Skip to content

[AutoPR- Security] Patch cmake for CVE-2025-14017 [MEDIUM] #15475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kgodara912 merged 2 commits into from
Jan 20, 2026
Merged

[AutoPR- Security] Patch cmake for CVE-2025-14017 [MEDIUM] #15475

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1e6cbf4
Patch cmake for CVE-2025-14017
azurelinux-security Jan 9, 2026
701276a
manually backported the patch
BinduSri-6522866 Jan 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
117 changes: 117 additions & 0 deletions SPECS/cmake/CVE-2025-14017.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,117 @@
From 1d14696f2939b065332bcd54a42fbac46bee9ff5 Mon Sep 17 00:00:00 2001
From: AllSpark <allspark@microsoft.com>
Date: Fri, 9 Jan 2026 04:45:45 +0000
Subject: [PATCH] ldap: call ldap_init() before setting the options

Closes #19830

Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: AI Backport of https://github.com/curl/curl/commit/39d1976b7f709a516e324333.patch
---
Utilities/cmcurl/lib/ldap.c | 49 ++++++++++++++-----------------------
1 file changed, 19 insertions(+), 30 deletions(-)

diff --git a/Utilities/cmcurl/lib/ldap.c b/Utilities/cmcurl/lib/ldap.c
index 678b4d5a..b664e991 100644
--- a/Utilities/cmcurl/lib/ldap.c
+++ b/Utilities/cmcurl/lib/ldap.c
@@ -364,16 +364,29 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
passwd = conn->passwd;
}

+#ifdef USE_WIN32_LDAP
+ if(ldap_ssl)
+ server = ldap_sslinit(host, conn->primary.remote_port, 1);
+ else
+#else
+ server = ldap_init(host, conn->primary.remote_port);
+#endif
+ if(!server) {
+ failf(data, "LDAP: cannot setup connect to %s:%u",
+ conn->host.dispname, conn->primary.remote_port);
+ result = CURLE_COULDNT_CONNECT;
+ goto quit;
+ }
+
#ifdef LDAP_OPT_NETWORK_TIMEOUT
- ldap_set_option(NULL, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
+ ldap_set_option(server, LDAP_OPT_NETWORK_TIMEOUT, &ldap_timeout);
#endif
- ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
+ ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);

if(ldap_ssl) {
#ifdef HAVE_LDAP_SSL
#ifdef USE_WIN32_LDAP
/* Win32 LDAP SDK doesn't support insecure mode without CA! */
- server = ldap_sslinit(host, conn->primary.remote_port, 1);
ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON);
#else
int ldap_option;
@@ -441,7 +454,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
goto quit;
}
infof(data, "LDAP local: using PEM CA cert: %s", ldap_ca);
- rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
+ rc = ldap_set_option(server, LDAP_OPT_X_TLS_CACERTFILE, ldap_ca);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ERROR setting PEM CA cert: %s",
ldap_err2string(rc));
@@ -453,20 +466,13 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
else
ldap_option = LDAP_OPT_X_TLS_NEVER;

- rc = ldap_set_option(NULL, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
+ rc = ldap_set_option(server, LDAP_OPT_X_TLS_REQUIRE_CERT, &ldap_option);
if(rc != LDAP_SUCCESS) {
failf(data, "LDAP local: ERROR setting cert verify mode: %s",
ldap_err2string(rc));
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
- server = ldap_init(host, conn->primary.remote_port);
- if(!server) {
- failf(data, "LDAP local: Cannot connect to %s:%u",
- conn->host.dispname, conn->primary.remote_port);
- result = CURLE_COULDNT_CONNECT;
- goto quit;
- }
ldap_option = LDAP_OPT_X_TLS_HARD;
rc = ldap_set_option(server, LDAP_OPT_X_TLS, &ldap_option);
if(rc != LDAP_SUCCESS) {
@@ -475,15 +481,6 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
result = CURLE_SSL_CERTPROBLEM;
goto quit;
}
-/*
- rc = ldap_start_tls_s(server, NULL, NULL);
- if(rc != LDAP_SUCCESS) {
- failf(data, "LDAP local: ERROR starting SSL/TLS mode: %s",
- ldap_err2string(rc));
- result = CURLE_SSL_CERTPROBLEM;
- goto quit;
- }
-*/
#else
(void)ldap_option;
(void)ldap_ca;
@@ -502,15 +499,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
result = CURLE_NOT_BUILT_IN;
goto quit;
}
- else {
- server = ldap_init(host, conn->primary.remote_port);
- if(!server) {
- failf(data, "LDAP local: Cannot connect to %s:%u",
- conn->host.dispname, conn->primary.remote_port);
- result = CURLE_COULDNT_CONNECT;
- goto quit;
- }
- }
+
#ifdef USE_WIN32_LDAP
ldap_set_option(server, LDAP_OPT_PROTOCOL_VERSION, &ldap_proto);
rc = ldap_win_bind(data, server, user, passwd);
--
2.45.4

6 changes: 5 additions & 1 deletion SPECS/cmake/cmake.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
Summary: Cmake
Name: cmake
Version: 3.30.3
Release: 10%{?dist}
Release: 11%{?dist}
License: BSD AND LGPLv2+
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand Down Expand Up @@ -32,6 +32,7 @@ Patch12: CVE-2025-5917.patch
Patch13: CVE-2025-5918.patch
Patch14: CVE-2025-9301.patch
Patch15: CVE-2025-10148.patch
Patch16: CVE-2025-14017.patch

BuildRequires: bzip2
BuildRequires: bzip2-devel
Expand Down Expand Up @@ -112,6 +113,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure
%{_libdir}/rpm/macros.d/macros.cmake

%changelog
* Fri Jan 09 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.30.3-11
- Patch for CVE-2025-14017

* Sat Sep 13 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.30.3-10
- Patch for CVE-2025-10148

Expand Down
4 changes: 2 additions & 2 deletions toolkit/resources/manifests/package/toolchain_aarch64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,8 @@ check-debuginfo-0.15.2-1.azl3.aarch64.rpm
chkconfig-1.25-1.azl3.aarch64.rpm
chkconfig-debuginfo-1.25-1.azl3.aarch64.rpm
chkconfig-lang-1.25-1.azl3.aarch64.rpm
cmake-3.30.3-10.azl3.aarch64.rpm
cmake-debuginfo-3.30.3-10.azl3.aarch64.rpm
cmake-3.30.3-11.azl3.aarch64.rpm
cmake-debuginfo-3.30.3-11.azl3.aarch64.rpm
coreutils-9.4-6.azl3.aarch64.rpm
coreutils-debuginfo-9.4-6.azl3.aarch64.rpm
coreutils-lang-9.4-6.azl3.aarch64.rpm
Expand Down
4 changes: 2 additions & 2 deletions toolkit/resources/manifests/package/toolchain_x86_64.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,8 +54,8 @@ check-debuginfo-0.15.2-1.azl3.x86_64.rpm
chkconfig-1.25-1.azl3.x86_64.rpm
chkconfig-debuginfo-1.25-1.azl3.x86_64.rpm
chkconfig-lang-1.25-1.azl3.x86_64.rpm
cmake-3.30.3-10.azl3.x86_64.rpm
cmake-debuginfo-3.30.3-10.azl3.x86_64.rpm
cmake-3.30.3-11.azl3.x86_64.rpm
cmake-debuginfo-3.30.3-11.azl3.x86_64.rpm
coreutils-9.4-6.azl3.x86_64.rpm
coreutils-debuginfo-9.4-6.azl3.x86_64.rpm
coreutils-lang-9.4-6.azl3.x86_64.rpm
Expand Down
Loading