microsoft · anphel31 · Sep 9, 2025 · Aug 5, 2025 · Aug 6, 2025 · Aug 7, 2025
@@ -145,7 +145,6 @@ extends:
                       maxCPU: "${{ configuration.maxCPUs }}"
                       outputArtifactsFolder: $(ob_outputDirectory)
                       outputRPMsTarballName: $(outputRPMsTarballName)
-                      pipArtifactFeeds: "mariner/Mariner-Pypi-Feed"
                       selfRepoName: self
                       testSuiteName: "[${{ configuration.name }}] Package test"
 
@@ -204,7 +203,6 @@ extends:
                       isUseCCache: true
                       maxCPU: "${{ configuration.maxCPUs }}"
                       outputArtifactsFolder: $(ob_outputDirectory)
-                      pipArtifactFeeds: "mariner/Mariner-Pypi-Feed"
                       selfRepoName: self
                       srpmPackList: "$(testListFromToolchain)"
                       testRerunList: "$(testListFromToolchain)"

@@ -121,10 +121,6 @@ parameters:
     type: string
     default: ""
 
-  - name: pipArtifactFeeds
-    type: string
-    default: ""
-
   - name: publishLogs
     type: boolean
     default: true
@@ -154,12 +150,6 @@ steps:
     parameters:
       buildRepoRoot: ${{ parameters.buildRepoRoot }}
 
-  - ${{ if parameters.pipArtifactFeeds }}:
-      - task: PipAuthenticate@1
-        inputs:
-          artifactFeeds: "${{ parameters.pipArtifactFeeds }}"
-        displayName: "Authenticate to custom pip artifact feeds"
-
   - ${{ if parameters.customToolchainTarballName }}:
       - script: |
           toolchain_archive="$(find "${{ parameters.inputArtifactsFolder }}" -name "${{ parameters.customToolchainTarballName }}" -print -quit)"

@@ -32,9 +32,7 @@ parameters:
     default: "$(Agent.TempDirectory)"
 
 steps:
-    # TODO: the "--index-url" argument must be removed once accessing internal ADO feeds from fork PR checks is supported.
-  - bash: pip3 install --user junit_xml==1.9 --index-url https://pypi.org/simple
-    retryCountOnTaskFailure: 3
+  - bash: sudo tdnf install -y python3-junit-xml
     displayName: "Install Python dependencies"
 
   - task: PythonScript@0

@@ -21,7 +21,7 @@
 Summary:        A command line tool used for creating OCI Images
 Name:           buildah
 Version:        1.18.0
-Release:        25%{?dist}
+Release:        26%{?dist}
 License:        ASL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -123,6 +123,9 @@ cp imgtype %{buildroot}/%{_bindir}/%{name}-imgtype
 %{_datadir}/%{name}/test
 
 %changelog
+* Thu Sep 04 2025 Akhila Guruju <[email protected]> - 1.18.0-26
+- Bump release to rebuild with golang
+
 * Mon Sep 09 2024 CBL-Mariner Servicing Account <[email protected]> - 1.18.0-25
 - Bump release to rebuild with go 1.22.7
 

@@ -24,7 +24,7 @@
 
 Name:          %{project}-%{repo}
 Version:       1.1.1
-Release:       16%{?dist}
+Release:       17%{?dist}
 Summary:       Libraries for writing CNI plugin
 License:       ASL 2.0 and BSD and MIT
 Vendor:        Microsoft Corporation
@@ -129,6 +129,9 @@ install -p plugins/ipam/dhcp/systemd/cni-dhcp.socket %{buildroot}%{_unitdir}
 %{_unitdir}/cni-dhcp.socket
 
 %changelog
+* Thu Sep 04 2025 Akhila Guruju <[email protected]> - 1.1.1-17
+- Bump release to rebuild with golang
+
 * Mon Sep 09 2024 CBL-Mariner Servicing Account <[email protected]> - 1.1.1-16
 - Bump release to rebuild with go 1.22.7
 

