Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ignition for openSUSE:Factory checked in at 2026-07-26 11:26:56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ignition (Old) and /work/SRC/openSUSE:Factory/.ignition.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ignition" Sun Jul 26 11:26:56 2026 rev:60 rq:1367514 version:2.26.0 Changes: -------- --- /work/SRC/openSUSE:Factory/ignition/ignition.changes 2026-05-29 18:04:42.548406473 +0200 +++ /work/SRC/openSUSE:Factory/.ignition.new.2004/ignition.changes 2026-07-26 11:26:58.975644141 +0200 @@ -1,0 +2,10 @@ +Thu Jul 23 17:17:35 UTC 2026 - Ignaz Forster <[email protected]> + +- Add CVE-2026-34986.patch + * Fixes [bsc#1262944] +- Add CVE-2026-39821.patch + * Fixes [bsc#1266606] +- Add CVE-2026-56852.patch + * Fixes [bsc#1272059] + +------------------------------------------------------------------- New: ---- CVE-2026-34986.patch CVE-2026-39821.patch CVE-2026-56852.patch ----------(New B)---------- New: - Add CVE-2026-34986.patch * Fixes [bsc#1262944] New: * Fixes [bsc#1262944] - Add CVE-2026-39821.patch * Fixes [bsc#1266606] New: * Fixes [bsc#1266606] - Add CVE-2026-56852.patch * Fixes [bsc#1272059] ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ignition.spec ++++++ --- /var/tmp/diff_new_pack.NAhNsB/_old 2026-07-26 11:26:59.903675985 +0200 +++ /var/tmp/diff_new_pack.NAhNsB/_new 2026-07-26 11:26:59.907676122 +0200 @@ -45,6 +45,9 @@ Patch4: 0004-Order-ignition-disks.service-before-systemd-fsck-roo.patch Patch5: CVE-2026-33186.patch Patch6: CVE-2026-33814.patch +Patch7: CVE-2026-39821.patch +Patch8: CVE-2026-34986.patch +Patch9: CVE-2026-56852.patch BuildRequires: dracut BuildRequires: libblkid-devel BuildRequires: systemd-rpm-macros ++++++ CVE-2026-34986.patch ++++++ >From 02464163e1e891db85257cb8860978a1c0226016 Mon Sep 17 00:00:00 2001 From: Jacob Hoffman-Andrews <[email protected]> Date: Tue, 31 Mar 2026 16:33:50 -0700 Subject: [PATCH] Merge commit from fork * cipher: fix panic on KeyUnwrap of too-short slice * jwe: don't call KeyUnwrap on empty (encrypted) key Also don't call `aead.decrypt` on an empty key. * test: make asymmetric_test more precise These two test cases were passing a nil recipient, and checking for "any error" instead of a specific error, which meant that introducing a nil recipient check in `decryptKey` caused the test to stop testing what it meant to test, but continue passing. Now we check for a specific error. * test: TestKeyUnwrapShort * jwe: TestEmptyEncryptedKey * test: add `shorten` and `empty` corruptors * fix import path --- asymmetric.go | 10 +++++++++- cipher/key_wrap.go | 10 +++++++++- symmetric.go | 26 ++++++++++++++++++-------- 7 files changed, 168 insertions(+), 16 deletions(-) diff --git a/vendor/github.com/go-jose/go-jose/v4/asymmetric.go b/vendor/github.com/go-jose/go-jose/v4/asymmetric.go index d4d4961..79d9ee5 100644 --- a/vendor/github.com/go-jose/go-jose/v4/asymmetric.go +++ b/vendor/github.com/go-jose/go-jose/v4/asymmetric.go @@ -414,6 +414,9 @@ func (ctx ecKeyGenerator) genKey() ([]byte, rawHeader, error) { // Decrypt the given payload and return the content encryption key. func (ctx ecDecrypterSigner) decryptKey(headers rawHeader, recipient *recipientInfo, generator keyGenerator) ([]byte, error) { + if recipient == nil { + return nil, errors.New("go-jose/go-jose: missing recipient") + } epk, err := headers.getEPK() if err != nil { return nil, errors.New("go-jose/go-jose: invalid epk header") @@ -461,13 +464,18 @@ func (ctx ecDecrypterSigner) decryptKey(headers rawHeader, recipient *recipientI return nil, ErrUnsupportedAlgorithm } + encryptedKey := recipient.encryptedKey + if len(encryptedKey) == 0 { + return nil, errors.New("go-jose/go-jose: missing JWE Encrypted Key") + } + key := deriveKey(string(algorithm), keySize) block, err := aes.NewCipher(key) if err != nil { return nil, err } - return josecipher.KeyUnwrap(block, recipient.encryptedKey) + return josecipher.KeyUnwrap(block, encryptedKey) } func (ctx edDecrypterSigner) signPayload(payload []byte, alg SignatureAlgorithm) (Signature, error) { diff --git a/vendor/github.com/go-jose/go-jose/v4/cipher/key_wrap.go b/vendor/github.com/go-jose/go-jose/v4/cipher/key_wrap.go index b9effbc..a2f86e3 100644 --- a/vendor/github.com/go-jose/go-jose/v4/cipher/key_wrap.go +++ b/vendor/github.com/go-jose/go-jose/v4/cipher/key_wrap.go @@ -66,12 +66,20 @@ func KeyWrap(block cipher.Block, cek []byte) ([]byte, error) { } // KeyUnwrap implements NIST key unwrapping; it unwraps a content encryption key (cek) with the given block cipher. +// +// https://datatracker.ietf.org/doc/html/rfc7518#section-4.4 +// https://datatracker.ietf.org/doc/html/rfc7518#section-4.6 +// https://datatracker.ietf.org/doc/html/rfc7518#section-4.8 func KeyUnwrap(block cipher.Block, ciphertext []byte) ([]byte, error) { + n := (len(ciphertext) / 8) - 1 + if n <= 0 { + return nil, errors.New("go-jose/go-jose: JWE Encrypted Key too short") + } + if len(ciphertext)%8 != 0 { return nil, errors.New("go-jose/go-jose: key wrap input must be 8 byte blocks") } - n := (len(ciphertext) / 8) - 1 r := make([][]byte, n) for i := range r { diff --git a/vendor/github.com/go-jose/go-jose/v4/symmetric.go b/vendor/github.com/go-jose/go-jose/v4/symmetric.go index 10d8e19..4a4bba2 100644 --- a/vendor/github.com/go-jose/go-jose/v4/symmetric.go +++ b/vendor/github.com/go-jose/go-jose/v4/symmetric.go @@ -364,11 +364,21 @@ func (ctx *symmetricKeyCipher) encryptKey(cek []byte, alg KeyAlgorithm) (recipie // Decrypt the content encryption key. func (ctx *symmetricKeyCipher) decryptKey(headers rawHeader, recipient *recipientInfo, generator keyGenerator) ([]byte, error) { - switch headers.getAlgorithm() { - case DIRECT: - cek := make([]byte, len(ctx.key)) - copy(cek, ctx.key) - return cek, nil + if recipient == nil { + return nil, fmt.Errorf("go-jose/go-jose: missing recipient") + } + + alg := headers.getAlgorithm() + if alg == DIRECT { + return bytes.Clone(ctx.key), nil + } + + encryptedKey := recipient.encryptedKey + if len(encryptedKey) == 0 { + return nil, fmt.Errorf("go-jose/go-jose: missing JWE Encrypted Key") + } + + switch alg { case A128GCMKW, A192GCMKW, A256GCMKW: aead := newAESGCM(len(ctx.key)) @@ -383,7 +393,7 @@ func (ctx *symmetricKeyCipher) decryptKey(headers rawHeader, recipient *recipien parts := &aeadParts{ iv: iv.bytes(), - ciphertext: recipient.encryptedKey, + ciphertext: encryptedKey, tag: tag.bytes(), } @@ -399,7 +409,7 @@ func (ctx *symmetricKeyCipher) decryptKey(headers rawHeader, recipient *recipien return nil, err } - cek, err := josecipher.KeyUnwrap(block, recipient.encryptedKey) + cek, err := josecipher.KeyUnwrap(block, encryptedKey) if err != nil { return nil, err } @@ -440,7 +450,7 @@ func (ctx *symmetricKeyCipher) decryptKey(headers rawHeader, recipient *recipien return nil, err } - cek, err := josecipher.KeyUnwrap(block, recipient.encryptedKey) + cek, err := josecipher.KeyUnwrap(block, encryptedKey) if err != nil { return nil, err } ++++++ CVE-2026-39821.patch ++++++ >From 2d5129d2b310e497a1821044acad0ec60bc9ef5c Mon Sep 17 00:00:00 2001 From: Damien Neil <[email protected]> Date: Thu, 09 Jul 2026 19:00:57 -0700 Subject: [PATCH] [release-branch.go1.25] all: update x/net Pulls in a change to x/net/idna to reject all-ASCII xn-- labels. For #78760 Fixes #80297 Fixes CVE-2026-39821 Change-Id: I3aae285219eadc3730927320ee58466a6a6a6964 Reviewed-on: https://go-review.googlesource.com/c/go/+/799121 LUCI-TryBot-Result: [email protected] <[email protected]> Reviewed-by: David Chase <[email protected]> --- diff --git a/vendor/golang.org/x/net/idna/idna10.0.0.go b/vendor/golang.org/x/net/idna/idna10.0.0.go index 7b37178..0743e91 100644 --- a/vendor/golang.org/x/net/idna/idna10.0.0.go +++ b/vendor/golang.org/x/net/idna/idna10.0.0.go @@ -362,7 +362,8 @@ continue } if strings.HasPrefix(label, acePrefix) { - u, err2 := decode(label[len(acePrefix):]) + enc := label[len(acePrefix):] + u, err2 := decode(enc) if err2 != nil { if err == nil { err = err2 @@ -370,6 +371,9 @@ // Spec says keep the old label. continue } + if err == nil && len(u) > 0 && isASCII(u) { + err = punyError(enc) + } isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight labels.set(u) if err == nil && p.fromPuny != nil { @@ -424,6 +428,15 @@ return s, err } +func isASCII(s string) bool { + for _, c := range []byte(s) { + if c >= 0x80 { + return false + } + } + return true +} + func normalize(p *Profile, s string) (mapped string, isBidi bool, err error) { // TODO: consider first doing a quick check to see if any of these checks // need to be done. This will make it slower in the general case, but ++++++ CVE-2026-56852.patch ++++++ >From 5ae8e578e495731553eddba11b2d0e86c91a00ce Mon Sep 17 00:00:00 2001 From: Damien Neil <[email protected]> Date: Tue, 14 Apr 2026 21:46:24 -0400 Subject: [PATCH] unicode/norm: avoid infinite loop on invalid input Invalid characters are given a Properties with a size of 0. The nextComposed function can enter an infinite loop when encountering an invalid character, since it advances its input by the (possibly 0) character size. Rather than finding every place which might assume characters have a non-zero size, change compInfo to return a size-1 Properties for invalid characters and use the property flags to record validity. Fixes golang/go#80142 Change-Id: Ie0791faefeddc1e8f671b0ed73f29e906a6a6964 Reviewed-on: https://go-review.googlesource.com/c/text/+/794100 LUCI-TryBot-Result: [email protected] <[email protected]> Auto-Submit: Damien Neil <[email protected]> Reviewed-by: Neal Patel <[email protected]> Reviewed-by: Neal Patel <[email protected]> --- diff --git a/unicode/norm/forminfo.go b/vendor/golang.org/x/text/unicode/norm/forminfo.go index f3a234e..b3cf5d9 100644 --- a/vendor/golang.org/x/text/unicode/norm/forminfo.go +++ b/vendor/golang.org/x/text/unicode/norm/forminfo.go @@ -121,8 +121,12 @@ // // When all 4 bits are zero, the character is inert, meaning it is never // influenced by normalization. +// +// We set flags to 0x80 (high bit 7 unused in quick check data) to indicate an invalid rune. type qcInfo uint8 +func (p