Star0
31
代码
代码
Issues13
Pull Requests15
项目讨论
Wiki
分析
Star0
31
已开启
fix CVE-2025-61731 #598
rixian4857创建于 2月28日
fix CVE-2025-61731 #598
已开启
rixian4857创建于 2月28日
从rixian4857/golangopenEuler-24.03-LTS-SP3合入到src-openeuler/golangopenEuler-24.03-LTS-SP3
共 3 个文件变更+115-1
A1022-CVE-2025-61731.patch+63-0
@@ -0,0 +1,63 @@
1+From 00b7309387a171bcba37382e7ed96b473df04917 Mon Sep 17 00:00:00 2001
2+From: Neal Patel <nealpatel@google.com>
3+Date: Thu, 4 Dec 2025 12:30:39 -0500
4+Subject: [PATCH] [release-branch.go1.24] cmd/go/internal/work: sanitize flags
5+ before invoking 'pkg-config'
6+ 
7+The addition of CgoPkgConfig allowed execution with flags not
8+matching the safelist. In order to prevent potential arbitrary
9+code execution at build time, ensure that flags are validated
10+prior to invoking the 'pkg-config' binary.
11+ 
12+Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc.
13+for reporting this issue.
14+ 
15+Fixes CVE-2025-61731
16+Fixes #77100
17+ 
18+Change-Id: Ic51b41f1f7e697ab98c9c32c6fae35f217f7f364
19+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3240
20+Reviewed-by: Nicholas Husin <husin@google.com>
21+Reviewed-by: Damien Neil <dneil@google.com>
22+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/3344
23+Reviewed-by: Neal Patel <nealpatel@google.com>
24+Reviewed-on: https://go-review.googlesource.com/c/go/+/736701
25+Auto-Submit: Michael Pratt <mpratt@google.com>
26+TryBot-Bypass: Michael Pratt <mpratt@google.com>
27+Reviewed-by: Junyang Shao <shaojunyang@google.com>
28+---
29+ src/cmd/go/internal/work/exec.go | 8 ++++++++
30+ src/cmd/go/internal/work/security.go | 1 +
31+ 2 files changed, 9 insertions(+)
32+ 
33+diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go
34+index 7b073165d5fe25..8d0a7b51c21f47 100644
35+--- a/src/cmd/go/internal/work/exec.go
36++++ b/src/cmd/go/internal/work/exec.go
37+@@ -1652,6 +1652,14 @@ func (b *Builder) getPkgConfigFlags(a *Action) (cflags, ldflags []string, err er
38+ return nil, nil, fmt.Errorf("invalid pkg-config package name: %s", pkg)
39+ }
40+ }
41++
42++ // Running 'pkg-config' can cause execution of
43++ // arbitrary code using flags that are not in
44++ // the safelist.
45++ if err := checkCompilerFlags("CFLAGS", "pkg-config --cflags", pcflags); err != nil {
46++ return nil, nil, err
47++ }
48++
49+ var out []byte
50+ out, err = sh.runOut(p.Dir, nil, b.PkgconfigCmd(), "--cflags", pcflags, "--", pkgs)
51+ if err != nil {
52+diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go
53+index 50bfd0ab705383..66b02cb8592a91 100644
54+--- a/src/cmd/go/internal/work/security.go
55++++ b/src/cmd/go/internal/work/security.go
56+@@ -125,6 +125,7 @@ var validCompilerFlags = []*lazyregexp.Regexp{
57+ re(`-pedantic(-errors)?`),
58+ re(`-pipe`),
59+ re(`-pthread`),
60++ re(`--static`),
61+ re(`-?-std=([^@\-].*)`),
62+ re(`-?-stdlib=([^@\-].*)`),
63+ re(`--sysroot=([^@\-].*)`),
Abackport-0049-CVE-2025-61731.patch+44-0
@@ -0,0 +1,44 @@
1+From de7a96afc3c1a2c279cf25403a4d11afcf315697 Mon Sep 17 00:00:00 2001
2+From: rixian4857 <shihuiyuan@xfusion.com>
3+Date: Sat, 28 Feb 2026 14:11:42 +0800
4+Subject: [PATCH] a
5+ 
6+---
7+ src/cmd/go/internal/work/exec.go | 8 ++++++++
8+ src/cmd/go/internal/work/security.go | 1 +
9+ 2 files changed, 9 insertions(+)
10+ 
11+diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go
12+index 13d2a78..7142568 100644
13+--- a/src/cmd/go/internal/work/exec.go
14++++ b/src/cmd/go/internal/work/exec.go
15+@@ -1622,6 +1622,14 @@ func (b *Builder) getPkgConfigFlags(p *load.Package) (cflags, ldflags []string,
16+ return nil, nil, fmt.Errorf("invalid pkg-config package name: %s", pkg)
17+ }
18+ }
19++
20++ // Running 'pkg-config' can cause execution of
21++ // arbitrary code using flags that are not in
22++ // the safelist.
