已开启
Fix-CVE-2025-61732 #599
hlhtbd01创建于 2月28日
Fix-CVE-2025-61732 #599
已开启
共 2 个文件变更+54-1
| @@ -0,0 +1,46 @@ | |||
| 1 | +From b19100991ac6d096e67cead47392049c178fd5ab Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Neal Patel <nealpatel@google.com> | ||
| 3 | +Date: Tue, 6 Jan 2026 16:09:19 -0500 | ||
| 4 | +Subject: [PATCH] [release-branch.go1.25] cmd/go: remove user-content from doc | ||
| 5 | + strings in cgo ASTs. | ||
| 6 | + | ||
| 7 | +Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue. | ||
| 8 | + | ||
| 9 | +Updates #76697 | ||
| 10 | +Fixes #77129 | ||
| 11 | +Fixes CVE-2025-61732 | ||
| 12 | + | ||
| 13 | +Change-Id: I9ecbef556f6e545fb152407041cd086c069f22d1 | ||
| 14 | +Reviewed-on: https://go-review.googlesource.com/c/go/+/740040 | ||
| 15 | +Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> | ||
| 16 | +LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> | ||
| 17 | +Reviewed-by: Roland Shoemaker <roland@golang.org> | ||
| 18 | +--- | ||
| 19 | + src/cmd/cgo/ast.go | 11 +++-------- | ||
| 20 | + 1 file changed, 3 insertions(+), 8 deletions(-) | ||
| 21 | + | ||
| 22 | +diff --git a/src/cmd/cgo/ast.go b/src/cmd/cgo/ast.go | ||
| 23 | +index 861479db7acf5b..11f5831ccdfeae 100644 | ||
| 24 | +--- a/src/cmd/cgo/ast.go | ||
| 25 | ++++ b/src/cmd/cgo/ast.go | ||
| 26 | +@@ -301,17 +301,12 @@ func (f *File) saveExport(x interface{}, context astContext) { | ||
| 27 | + error_(c.Pos(), "export comment has wrong name %q, want %q", name, n.Name.Name) | ||
| 28 | + } | ||
| 29 | + | ||
| 30 | +- doc := "" | ||
| 31 | +- for _, c1 := range n.Doc.List { | ||
| 32 | +- if c1 != c { | ||
| 33 | +- doc += c1.Text + "\n" | ||
| 34 | +- } | ||
| 35 | +- } | ||
| 36 | +- | ||
| 37 | + f.ExpFunc = append(f.ExpFunc, &ExpFunc{ | ||
| 38 | + Func: n, | ||
| 39 | + ExpName: name, | ||
| 40 | +- Doc: doc, | ||
| 41 | ++ // Caution: Do not set the Doc field on purpose | ||
| 42 | ++ // to ensure that there are no unintended artifacts | ||
| 43 | ++ // in the binary. See https://go.dev/issue/76697. | ||
| 44 | + }) | ||
| 45 | + break | ||
| 46 | + } | ||
| @@ -69,7 +69,7 @@ | |||
| 69 | 69 | ||
| 70 | Name: golang | 70 | Name: golang |
| 71 | Version: 1.21.4 | 71 | Version: 1.21.4 |
| 72 | -Release: 44 | 72 | +Release: 45 |
| 73 | Summary: The Go Programming Language | 73 | Summary: The Go Programming Language |
| 74 | License: BSD and Public Domain | 74 | License: BSD and Public Domain |
| 75 | URL: https://golang.org/ | 75 | URL: https://golang.org/ |
| @@ -171,6 +171,7 @@ Patch6045: backport-0045-CVE-2025-47912-net-url-enforce-stricter-parsing.patch | |||
| 171 | Patch6046: backport-0046-CVE-2025-58186-net-http-add-httpcookiemaxnum.patch | 171 | Patch6046: backport-0046-CVE-2025-58186-net-http-add-httpcookiemaxnum.patch |
| 172 | Patch6047: backport-0047-CVE-2025-61729-crypto-x509-prevent-Hostname.patch | 172 | Patch6047: backport-0047-CVE-2025-61729-crypto-x509-prevent-Hostname.patch |
| 173 | Patch6048: backport-0048-CVE-2025-61727-crypto-x509-excluded-subdomain.patch | 173 | Patch6048: backport-0048-CVE-2025-61727-crypto-x509-excluded-subdomain.patch |
| 174 | +Patch6049: backport-0049-CVE-2025-61732-golang.patch | ||
| 174 | 175 | ||
| 175 | # Part 10001-10999 | 176 | # Part 10001-10999 |
| 176 | %ifarch sw_64 | 177 | %ifarch sw_64 |
| @@ -562,6 +563,12 @@ fi | |||
| 562 | %files devel -f go-tests.list -f go-misc.list -f go-src.list | 563 | %files devel -f go-tests.list -f go-misc.list -f go-src.list |
| 563 | 564 | ||
| 564 | %changelog | 565 | %changelog |
| 566 | +* Sat Feb 28 2026 yezixin <yezixin@xfusion.com> - 1.21.4-45 | ||
| 567 | +- Type:CVE | ||
| 568 | +- CVE:CVE-2025-61732 | ||
| 569 | +- SUG:NA | ||
| 570 | +- DESC:fix-CVE-2025-61732 | ||
| 571 | + | ||
| 565 | * Thu Dec 4 2025 huzhangying <huzhangying@huawei.com> - 1.21.4-44 | 572 | * Thu Dec 4 2025 huzhangying <huzhangying@huawei.com> - 1.21.4-44 |
| 566 | - Type:CVE | 573 | - Type:CVE |
| 567 | - CVE:CVE-2025-61729,CVE-2025-61727 | 574 | - CVE:CVE-2025-61729,CVE-2025-61727 |