diff --git a/SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec b/SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec index 4f16c1c353c..611b313da28 100644 --- a/SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec +++ b/SPECS-SIGNED/edk2-hvloader-signed/edk2-hvloader-signed.spec @@ -11,7 +11,7 @@ Summary: Signed HvLoader.efi for %{buildarch} systems Name: edk2-hvloader-signed-%{buildarch} Version: %{GITDATE}git%{GITCOMMIT} -Release: 12%{?dist} +Release: 13%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Azure Linux @@ -74,7 +74,10 @@ popd /boot/efi/HvLoader.efi %changelog -* Tue Jan 06 2026 Azure Linux Security Servicing Account - 20240524git3e722403cd16-12 +* Sun Feb 01 2026 Azure Linux Security Servicing Account - 20240524git3e722403cd16-13 +- Bump release for consistency with edk2 spec. + +* Fri Jan 30 2026 Azure Linux Security Servicing Account - 20240524git3e722403cd16-12 - Bump release for consistency with edk2 spec. * Thu Dec 18 2025 Jyoti kanase - 20240524git3e722403cd16-11 diff --git a/SPECS/edk2/CVE-2025-15467.patch b/SPECS/edk2/CVE-2025-15467.patch new file mode 100644 index 00000000000..05d6dc686a8 --- /dev/null +++ b/SPECS/edk2/CVE-2025-15467.patch @@ -0,0 +1,43 @@ +From 636fb597f7690441e1003b46e206f0ea96b4dc02 Mon Sep 17 00:00:00 2001 +From: Igor Ustinov +Date: Mon, 12 Jan 2026 12:13:35 +0100 +Subject: [PATCH] Correct handling of AEAD-encrypted CMS with inadmissibly long + IV +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Fixes CVE-2025-15467 + +Reviewed-by: Saša Nedvědický +Reviewed-by: Norbert Pocs +Reviewed-by: Eugene Syromiatnikov +Reviewed-by: Tomas Mraz +MergeDate: Mon Jan 26 19:31:45 2026 +(cherry picked from commit 0ddd6b6bcbdedbe2c8304af05771f8ab11939112) +Signed-off-by: rpm-build +Upstream-reference: https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3.patch +--- + CryptoPkg/Library/OpensslLib/openssl/crypto/evp/evp_lib.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/CryptoPkg/Library/OpensslLib/openssl/crypto/evp/evp_lib.c b/CryptoPkg/Library/OpensslLib/openssl/crypto/evp/evp_lib.c +index d88066d..3eb80b8 100644 +--- a/CryptoPkg/Library/OpensslLib/openssl/crypto/evp/evp_lib.c ++++ b/CryptoPkg/Library/OpensslLib/openssl/crypto/evp/evp_lib.c +@@ -249,10 +249,9 @@ int evp_cipher_get_asn1_aead_params(EVP_CIPHER_CTX *c, ASN1_TYPE *type, + if (type == NULL || asn1_params == NULL) + return 0; + +- i = ossl_asn1_type_get_octetstring_int(type, &tl, NULL, EVP_MAX_IV_LENGTH); +- if (i <= 0) ++ i = ossl_asn1_type_get_octetstring_int(type, &tl, iv, EVP_MAX_IV_LENGTH); ++ if (i <= 0 || i > EVP_MAX_IV_LENGTH) + return -1; +- ossl_asn1_type_get_octetstring_int(type, &tl, iv, i); + + memcpy(asn1_params->iv, iv, i); + asn1_params->iv_len = i; +-- +2.45.4 + diff --git a/SPECS/edk2/edk2.spec b/SPECS/edk2/edk2.spec index ad0c09a87b5..a5cfc9b34b7 100644 --- a/SPECS/edk2/edk2.spec +++ b/SPECS/edk2/edk2.spec @@ -55,7 +55,7 @@ ExclusiveArch: x86_64 Name: edk2 Version: %{GITDATE}git%{GITCOMMIT} -Release: 12%{?dist} +Release: 13%{?dist} Summary: UEFI firmware for 64-bit virtual machines License: Apache-2.0 AND (BSD-2-Clause OR GPL-2.0-or-later) AND BSD-2-Clause-Patent AND BSD-3-Clause AND BSD-4-Clause AND ISC AND MIT AND LicenseRef-Fedora-Public-Domain URL: https://www.tianocore.org @@ -141,7 +141,8 @@ Patch1004: CVE-2024-2511.patch Patch1005: CVE-2024-4603.patch Patch1006: CVE-2025-3770.patch Patch1007: CVE-2025-9230.patch -Patch1008: CVE-2025-2295.patch +Patch1008: CVE-2025-15467.patch +Patch1009: CVE-2025-2295.patch # python3-devel and libuuid-devel are required for building tools. # python3-devel is also needed for varstore template generation and @@ -803,9 +804,12 @@ done /boot/efi/HvLoader.efi %changelog -* Tue Jan 06 2026 Azure Linux Security Servicing Account - 20240524git3e722403cd16-12 +* Sun Feb 01 2026 Azure Linux Security Servicing Account - 20240524git3e722403cd16-13 - Patch for CVE-2025-2295 +* Fri Jan 30 2026 Azure Linux Security Servicing Account - 20240524git3e722403cd16-12 +- Patch for CVE-2025-15467 + * Thu Dec 18 2025 Jyoti kanase - 20240524git3e722403cd16-11 - Patch for CVE-2025-2296 @@ -815,6 +819,12 @@ done * Mon Aug 11 2025 Azure Linux Security Servicing Account - 20240524git3e722403cd16-9 - Patch for CVE-2025-3770 +* Fri Oct 03 2025 Azure Linux Security Servicing Account - 20240524git3e722403cd16-10 +- Patch for CVE-2025-9230 + +* Mon Aug 11 2025 Azure Linux Security Servicing Account - 20240524git3e722403cd16-9 +- Patch for CVE-2025-3770 + * Thu Apr 24 2025 Jyoti Kanase - 20240524git3e722403cd16-8 - Fix CVE-2024-38796