@@ -2,7 +2,7 @@ Vendor:         Microsoft Corporation
 Distribution:   Mariner
 Name:                   delve
 Version:                1.5.0
-Release:                19%{?dist}
+Release:                20%{?dist}
 Summary:                A debugger for the Go programming language
 
 License:                MIT
@@ -72,6 +72,9 @@ done
 
 
 %changelog
+* Thu Sep 04 2025 Akhila Guruju <[email protected]> - 1.5.0-20
+- Bump release to rebuild with golang
+
 * Mon Sep 09 2024 CBL-Mariner Servicing Account <[email protected]> - 1.5.0-19
 - Bump release to rebuild with go 1.22.7
 

@@ -2,7 +2,7 @@
 Summary:        Node Managed Identity
 Name:           nmi
 Version:        1.8.17
-Release:        5%{?dist}
+Release:        6%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -62,6 +62,9 @@ popd
 %{_bindir}/%{name}
 
 %changelog
+* Thu Sep 04 2025 Akhila Guruju <[email protected]> - 1.8.17-6
+- Bump release to rebuild with golang
+
 * Mon Sep 09 2024 CBL-Mariner Servicing Account <[email protected]> - 1.8.17-5
 - Bump release to rebuild with go 1.22.7
 

@@ -36,7 +36,7 @@
 
 Name:           podman
 Version:        4.1.1
-Release:        22%{?dist}
+Release:        23%{?dist}
 License:        ASL 2.0 and BSD and ISC and MIT and MPLv2.0
 Summary:        Manage Pods, Containers and Container Images
 Vendor:         Microsoft Corporation
@@ -387,6 +387,9 @@ cp -pav test/system %{buildroot}/%{_datadir}/%{name}/test/
 
 # rhcontainerbot account currently managed by lsm5
 %changelog
+* Thu Sep 04 2025 Akhila Guruju <[email protected]> - 4.1.1-23
+- Bump release to rebuild with golang
+
 * Mon Sep 09 2024 CBL-Mariner Servicing Account <[email protected]> - 4.1.1-22
 - Bump release to rebuild with go 1.22.7
 

@@ -1,7 +1,7 @@
 Summary:        Open Container Image manipulation tool
 Name:           umoci
 Version:        0.4.7
-Release:        17%{?dist}
+Release:        18%{?dist}
 License:        Apache-2.0
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -39,6 +39,9 @@ go test -mod=vendor
 %{_bindir}/umoci
 
 %changelog
+* Thu Sep 04 2025 Akhila Guruju <[email protected]> - 0.4.7-18
+- Bump release to rebuild with golang
+
 * Mon Sep 09 2024 CBL-Mariner Servicing Account <[email protected]> - 0.4.7-17
 - Bump release to rebuild with go 1.22.7
 

@@ -6,7 +6,7 @@
 Summary:        Signed HvLoader.efi for %{buildarch} systems
 Name:           hvloader-signed-%{buildarch}
 Version:        1.0.1
-Release:        13%{?dist}
+Release:        14%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -69,6 +69,9 @@ popd
 /boot/efi/HvLoader.efi
 
 %changelog
+* Tue Aug 12 2025 Azure Linux Security Servicing Account <[email protected]> - 1.0.1-14
+- Bump release for consistency with hvloader spec.
+
 * Tue May 13 2025 Archana Shettigar <[email protected]> - 1.0.1-13
 - Bump release for consistency with hvloader spec.
 

@@ -1,7 +1,7 @@
 Summary:        The KeysInUse Engine for OpenSSL allows the logging of private key usage through OpenSSL
 Name:           KeysInUse-OpenSSL
 Version:        0.3.4
-Release:        7%{?dist}
+Release:        8%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -74,6 +74,9 @@ if [ -x %{_bindir}/keysinuseutil ]; then
 fi
 
 %changelog
+* Thu Sep 04 2025 Akhila Guruju <[email protected]> - 0.3.4-8
+- Bump release to rebuild with golang
+
 * Mon Sep 09 2024 CBL-Mariner Servicing Account <[email protected]> - 0.3.4-7
 - Bump release to rebuild with go 1.22.7
 

