From: "Theo Gaige (Schneider Electric)" <[email protected]>
Backport patch from [1] [1] https://go.dev/cl/774481 Signed-off-by: Theo Gaige (Schneider Electric) <[email protected]> Reviewed-by: Bruno Vernay <[email protected]> --- meta/recipes-devtools/go/go-1.22.12.inc | 1 + .../go/go/CVE-2026-42504.patch | 58 +++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100644 meta/recipes-devtools/go/go/CVE-2026-42504.patch diff --git a/meta/recipes-devtools/go/go-1.22.12.inc b/meta/recipes-devtools/go/go-1.22.12.inc index 03a1a81fc3..ba4fe9a734 100644 --- a/meta/recipes-devtools/go/go-1.22.12.inc +++ b/meta/recipes-devtools/go/go-1.22.12.inc @@ -53,6 +53,7 @@ SRC_URI += "\ file://CVE-2026-39826.patch \ file://CVE-2026-42499.patch \ file://CVE-2026-42501.patch \ + file://CVE-2026-42504.patch \ " SRC_URI[main.sha256sum] = "012a7e1f37f362c0918c1dfa3334458ac2da1628c4b9cf4d9ca02db986e17d71" diff --git a/meta/recipes-devtools/go/go/CVE-2026-42504.patch b/meta/recipes-devtools/go/go/CVE-2026-42504.patch new file mode 100644 index 0000000000..1ae104ae19 --- /dev/null +++ b/meta/recipes-devtools/go/go/CVE-2026-42504.patch @@ -0,0 +1,58 @@ +From 41ca50d68cd74e0a68f3917cd902885c84fedbf7 Mon Sep 17 00:00:00 2001 +From: Damien Neil <[email protected]> +Date: Tue, 5 May 2026 15:20:34 -0700 +Subject: [PATCH] mime: avoid quadratic complexity in WordDecoder.DecodeHeader + +When encountering an undecodable encoded-word, +skip over the entire word rather than just the initial "=?". + +Fixes #79217 +Fixes CVE-2026-42504 + +Change-Id: I28605faa235459d2ba71bd0f3ae3dce96a6a6964 +Reviewed-on: https://go-review.googlesource.com/c/go/+/774481 +Reviewed-by: Nicholas Husin <[email protected]> +LUCI-TryBot-Result: [email protected] <[email protected]> +Reviewed-by: Nicholas Husin <[email protected]> + +CVE: CVE-2026-42504 +Upstream-Status: Backport [https://github.com/golang/go/commit/f230dd8a1d0a63d73e92685e378dcd725f7aac00] +Signed-off-by: Theo Gaige (Schneider Electric) <[email protected]> +--- + src/mime/encodedword.go | 4 ++-- + src/mime/encodedword_test.go | 4 ++++ + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/src/mime/encodedword.go b/src/mime/encodedword.go +index e6b470b1fb..a7059f3bc4 100644 +--- a/src/mime/encodedword.go ++++ b/src/mime/encodedword.go +@@ -275,8 +275,8 @@ func (d *WordDecoder) DecodeHeader(header string) (string, error) { + content, err := decode(encoding, text) + if err != nil { + betweenWords = false +- buf.WriteString(header[:start+2]) +- header = header[start+2:] ++ buf.WriteString(header[:end]) ++ header = header[end:] + continue + } + +diff --git a/src/mime/encodedword_test.go b/src/mime/encodedword_test.go +index 2a98794380..befc3cd996 100644 +--- a/src/mime/encodedword_test.go ++++ b/src/mime/encodedword_test.go +@@ -140,6 +140,10 @@ func TestDecodeHeader(t *testing.T) { + {"=?ISO-8859-1?Q?a?= =?ISO-8859-1?Q?b?=", "ab"}, + {"=?ISO-8859-1?Q?a?= \r\n\t =?ISO-8859-1?Q?b?=", "ab"}, + {"=?ISO-8859-1?Q?a_b?=", "a b"}, ++ // Undecodable words ++ {"=?UTF-8?b?garbage?= =?UTF-8?b?QW5kcsOp?= =?UTF-8?b?garbage?=", "=?UTF-8?b?garbage?= André =?UTF-8?b?garbage?="}, ++ {"=?UTF-8?b?QW5kcsOp", "=?UTF-8?b?QW5kcsOp"}, ++ {"=?UTF-8?x?y?=?UTF-8?x?y=?", "=?UTF-8?x?y?=?UTF-8?x?y=?"}, + } + + for _, test := range tests { +-- +2.43.0 + -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#237496): https://lists.openembedded.org/g/openembedded-core/message/237496 Mute This Topic: https://lists.openembedded.org/mt/119422300/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
