已开启
fix(cve): 修复 CVE-2025-27821 在 hadoop 中的漏洞 #140
infra_team创建于 6月18日
fix(cve): 修复 CVE-2025-27821 在 hadoop 中的漏洞 #140
已开启
共 2 个文件变更+25-1
| @@ -0,0 +1,17 @@ | |||
| 1 | +diff --git a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser2.c b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser2.c | ||
| 2 | +--- a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser2.c | ||
| 3 | ++++ b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser2.c | ||
| 4 | + | ||
| 5 | + static int parse_int(const char *first, const char *after_last) { | ||
| 6 | + const int size = after_last - first; | ||
| 7 | + if (size) { | ||
| 8 | +- char buffer[size + 1]; | ||
| 9 | ++ char* buffer = (char*) malloc(size + 1); | ||
| 10 | + memcpyz(buffer, first, size); | ||
| 11 | +- return atoi(buffer); | ||
| 12 | ++ const int value = atoi(buffer); | ||
| 13 | ++ free(buffer); | ||
| 14 | ++ return value; | ||
| 15 | + } | ||
| 16 | + return 0; | ||
| 17 | + } | ||
| @@ -13,7 +13,7 @@ | |||
| 13 | 13 | ||
| 14 | Name: hadoop | 14 | Name: hadoop |
| 15 | Version: 3.3.6 | 15 | Version: 3.3.6 |
| 16 | -Release: 8 | 16 | +Release: 9 |
| 17 | Summary: A software platform for processing vast amounts of data | 17 | Summary: A software platform for processing vast amounts of data |
| 18 | # The BSD license file is missing | 18 | # The BSD license file is missing |
| 19 | # https://issues.apache.org/jira/browse/HADOOP-9849 | 19 | # https://issues.apache.org/jira/browse/HADOOP-9849 |
| @@ -46,6 +46,7 @@ Patch0: 01-lock-triple-beam-version-to-1.3.0.patch | |||
| 46 | Patch1: 02-Upgrade-os-maven-plugin-to-1.7.1.patch | 46 | Patch1: 02-Upgrade-os-maven-plugin-to-1.7.1.patch |
| 47 | Patch2: 03-Fix-build-on-riscv.patch | 47 | Patch2: 03-Fix-build-on-riscv.patch |
| 48 | Patch3: 04-Enhance-access-control-for-RunJar.patch | 48 | Patch3: 04-Enhance-access-control-for-RunJar.patch |
| 49 | +Patch4: CVE-2025-27821-fix-uriparser2.patch | ||
| 49 | 50 | ||
| 50 | Patch1000: 1000-Added-support-for-building-the-riscv64-protoc-binari.patch | 51 | Patch1000: 1000-Added-support-for-building-the-riscv64-protoc-binari.patch |
| 51 | Patch1001: 1001-Added-support-for-building-the-riscv64-protoc-gen-gr.patch | 52 | Patch1001: 1001-Added-support-for-building-the-riscv64-protoc-gen-gr.patch |
| @@ -306,6 +307,8 @@ mvn install:install-file -DgroupId=com.google.protobuf -DartifactId=protoc -Dver | |||
| 306 | %patch0 -p1 | 307 | %patch0 -p1 |
| 307 | %patch1 -p1 | 308 | %patch1 -p1 |
| 308 | %patch2 -p1 | 309 | %patch2 -p1 |
| 310 | +%patch3 -p1 | ||
| 311 | +%patch4 -p1 | ||
| 309 | %else | 312 | %else |
| 310 | %setup -n %{name}-%{version}-src | 313 | %setup -n %{name}-%{version}-src |
| 311 | %autopatch -M999 -p1 | 314 | %autopatch -M999 -p1 |
| @@ -1206,6 +1209,10 @@ fi | |||
| 1206 | %config(noreplace) %{_sysconfdir}/%{name}/container-executor.cfg | 1209 | %config(noreplace) %{_sysconfdir}/%{name}/container-executor.cfg |
| 1207 | 1210 | ||
| 1208 | %changelog | 1211 | %changelog |
| 1212 | +* Thu Jun 18 2026 infra_team <zhaiwenjie1@huawei.com> - 3.3.6-9 | ||
| 1213 | +- fix CVE: CVE-2025-27821 | ||
| 1214 | +- Replace VLA with malloc in parse_int function of uriparser2 to fix out-of-bounds write vulnerability | ||
| 1215 | + | ||
| 1209 | * Mon Dec 16 2024 shenzhongwei <shenzhongwei@kylinos.cn> - 3.3.6-8 | 1216 | * Mon Dec 16 2024 shenzhongwei <shenzhongwei@kylinos.cn> - 3.3.6-8 |
| 1210 | - include all patches in the source package. | 1217 | - include all patches in the source package. |
| 1211 | 1218 | ||