@@ -0,0 +1,100 @@
+From b424803abdb2bec818e4fbcb251ce031c22aca53 Mon Sep 17 00:00:00 2001
+From: Gary Gregory <[email protected]>
+Date: Sat, 21 Sep 2024 17:23:08 -0400
+Subject: [PATCH] Rewrite ClassUtils.getClass() without recursion to avoid
+ StackOverflowError on very long inputs.
+
+- This was found fuzz testing Apache Commons Text which relies on
+ClassUtils.
+- OssFuzz Issue 42522972:
+apache-commons-text:StringSubstitutorInterpolatorFuzzer: Security
+exception in org.apache.commons.lang3.ClassUtils.getClass
+
+Upstream Patch Reference: https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53.patch
+---
+ src/changes/changes.xml                       |  1 +
+ .../org/apache/commons/lang3/ClassUtils.java  | 46 +++++++++----------
+ 2 files changed, 23 insertions(+), 24 deletions(-)
+
+diff --git a/src/changes/changes.xml b/src/changes/changes.xml
+index 5731324..dd2577b 100644
+--- a/src/changes/changes.xml
++++ b/src/changes/changes.xml
+@@ -47,6 +47,7 @@ The <action> type attribute can be add,update,fix,remove.
+
+   <release version="3.8.1" date="2018-09-19" description="This release is a bugfix for Restoring Bundle-SymbolicName in the MANIFEST.mf file.">
+     <action issue="LANG-1419" type="fix" dev="chtompki">Restore BundleSymbolicName for OSGi</action>
++    <action                   type="fix" dev="ggregory" due-to="OSS-Fuzz, Gary Gregory">Rewrite ClassUtils.getClass(...) without recursion to avoid StackOverflowError on very long inputs. OSS-Fuzz Issue 42522972: apache-commons-text:StringSubstitutorInterpolatorFuzzer: Security exception in org.apache.commons.lang3.ClassUtils.getClass.</action>
+   </release>
+
+   <release version="3.8" date="2018-08-15" description="New features and bug fixes. Requires Java 7, supports Java 8, 9, 10.">
+diff --git a/src/main/java/org/apache/commons/lang3/ClassUtils.java b/src/main/java/org/apache/commons/lang3/ClassUtils.java
+index be9f0dd..a9ec195 100644
+--- a/src/main/java/org/apache/commons/lang3/ClassUtils.java
++++ b/src/main/java/org/apache/commons/lang3/ClassUtils.java
+@@ -985,30 +985,27 @@ public class ClassUtils {
+      */
+     public static Class<?> getClass(
+             final ClassLoader classLoader, final String className, final boolean initialize) throws ClassNotFoundException {
+-        try {
+-            Class<?> clazz;
+-            if (namePrimitiveMap.containsKey(className)) {
+-                clazz = namePrimitiveMap.get(className);
+-            } else {
+-                clazz = Class.forName(toCanonicalName(className), initialize, classLoader);
+-            }
+-            return clazz;
+-        } catch (final ClassNotFoundException ex) {
+-            // allow path separators (.) as inner class name separators
+-            final int lastDotIndex = className.lastIndexOf(PACKAGE_SEPARATOR_CHAR);
+-
+-            if (lastDotIndex != -1) {
+-                try {
+-                    return getClass(classLoader, className.substring(0, lastDotIndex) +
+-                            INNER_CLASS_SEPARATOR_CHAR + className.substring(lastDotIndex + 1),
+-                            initialize);
+-                } catch (final ClassNotFoundException ex2) { // NOPMD
+-                    // ignore exception
++        // This method was re-written to avoid recursion and stack overflows found by fuzz testing.
++        String next = className;
++        int lastDotIndex = -1;
++        do {
++            try {
++                Class<?> clazz;
++                if (namePrimitiveMap.containsKey(next)) {
++                    clazz = namePrimitiveMap.get(next);
++                } else {
++                    clazz = Class.forName(toCanonicalName(next), initialize, classLoader);
++                }
++                return clazz;
++            } catch (final ClassNotFoundException ex) {
++                lastDotIndex = next.lastIndexOf(PACKAGE_SEPARATOR_CHAR);
++                if (lastDotIndex != -1) {
++                    next = next.substring(0, lastDotIndex) +
++                            INNER_CLASS_SEPARATOR_CHAR + next.substring(lastDotIndex + 1);
+                 }
+             }
+-
+-            throw ex;
+-        }
++        } while (lastDotIndex != -1);
++        throw new ClassNotFoundException(next);
+     }
+
+     /**
+@@ -1124,9 +1121,10 @@ public class ClassUtils {
+     private static String toCanonicalName(String className) {
+         className = StringUtils.deleteWhitespace(className);
+         Validate.notNull(className, "className must not be null.");
+-        if (className.endsWith("[]")) {
++        final String arrayMarker = "[]";
++        if (className.endsWith(arrayMarker)) {
+             final StringBuilder classNameBuffer = new StringBuilder();
+-            while (className.endsWith("[]")) {
++            while (className.endsWith(arrayMarker)) {
+                 className = className.substring(0, className.length() - 2);
+                 classNameBuffer.append("[");
+             }
+-- 
+2.34.1
+
@@ -18,7 +18,7 @@
 Summary:        Apache Commons Lang Package
 Name:           apache-%{short_name}
 Version:        3.8.1
-Release:        5%{?dist}
+Release:        6%{?dist}
 License:        Apache-2.0
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -27,6 +27,7 @@ URL:            https://commons.apache.org/proper/commons-lang
 Source0:        https://archive.apache.org/dist/commons/lang/source/%{short_name}-%{version}-src.tar.gz
 Source1:        build.xml
 Source2:        default.properties
+Patch0:         CVE-2025-48924.patch
 BuildRequires:  ant
 BuildRequires:  ant-junit
 BuildRequires:  fdupes
@@ -57,7 +58,8 @@ Group:          Documentation/HTML
 Javadoc for %{name}.
 