Properties) isInvalid() bool { return p.flags == 0x80 } + func (p Properties) isYesC() bool { return p.flags&0x10 == 0 } func (p Properties) isYesD() bool { return p.flags&0x4 == 0 } @@ -247,6 +251,9 @@ // to a Properties. See the comment at the top of the file // for more information on the format. func compInfo(v uint16, sz int) Properties { + if sz == 0 { + return Properties{flags: 0x80, size: 1} + } if v == 0 { return Properties{size: uint8(sz)} } else if v >= 0x8000 { @@ -254,7 +261,7 @@ size: uint8(sz), ccc: uint8(v), tccc: uint8(v), - flags: qcInfo(v >> 8), + flags: qcInfo(v>>8) & 0x3f, } if p.ccc > 0 || p.combinesBackward() { p.nLead = uint8(p.flags & 0x3) diff --git a/unicode/norm/iter.go b/vendor/golang.org/x/text/unicode/norm/iter.go index 417c6b2..3cc0592 100644 --- a/vendor/golang.org/x/text/unicode/norm/iter.go +++ b/vendor/golang.org/x/text/unicode/norm/iter.go @@ -376,16 +376,12 @@ goto doNorm } prevCC = i.info.tccc - sz := int(i.info.size) - if sz == 0 { - sz = 1 // illegal rune: copy byte-by-byte - } - p := outp + sz + p := outp + int(i.info.size) if p > len(i.buf) { break } outp = p - i.p += sz + i.p += int(i.info.size) if i.p >= i.rb.nsrc { i.setDone() break diff --git a/unicode/norm/normalize.go b/vendor/golang.org/x/text/unicode/norm/normalize.go index 4747ad0..60b1511 100644 --- a/vendor/golang.org/x/text/unicode/norm/normalize.go +++ b/vendor/golang.org/x/text/unicode/norm/normalize.go @@ -148,7 +148,7 @@ // patched buffer and whether the decomposition is still in progress. func patchTail(rb *reorderBuffer) bool { info, p := lastRuneStart(&rb.f, rb.out) - if p == -1 || info.size == 0 { + if p == -1 || info.isInvalid() { return true } end := p + int(info.size) @@ -225,7 +225,7 @@ } fd := &rb.f if doMerge { - var info Properties + info := Properties{flags: 0x80, size: 1} // invalid rune if p < n { info = fd.info(src, p) if !info.BoundaryBefore() || info.nLeadingNonStarters() > 0 { @@ -235,7 +235,7 @@ p = decomposeSegment(rb, p, true) } } - if info.size == 0 { + if info.isInvalid() { rb.doFlush() // Append incomplete UTF-8 encoding. return src.appendSlice(rb.out, p, n) @@ -314,7 +314,7 @@ continue } info := f.info(src, i) - if info.size == 0 { + if info.isInvalid() { if atEOF { // include incomplete runes return n, true @@ -379,7 +379,7 @@ // CGJ insertion points correctly. Luckily it doesn't have to. for { info := fd.info(src, i) - if info.size == 0 { + if info.isInvalid() { return -1 } if s := ss.next(info); s != ssSuccess { @@ -424,7 +424,7 @@ } fd := formTable[f] info := fd.info(src, 0) - if info.size == 0 { + if info.isInvalid() { if atEOF { return 1 } @@ -435,7 +435,7 @@ for i := int(info.size); i < nsrc; i += int(info.size) { info = fd.info(src, i) - if info.size == 0 { + if info.isInvalid() { if atEOF { return i } @@ -465,7 +465,7 @@ if p == -1 { return -1 } - if info.size == 0 { // ends with incomplete rune + if info.isInvalid() { // ends with incomplete rune if p == 0 { // starts with incomplete rune return -1 } @@ -504,7 +504,7 @@ func decomposeSegment(rb *reorderBuffer, sp int, atEOF bool) int { // Force one character to be consumed. info := rb.f.info(rb.src, sp) - if info.size == 0 { + if info.isInvalid() { return 0 } if s := rb.ss.next(info); s == ssStarter { @@ -528,7 +528,7 @@ break } info = rb.f.info(rb.src, sp) - if info.size == 0 { + if info.isInvalid() { if !atEOF { return int(iShortSrc) }
