Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubernetes1.35 for openSUSE:Factory checked in at 2026-09-14 16:21:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubernetes1.35 (Old) and /work/SRC/openSUSE:Factory/.kubernetes1.35.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubernetes1.35" Mon Sep 14 16:21:51 2026 rev:10 rq:1377681 version:1.35.8 Changes: -------- --- /work/SRC/openSUSE:Factory/kubernetes1.35/kubernetes1.35.changes 2026-08-24 12:17:11.954917582 +0200 +++ /work/SRC/openSUSE:Factory/.kubernetes1.35.new.1265/kubernetes1.35.changes 2026-09-14 16:21:55.468414646 +0200 @@ -1,0 +2,8 @@ +Sun Sep 13 11:16:38 UTC 2026 - Priyanka Saggu <[email protected]> + +- New patch: CVE-2026-41178-otel-baggage-upstream.patch + to fix CVE-2026-41178 (go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs), bsc#1276659 + ref: https://github.com/open-telemetry/opentelemetry-go/commit/97447f5c54 + ref: https://github.com/open-telemetry/opentelemetry-go/commit/f02feacf86 + +------------------------------------------------------------------- New: ---- CVE-2026-41178-otel-baggage-upstream.patch ----------(New B)---------- New: - New patch: CVE-2026-41178-otel-baggage-upstream.patch to fix CVE-2026-41178 (go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs), bsc#1276659 ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubernetes1.35.spec ++++++ --- /var/tmp/diff_new_pack.qoWNQd/_old 2026-09-14 16:21:57.409496213 +0200 +++ /var/tmp/diff_new_pack.qoWNQd/_new 2026-09-14 16:21:57.414496423 +0200 @@ -49,6 +49,10 @@ Patch4: kubeadm-opensuse-flexvolume.patch # Patch to revert renaming of coredns image location to match how it's done on download.opensuse.org Patch5: revert-coredns-image-renaming.patch +# Patch to fix CVE-2026-41178 (go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs), bsc#1276659, PR open-telemetry/opentelemetry-go#8222 +# ref: https://github.com/open-telemetry/opentelemetry-go/commit/97447f5c54 +# ref: https://github.com/open-telemetry/opentelemetry-go/commit/f02feacf86 +Patch6: CVE-2026-41178-otel-baggage-upstream.patch BuildRequires: fdupes BuildRequires: git BuildRequires: go >= 1.26.5 @@ -217,6 +221,7 @@ %patch -P 3 -p1 %patch -P 4 -p0 %patch -P 5 -p1 +%patch -P 6 -p1 %build # This is fixing bug bsc#1065972 ++++++ CVE-2026-41178-otel-baggage-upstream.patch ++++++ >From 97447f5c54c66f4b8773aefeafad260e4e91d92b Mon Sep 17 00:00:00 2001 From: Sam Xie <[email protected]> Date: Wed, 20 May 2026 07:25:54 -0700 Subject: [PATCH] Add max baggage length as limitation (#8222) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ``` goos: darwin goarch: arm64 pkg: go.opentelemetry.io/otel/baggage cpu: Apple M1 Max │ /tmp/old.txt │ /tmp/new.txt │ │ sec/op │ sec/op vs base │ New-10 413.5n ± 1% 410.1n ± 1% ~ (p=0.184 n=10) NewMemberRaw-10 12.65n ± 1% 12.62n ± 1% ~ (p=0.270 n=10) Parse-10 1.252µ ± 2% 1.254µ ± 1% ~ (p=0.778 n=10) String-10 594.9n ± 1% 593.4n ± 1% ~ (p=0.279 n=10) ValueEscape/nothing_to_escape-10 4.890n ± 1% 4.885n ± 0% ~ (p=0.579 n=10) ValueEscape/requires_escaping-10 22.02n ± 1% 21.47n ± 1% -2.50% (p=0.000 n=10) ValueEscape/long_value-10 507.4n ± 1% 506.6n ± 2% ~ (p=0.481 n=10) MemberString-10 486.7n ± 15% 514.0n ± 5% ~ (p=0.190 n=10) ParseOversized-10 22544795.0n ± 1% 130.8n ± 4% -100.00% (p=0.000 n=10) geomean 510.0n 133.8n -73.76% │ /tmp/old.txt │ /tmp/new.txt │ │ B/op │ B/op vs base │ New-10 592.0 ± 0% 592.0 ± 0% ~ (p=1.000 n=10) ¹ NewMemberRaw-10 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Parse-10 1.039Ki ± 0% 1.039Ki ± 0% ~ (p=1.000 n=10) ¹ String-10 840.0 ± 0% 840.0 ± 0% ~ (p=1.000 n=10) ¹ ValueEscape/nothing_to_escape-10 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ ValueEscape/requires_escaping-10 16.00 ± 0% 16.00 ± 0% ~ (p=1.000 n=10) ¹ ValueEscape/long_value-10 576.0 ± 0% 576.0 ± 0% ~ (p=1.000 n=10) ¹ MemberString-10 656.0 ± 0% 656.0 ± 0% ~ (p=1.000 n=10) ¹ ParseOversized-10 801126.50 ± 0% 88.00 ± 0% -99.99% (p=0.000 n=10) geomean ² -63.68% ² ¹ all samples are equal ² summaries must be >0 to compute geomean │ /tmp/old.txt │ /tmp/new.txt │ │ allocs/op │ allocs/op vs base │ New-10 6.000 ± 0% 6.000 ± 0% ~ (p=1.000 n=10) ¹ NewMemberRaw-10 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ Parse-10 18.00 ± 0% 18.00 ± 0% ~ (p=1.000 n=10) ¹ String-10 