 %prep
-%setup -q -n %{short_name}-%{version}-src
+
+%autosetup -n %{short_name}-%{version}-src -p1
 cp %{SOURCE1} .
 cp %{SOURCE2} .
 sed -i 's/\r//' *.txt
@@ -98,6 +100,9 @@ cp -pr target/apidocs/* %{buildroot}%{_javadocdir}/%{name}/
 %{_javadocdir}/%{name}
 
 %changelog
+* Wed Jul 16 2025 Aninda Pradhan <[email protected]> - 3.8.1-6
+- Addressed CVE-2025-48924
+
 * Fri Mar 17 2023 Mykhailo Bykhovtsev <[email protected]> - 3.8.1-5
 - Moved from extended to core
 - License verified

@@ -0,0 +1,30 @@
+From 1dfb03ca74b78ff4a87b48a70b91a5cfc985f9c4 Mon Sep 17 00:00:00 2001
+From: dj_palli <[email protected]>
+Date: Thu, 12 Jun 2025 20:49:56 +0000
+Subject: [PATCH] Address CVE-2023-53154
+
+Upstream Patch Reference: https://github.com/DaveGamble/cJSON/commit/3ef4e4e730e5efd381be612df41e1ff3f5bb3c32
+
+---
+ binutils/cJSON.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/binutils/cJSON.c b/binutils/cJSON.c
+index e85ac11..45c1c45 100644
+--- a/binutils/cJSON.c
++++ b/binutils/cJSON.c
+@@ -1650,6 +1650,11 @@ static cJSON_bool parse_object(cJSON * const item, parse_buffer * const input_bu
+             current_item = new_item;
+         }
+
++	if (cannot_access_at_index(input_buffer, 1))
++        {
++            goto fail; /* nothing comes after the comma */
++        }
++
+         /* parse the name of the child */
+         input_buffer->offset++;
+         buffer_skip_whitespace(input_buffer);
+-- 
+2.45.2
+