta Machová <[email protected]> + +- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only + Punycode-encoded labels allows for validation bypass and privilege + escalation (bsc#1266603) + * CVE-2026-39821.patch + +------------------------------------------------------------------- New: ---- CVE-2026-39821.patch ----------(New B)---------- New: escalation (bsc#1266603) * CVE-2026-39821.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ google-guest-agent.spec ++++++ --- /var/tmp/diff_new_pack.gAVSgQ/_old 2026-07-21 23:01:32.748078685 +0200 +++ /var/tmp/diff_new_pack.gAVSgQ/_new 2026-07-21 23:01:32.752078823 +0200 @@ -29,6 +29,8 @@ Source1: vendor.tar.gz Source2: rpmlintrc Patch0: disable_google_dhclient_script.patch +# PATCH-FIX-UPSTREAM - golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation +Patch1: CVE-2026-39821.patch BuildRequires: golang(API) = 1.26 Requires: google-guest-configs Requires: google-guest-oslogin >= 20231003 @@ -42,6 +44,9 @@ %prep %setup -n %{shortname}-%{version} -a1 %patch -P 0 -p1 +pushd vendor/golang.org/x/net +%patch -P 1 -p1 +popd %build %ifnarch ppc64 ++++++ CVE-2026-39821.patch ++++++ >From f05f21be5927155a88b371674c298ada54b71cf5 Mon Sep 17 00:00:00 2001 From: Damien Neil <[email protected]> Date: Wed, 1 Jul 2026 16:00:33 -0700 Subject: [PATCH] idna: reject all-ASCII xn-- labels on all Go versions Change generated from x/text with CL 796420 applied. For golang/go#78760 Change-Id: Ie6233f98492821f3e42b726488d9a9856a6a6964 Reviewed-on: https://go-review.googlesource.com/c/net/+/796421 Reviewed-by: Nicholas Husin <[email protected]> Reviewed-by: Nicholas Husin <[email protected]> LUCI-TryBot-Result: [email protected] <[email protected]> --- idna/idna.go | 6 +++++- idna/idna_test.go | 14 ++++++++++++-- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/idna/idna.go b/idna/idna.go index 22767125bf..e2f28fed48 100644 --- a/idna/idna.go +++ b/idna/idna.go @@ -400,7 +400,11 @@ func (p *Profile) process(s string, toASCII bool) (string, error) { // Spec says keep the old label. continue } - if unicode16 && err == nil && len(u) > 0 && isASCII(u) { + if err == nil && len(u) > 0 && isASCII(u) { + // UTS 43 pre-revision 33 doesn't classify a xn-- label + // which contains only ASCII characters as an error, + // but that's a specification bug and a security issue. + // Always return an error in this case. err = punyError(enc) } isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight
