Skip to content

Commit 1e6cbf4

Browse files
azurelinux-securityazurelinux-security
committed
Patch cmake for CVE-2025-14017 
1 parent 99c4a16 commit 1e6cbf4

File tree

4 files changed

+99
-5
lines changed

4 files changed

+99
-5
lines changed

‎SPECS/cmake/CVE-2025-14017.patch‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
From 1d14696f2939b065332bcd54a42fbac46bee9ff5 Mon Sep 17 00:00:00 2001
2+
From: AllSpark <allspark@microsoft.com>
3+
Date: Fri, 9 Jan 2026 04:45:45 +0000
4+
Subject: [PATCH] ldap: call ldap_init() before setting the options
5+
6+
Closes #19830
7+
8+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
9+
Upstream-reference: AI Backport of https://github.com/curl/curl/commit/39d1976b7f709a516e324333.patch
10+
---
11+
Utilities/cmcurl/lib/ldap.c | 35 +++++++++++++++++++++--------------
12+
1 file changed, 21 insertions(+), 14 deletions(-)
13+
14+
diff --git a/Utilities/cmcurl/lib/ldap.c b/Utilities/cmcurl/lib/ldap.c
15+
index 678b4d5a..7c0f69c1 100644
16+
--- a/Utilities/cmcurl/lib/ldap.c
17+
+++ b/Utilities/cmcurl/lib/ldap.c
18+
@@ -364,16 +364,31 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
19+
passwd = conn->passwd;
20+
}
21+
22+
+#if defined(USE_WIN32_LDAP)
23+
+ if(ldap_ssl)
24+
+ server = ldap_sslinit(host, conn->primary.remote_port, 1);
25+
+ else
26+
+ server = ldap_init(host, conn->primary.remote_port);
27+
+#else
28+
+ server = ldap_init(host, conn->primary.remote_port);
29+
+#endif
30+
+ if(!server) {
31+
+ failf(data, "LDAP local: Cannot connect to %s:%u",
32+
+ conn->host.dispname, conn->primary.remote_port);
33+
+ result = CURLE_COULDNT_CONNECT;
34+
+ goto quit;
35+
+ }
36+
+
37+
+
38+
#ifdef LDAP_OPT_NETWORK_TIMEOUT
39+
- ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
40+
+ ldap_set_option(server, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
41+
#endif
42+
- ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
43+
+ ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
44+
45+
if(ldap_ssl) {
46+
#ifdef HAVE_LDAP_SSL
47+
#ifdef USE_WIN32_LDAP
48+
/* Win32 LDAP SDK doesn't support insecure mode without CA! */
49+
- server = ldap_sslinit(host, conn->primary.remote_port, 1);
50+
ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON);
51+
#else
52+
int ldap_option;
53+
@@ -441,7 +456,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
54+
goto quit;
55+
}
56+
infof(data, "LDAP local: using PEM CA cert: %s", ldap_ca);
57+
- rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
58+
+ rc = ldap_set_option(server, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
59+
if(rc != LDAP_SUCCESS) {
60+
failf(data, "LDAP local: ERROR setting PEM CA cert: %s",
61+
ldap_err2string(rc));
62+
@@ -453,7 +468,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
63+
else
64+
ldap_option = LDAP_OPT_X_TLS_NEVER;
65+
66+
- rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
67+
+ rc = ldap_set_option(server, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
68+
if(rc != LDAP_SUCCESS) {
69+
failf(data, "LDAP local: ERROR setting cert verify mode: %s",
70+
ldap_err2string(rc));
71+
@@ -502,15 +517,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
72+
result = CURLE_NOT_BUILT_IN;
73+
goto quit;
74+
}
75+
- else {
76+
- server = ldap_init(host, conn->primary.remote_port);
77+
- if(!server) {
78+
- failf(data, "LDAP local: Cannot connect to %s:%u",
79+
- conn->host.dispname, conn->primary.remote_port);
80+
- result = CURLE_COULDNT_CONNECT;
81+
- goto quit;
82+
- }
83+
- }
84+
+
85+
#ifdef USE_WIN32_LDAP
86+
ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
87+
rc = ldap_win_bind(data, server, user, passwd);
88+
--
89+
2.45.4
90+

‎SPECS/cmake/cmake.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Cmake
33
Name: cmake
44
Version: 3.30.3
5-
Release: 10%{?dist}
5+
Release: 11%{?dist}
66
License: BSD AND LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
@@ -32,6 +32,7 @@ Patch12: CVE-2025-5917.patch
3232
Patch13: CVE-2025-5918.patch
3333
Patch14: CVE-2025-9301.patch
3434
Patch15: CVE-2025-10148.patch
35+
Patch16: CVE-2025-14017.patch
3536

3637
BuildRequires: bzip2
3738
BuildRequires: bzip2-devel
@@ -112,6 +113,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
112113
%{_libdir}/rpm/macros.d/macros.cmake
113114

114115
%changelog
116+
* Fri Jan 09 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.30.3-11
117+
- Patch for CVE-2025-14017
118+
115119
* Sat Sep 13 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.30.3-10
116120
- Patch for CVE-2025-10148
117121

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,8 @@ check-debuginfo-0.15.2-1.azl3.aarch64.rpm
5151
chkconfig-1.25-1.azl3.aarch64.rpm
5252
chkconfig-debuginfo-1.25-1.azl3.aarch64.rpm
5353
chkconfig-lang-1.25-1.azl3.aarch64.rpm
54-
cmake-3.30.3-10.azl3.aarch64.rpm
55-
cmake-debuginfo-3.30.3-10.azl3.aarch64.rpm
54+
cmake-3.30.3-11.azl3.aarch64.rpm
55+
cmake-debuginfo-3.30.3-11.azl3.aarch64.rpm
5656
coreutils-9.4-6.azl3.aarch64.rpm
5757
coreutils-debuginfo-9.4-6.azl3.aarch64.rpm
5858
coreutils-lang-9.4-6.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,8 @@ check-debuginfo-0.15.2-1.azl3.x86_64.rpm
5454
chkconfig-1.25-1.azl3.x86_64.rpm
5555
chkconfig-debuginfo-1.25-1.azl3.x86_64.rpm
5656
chkconfig-lang-1.25-1.azl3.x86_64.rpm
57-
cmake-3.30.3-10.azl3.x86_64.rpm
58-
cmake-debuginfo-3.30.3-10.azl3.x86_64.rpm
57+
cmake-3.30.3-11.azl3.x86_64.rpm
58+
cmake-debuginfo-3.30.3-11.azl3.x86_64.rpm
5959
coreutils-9.4-6.azl3.x86_64.rpm
6060
coreutils-debuginfo-9.4-6.azl3.x86_64.rpm
6161
coreutils-lang-9.4-6.azl3.x86_64.rpm

0 commit comments

Comments
 (0)