8.000 ± 0% 8.000 ± 0% ~ (p=1.000 n=10) ¹ ValueEscape/nothing_to_escape-10 0.000 ± 0% 0.000 ± 0% ~ (p=1.000 n=10) ¹ ValueEscape/requires_escaping-10 1.000 ± 0% 1.000 ± 0% ~ (p=1.000 n=10) ¹ ValueEscape/long_value-10 2.000 ± 0% 2.000 ± 0% ~ (p=1.000 n=10) ¹ MemberString-10 4.000 ± 0% 4.000 ± 0% ~ (p=1.000 n=10) ¹ ParseOversized-10 250007.000 ± 0% 3.000 ± 0% -100.00% (p=0.000 n=10) geomean ² -71.61% ² ¹ all samples are equal ² summaries must be >0 to compute geomean ``` --------- Co-authored-by: Robert Pająk <[email protected]> --- baggage/baggage.go | 30 ++++++++++++++++++--- propagation/baggage.go | 59 ++++++++++++++++++++++++++++++++++-------- 2 files changed, 74 insertions(+), 15 deletions(-) diff --git a/vendor/go.opentelemetry.io/otel/baggage/baggage.go b/vendor/go.opentelemetry.io/otel/baggage/baggage.go index 878ffbe4..b290c6d6 100644 --- a/vendor/go.opentelemetry.io/otel/baggage/baggage.go +++ b/vendor/go.opentelemetry.io/otel/baggage/baggage.go @@ -14,6 +14,10 @@ import ( ) const ( + maxParseErrors = 5 + + // W3C Baggage specification limits. + // https://www.w3.org/TR/baggage/#limits maxMembers = 64 maxBytesPerBaggageString = 8192 @@ -493,9 +497,15 @@ func New(members ...Member) (Baggage, error) { // from the W3C Baggage specification which allows duplicate list-members, but // conforms to the OpenTelemetry Baggage specification. // -// If the baggage-string exceeds the maximum allowed members (64) or bytes -// (8192), members are dropped until the limits are satisfied and an error is -// returned along with the partial result. +// If the raw baggage-string exceeds the maximum allowed bytes (8192), an +// empty Baggage and an error are returned. +// +// Otherwise, members are parsed left-to-right and accumulated until one of +// the following conditions is reached, at which point parsing stops and an +// error is returned alongside the partial result: +// - accepting the next member would cause the encoded baggage to exceed +// 8192 bytes, or +// - the baggage already contains 64 distinct keys. // // Invalid members are skipped and the error is returned along with the // partial result containing the valid members. @@ -504,9 +514,14 @@ func Parse(bStr string) (Baggage, error) { return Baggage{}, nil } + if n := len(bStr); n > maxBytesPerBaggageString { + return Baggage{}, fmt.Errorf("%w: %d", errBaggageBytes, n) + } + b := make(baggage.List) sizes := make(map[string]int) // Track per-key byte sizes var totalBytes int + var parseErrors int var truncateErr error for memberStr := range strings.SplitSeq(bStr, listDelimiter) { // Check member count limit. @@ -517,7 +532,10 @@ func Parse(bStr string) (Baggage, error) { m, err := parseMember(memberStr) if err != nil { - truncateErr = errors.Join(truncateErr, err) + parseErrors++ + if parseErrors <= maxParseErrors { + truncateErr = errors.Join(truncateErr, err) + } continue // skip invalid member, keep processing } @@ -553,6 +571,10 @@ func Parse(bStr string) (Baggage, error) { totalBytes = newTotalBytes } + if dropped := parseErrors - maxParseErrors; dropped > 0 { + truncateErr = errors.Join(truncateErr, fmt.Errorf("and %d more invalid member(s)", dropped)) + } + if len(b) == 0 { return Baggage{}, truncateErr } diff --git a/vendor/go.opentelemetry.io/otel/propagation/baggage.go b/vendor/go.opentelemetry.io/otel/propagation/baggage.go index 2ecca3fe..afa5f454 100644 --- a/vendor/go.opentelemetry.io/otel/propagation/baggage.go +++ b/vendor/go.opentelemetry.io/otel/propagation/baggage.go @@ -5,6 +5,8 @@ package propagation // import "go.opentelemetry.io/otel/propagation" import ( "context" + "errors" + "fmt" "go.opentelemetry.io/otel/baggage" "go.opentelemetry.io/otel/internal/errorhandler" @@ -13,9 +15,12 @@ import ( const ( baggageHeader = "baggage" + maxParseErrors = 5 + // W3C Baggage specification limits. // https://www.w3.org/TR/baggage/#limits - maxMembers = 64 + maxMembers = 64 + maxBytesPerBaggageString = 8192 ) // Baggage is a propagator that supports the W3C Baggage format. @@ -72,24 +77,56 @@ func extractMultiBaggage(parent context.Context, carrier ValuesGetter) context.C } var members []baggage.Member - for _, bStr := range bVals { - currBag, err := baggage.Parse(bStr) - if err != nil { - errorhandler.GetErrorHandler().Handle(err) + var