[AutoPR- Security] Patch golang for CVE-2025-61724, CVE-2025-58188 [MEDIUM]

SPECS/golang/CVE-2025-58188.patch

@@ -0,0 +1,32 @@
+From 1ef19d713437251dd87cc862945ca7dc3483734e Mon Sep 17 00:00:00 2001
+From: AllSpark <[email protected]>
+Date: Sun, 16 Nov 2025 04:39:41 +0000
+Subject: [PATCH] crypto/x509: mitigate DoS vector when intermediate
+ certificate contains DSA public key\n\nWe enforce the canonical encoding of
+ SPKI and compare RawSubjectPublicKeyInfo bytes to avoid panics with DSA
+ public keys in intermediates. Add test to ensure chain validation fails
+ appropriately when an intermediate contains a DSA SPKI.\n\nBackport of
+ upstream fix.
+
+Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
+Upstream-reference: AI Backport of https://github.com/golang/go/commit/f9f198ab05e3282cbf6b13251d47d9141981e401.patch
+---
+ src/crypto/x509/verify_test.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/crypto/x509/verify_test.go b/src/crypto/x509/verify_test.go
+index 0961c5b..60a4cea 100644
+--- a/src/crypto/x509/verify_test.go
++++ b/src/crypto/x509/verify_test.go
+@@ -3119,7 +3119,7 @@ func dsaSelfSignedCNX(t *testing.T) []byte {
+ 	t.Helper()
+ 	var params dsa.Parameters
+ 	if err := dsa.GenerateParameters(&params, rand.Reader, dsa.L1024N160); err != nil {
+-		t.Skip(err) // CBL-Mariner doesn't support dsa.L1024N160, skip test
++		t.Fatal(err)
+ 	}
+
+ 	var dsaPriv dsa.PrivateKey
+-- 
+2.45.4
+

SPECS/golang/CVE-2025-61724.patch

@@ -0,0 +1,27 @@
+From 977334add50982e5dd56a04b94a7276bb005be40 Mon Sep 17 00:00:00 2001
+From: AllSpark <[email protected]>
+Date: Sun, 16 Nov 2025 04:39:49 +0000
+Subject: [PATCH] net/textproto: avoid quadratic complexity in
+ Reader.ReadResponse by using strings.Builder
+
+Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
+Upstream-reference: AI Backport of https://github.com/golang/go/commit/5d7a787aa2b486f77537eeaed9c38c940a7182b8.patch
+---
+ src/net/textproto/reader.go | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/net/textproto/reader.go b/src/net/textproto/reader.go
+index 94e3e0b..574f6c8 100644
+--- a/src/net/textproto/reader.go
++++ b/src/net/textproto/reader.go
+@@ -286,6 +286,7 @@ func (r *Reader) ReadCodeLine(expectCode int) (code int, message string, err err
+ func (r *Reader) ReadResponse(expectCode int) (code int, message string, err error) {
+ 	code, continued, first, err := r.readCodeLine(expectCode)
+ 	multi := continued
++	// Use strings.Builder to construct message to avoid quadratic complexity from repeated concatenation
+ 	var messageBuilder strings.Builder
+ 	messageBuilder.WriteString(first)
+ 	for continued {
+-- 
+2.45.4
+

SPECS/golang/golang.spec

@@ -15,7 +15,7 @@
 Summary:        Go
 Name:           golang
 Version:        1.25.3
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        BSD-3-Clause
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -26,6 +26,8 @@ Source0:        https://github.com/microsoft/go/releases/download/v%{version}-%{
 # bootstrap 00, same content as https://dl.google.com/go/go1.4-bootstrap-20171003.tar.gz
 Source1:        https://github.com/microsoft/go/releases/download/v1.4.0-1/go1.4-bootstrap-20171003.tar.gz
 Patch0:         go14_bootstrap_aarch64.patch
+Patch1:         CVE-2025-58188.patch
+Patch2:         CVE-2025-61724.patch
 # bootstrap 01
 Source2:        https://github.com/microsoft/go/releases/download/v1.19.12-1/go.20230802.5.src.tar.gz
 # bootstrap 02
@@ -57,6 +59,8 @@ tar xf %{SOURCE4} --no-same-owner
 mv -v go go-bootstrap-03
 
 %setup -q -n go
+%patch 1 -p1
+%patch 2 -p1
 
 %build
 # go 1.4 bootstraps with C.
@@ -160,6 +164,9 @@ fi
 %{_bindir}/*
 
 %changelog
+* Sun Nov 16 2025 Azure Linux Security Servicing Account <[email protected]> - 1.25.3-2
+- Patch for CVE-2025-61724, CVE-2025-58188
+
 * Tue Oct 14 2025 bot-for-go[bot] <199222863+bot-for-go[bot]@users.noreply.github.com> - 1.25.3-1
 - Bump version to 1.25.3-1