23++ if err := checkCompilerFlags("CFLAGS", "pkg-config --cflags", pcflags); err != nil {
24++ return nil, nil, err
25++ }
26++
27+ var out []byte
28+ out, err = b.runOut(nil, p.Dir, nil, b.PkgconfigCmd(), "--cflags", pcflags, "--", pkgs)
29+ if err != nil {
30+diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go
31+index db49eb6..288783d 100644
32+--- a/src/cmd/go/internal/work/security.go
33++++ b/src/cmd/go/internal/work/security.go
34+@@ -118,6 +118,7 @@ var validCompilerFlags = []*lazyregexp.Regexp{
35+ re(`-pedantic(-errors)?`),
36+ re(`-pipe`),
37+ re(`-pthread`),
38++ re(`--static`),
39+ re(`-?-std=([^@\-].*)`),
40+ re(`-?-stdlib=([^@\-].*)`),
41+ re(`--sysroot=([^@\-].*)`),
42+--
43+2.43.0
44+ 
Mgolang.spec+8-1
@@ -69,7 +69,7 @@
69 69 
70Name: golang70Name: golang
71Version: 1.21.471Version: 1.21.4
72-Release: 4472+Release: 45
73Summary: The Go Programming Language73Summary: The Go Programming Language
74License: BSD and Public Domain74License: BSD and Public Domain
75URL: https://golang.org/75URL: https://golang.org/
@@ -171,6 +171,7 @@ Patch6045: backport-0045-CVE-2025-47912-net-url-enforce-stricter-parsing.patch
171Patch6046: backport-0046-CVE-2025-58186-net-http-add-httpcookiemaxnum.patch171Patch6046: backport-0046-CVE-2025-58186-net-http-add-httpcookiemaxnum.patch
172Patch6047: backport-0047-CVE-2025-61729-crypto-x509-prevent-Hostname.patch172Patch6047: backport-0047-CVE-2025-61729-crypto-x509-prevent-Hostname.patch
173Patch6048: backport-0048-CVE-2025-61727-crypto-x509-excluded-subdomain.patch173Patch6048: backport-0048-CVE-2025-61727-crypto-x509-excluded-subdomain.patch
174+Patch6049: backport-0049-CVE-2025-61731.patch
174 175 
175# Part 10001-10999176# Part 10001-10999
176%ifarch sw_64177%ifarch sw_64
@@ -562,6 +563,12 @@ fi
562%files devel -f go-tests.list -f go-misc.list -f go-src.list563%files devel -f go-tests.list -f go-misc.list -f go-src.list
563 564 
564%changelog565%changelog
566+* Sat Feb 28 2026 rixian4857 <shihuiyuan@xfusion.com> - 1.21.4-45
567+- Type:CVE
568+- CVE:CVE-2025-61731
569+- SUG:NA
570+- DESC:fix CVE-2025-61731
571+ 
565* Thu Dec 4 2025 huzhangying <huzhangying@huawei.com> - 1.21.4-44572* Thu Dec 4 2025 huzhangying <huzhangying@huawei.com> - 1.21.4-44
566- Type:CVE573- Type:CVE
567- CVE:CVE-2025-61729,CVE-2025-61727574- CVE:CVE-2025-61729,CVE-2025-61727