totalBytes int + var parseErrors int + var truncateErr error + for i, bStr := range bVals { + if i > 0 { + totalBytes++ // comma separator between combined header values } - if currBag.Len() == 0 { - continue + totalBytes += len(bStr) + if totalBytes > maxBytesPerBaggageString { + // Per the W3C Baggage spec, the byte limit applies to the + // combination of all baggage headers, not each header + // individually. Mirror the single-header behavior of + // reporting the error and returning the parent context + // with no baggage attached. + errorhandler.GetErrorHandler().Handle(fmt.Errorf( + "baggage: aggregate header size %d exceeds %d byte limit", + totalBytes, + maxBytesPerBaggageString, + )) + return parent } - members = append(members, currBag.Members()...) - if len(members) >= maxMembers { - break + + // If members exceed the limit, stop parsing baggage. + if len(members) <= maxMembers { + currBag, err := baggage.Parse(bStr) + if err != nil { + parseErrors++ + if parseErrors <= maxParseErrors { + truncateErr = errors.Join(truncateErr, err) + } + } + if currBag.Len() == 0 { + continue + } + members = append(members, currBag.Members()...) } } + if dropped := parseErrors - maxParseErrors; dropped > 0 { + truncateErr = errors.Join(truncateErr, fmt.Errorf("and %d more error(s)", dropped)) + } + b, err := baggage.New(members...) if err != nil { - errorhandler.GetErrorHandler().Handle(err) + truncateErr = errors.Join(truncateErr, err) + } + if truncateErr != nil { + errorhandler.GetErrorHandler().Handle(truncateErr) } + if b.Len() == 0 { return parent } -- 2.55.0 >From f02feacf8652b69c051851cfa2945d2ed5f0d568 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Paj=C4=85k?= <[email protected]> Date: Tue, 26 May 2026 19:43:43 +0200 Subject: [PATCH] Merge commit from fork * fix(propagation): limit baggage extraction error reporting Use sync.Once when reporting malformed or oversized baggage headers so attacker-controlled extraction failures cannot repeatedly flood the global error handler/log output. * propagation: test baggage error reporting limit * add changelog entry --- propagation/baggage.go | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/vendor/go.opentelemetry.io/otel/propagation/baggage.go b/vendor/go.opentelemetry.io/otel/propagation/baggage.go index afa5f454..d81b709a 100644 --- a/vendor/go.opentelemetry.io/otel/propagation/baggage.go +++ b/vendor/go.opentelemetry.io/otel/propagation/baggage.go @@ -7,6 +7,7 @@ import ( "context" "errors" "fmt" + "sync" "go.opentelemetry.io/otel/baggage" "go.opentelemetry.io/otel/internal/errorhandler" @@ -23,6 +24,10 @@ const ( maxBytesPerBaggageString = 8192 ) +// handleExtractErrOnce limits error reporting for attacker-controlled baggage headers +// to one process-wide emission, preventing repeated extraction from flooding logs. +var handleExtractErrOnce sync.Once + // Baggage is a propagator that supports the W3C Baggage format. // // This propagates user-defined baggage associated with a trace. The complete @@ -62,7 +67,9 @@ func extractSingleBaggage(parent context.Context, carrier TextMapCarrier) contex bag, err := baggage.Parse(bStr) if err != nil { - errorhandler.GetErrorHandler().Handle(err) + handleExtractErrOnce.Do(func() { + errorhandler.GetErrorHandler().Handle(err) + }) } if bag.Len() == 0 { return parent @@ -91,11 +98,13 @@ func extractMultiBaggage(parent context.Context, carrier ValuesGetter) context.C // individually. Mirror the single-header behavior of // reporting the error and returning the parent context // with no baggage attached. - errorhandler.GetErrorHandler().Handle(fmt.Errorf( - "baggage: aggregate header size %d exceeds %d byte limit", - totalBytes, - maxBytesPerBaggageString, - )) + handleExtractErrOnce.Do(func() { + errorhandler.GetErrorHandler().Handle(fmt.Errorf( + "baggage: aggregate header size %d exceeds %d byte limit", + totalBytes, + maxBytesPerBaggageString, + )) + }) return parent } @@ -124,7 +133,9 @@ func extractMultiBaggage(parent context.Context, carrier ValuesGetter) context.C truncateErr = errors.Join(truncateErr, err) } if truncateErr != nil { - errorhandler.GetErrorHandler().Handle(truncateErr) + handleExtractErrOnce.Do(func() { + errorhandler.GetErrorHandler().Handle(truncateErr) + }) } if b.Len() == 0 { -- 2.55.0
