From 797d29109bd4419d9aca827506e51db5910af4fd Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Fri, 17 Jul 2026 09:38:48 +0000 Subject: [PATCH 1/2] Patch squid for CVE-2026-50012, CVE-2026-47729 --- SPECS/squid/CVE-2026-47729.patch | 52 ++++++++++++++++++++++++++++++++ SPECS/squid/CVE-2026-50012.patch | 36 ++++++++++++++++++++++ SPECS/squid/squid.spec | 7 ++++- 3 files changed, 94 insertions(+), 1 deletion(-) create mode 100644 SPECS/squid/CVE-2026-47729.patch create mode 100644 SPECS/squid/CVE-2026-50012.patch diff --git a/SPECS/squid/CVE-2026-47729.patch b/SPECS/squid/CVE-2026-47729.patch new file mode 100644 index 00000000000..362be2ca477 --- /dev/null +++ b/SPECS/squid/CVE-2026-47729.patch @@ -0,0 +1,52 @@ +From f35451396526d22bd6c10d656be31d263aa38475 Mon Sep 17 00:00:00 2001 +From: squidadm +Date: Sun, 17 May 2026 18:04:47 +1200 +Subject: [PATCH] Improve parsing of certain FTP directory listing formats + (#2408) (#2409) + +This surgical fix restricts parsing to the input buffer when the listing +entry date in "TypeA" or "TypeB" formats is not followed by a filename. +It does not improve rendering of listings with missing filenames or the +overall quality of FTP listing parsing code. + +C strchr() always returns a non-nil pointer when given a NUL character, +so its callers must be careful not to supply a NUL character if a +"natural" one-of-the-regular-c-string-characters membership test is +required. + +The bug was probably introduced in 1997 commit 3fdadc70 and then +duplicated in 2017 commit 3d872090. + +Co-authored-by: Alex Rousskov +Co-authored-by: Amos Jeffries +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8.patch +--- + src/clients/FtpGateway.cc | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/clients/FtpGateway.cc b/src/clients/FtpGateway.cc +index 6a9d2e8..1b168eb 100644 +--- a/src/clients/FtpGateway.cc ++++ b/src/clients/FtpGateway.cc +@@ -622,7 +622,7 @@ ftpListParseParts(const char *buf, struct Ftp::GatewayFlags flags) + // point after tokens[i+2] : + copyFrom = buf + tokens[i + 2].pos + strlen(tokens[i + 2].token); + if (flags.skip_whitespace) { +- while (strchr(w_space, *copyFrom)) ++ while (*copyFrom && strchr(w_space, *copyFrom)) + ++copyFrom; + } else { + /* Handle the following four formats: +@@ -633,7 +633,7 @@ ftpListParseParts(const char *buf, struct Ftp::GatewayFlags flags) + * Assuming a single space between date and filename + * suggested by: Nathan.Bailey@cc.monash.edu.au and + * Mike Battersby */ +- if (strchr(w_space, *copyFrom)) ++ if (*copyFrom && strchr(w_space, *copyFrom)) + ++copyFrom; + } + +-- +2.45.4 + diff --git a/SPECS/squid/CVE-2026-50012.patch b/SPECS/squid/CVE-2026-50012.patch new file mode 100644 index 00000000000..071d3e0778a --- /dev/null +++ b/SPECS/squid/CVE-2026-50012.patch @@ -0,0 +1,36 @@ +From 5caa594dc62f26e3ab4e969a1ee2fad4910a6eb9 Mon Sep 17 00:00:00 2001 +From: Francesco Chemolli <5175948+kinkie@users.noreply.github.com> +Date: Sat, 30 May 2026 10:16:33 +0000 +Subject: [PATCH] Harden peerDigestSwapInMask against invalid cache digest + reply (#2423) + +A cache_digest on-the-wire size may be bigger than the +mask_size declared in the digest itself. + +Ignore the digest in case this happens. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/squid-cache/squid/commit/19fcfe922717c8b255270c032dcde4071c003bcd.patch +--- + src/peer_digest.cc | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/peer_digest.cc b/src/peer_digest.cc +index 7027f5c..e6ce231 100644 +--- a/src/peer_digest.cc ++++ b/src/peer_digest.cc +@@ -622,6 +622,11 @@ peerDigestSwapInMask(void *data, char *buf, ssize_t size) + * NOTENOTENOTENOTENOTE: buf doesn't point to pd->cd->mask anymore! + * we need to do the copy ourselves! + */ ++ Assure(size >= 0); ++ if (fetch->mask_offset + size > static_cast(pd->cd->mask_size)) { ++ finishAndDeleteFetch(fetch, "peer digest mask data too large", true); ++ return -1; ++ } + memcpy(pd->cd->mask + fetch->mask_offset, buf, size); + + /* NOTE! buf points to the middle of pd->cd->mask! */ +-- +2.45.4 + diff --git a/SPECS/squid/squid.spec b/SPECS/squid/squid.spec index 62f5c2665d5..8565960f31c 100644 --- a/SPECS/squid/squid.spec +++ b/SPECS/squid/squid.spec @@ -2,7 +2,7 @@ Summary: The Squid proxy caching server Name: squid Version: 6.13 -Release: 4%{?dist} +Release: 5%{?dist} Vendor: Microsoft Corporation Distribution: Azure Linux License: GPL-2.0-or-later AND (LGPL-2.0-or-later AND MIT AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain AND Beerware) @@ -36,6 +36,8 @@ Patch208: CVE-2025-62168.patch Patch209: CVE-2026-32748.patch Patch210: CVE-2026-33515.patch Patch211: CVE-2026-33526.patch +Patch212: CVE-2026-47729.patch +Patch213: CVE-2026-50012.patch # cache_swap.sh Requires: bash gawk @@ -319,6 +321,9 @@ fi chgrp squid %{_var}/cache/samba/winbindd_privileged >/dev/null 2>&1 || : %changelog +* Fri Jul 17 2026 Azure Linux Security Servicing Account - 6.13-5 +- Patch for CVE-2026-50012, CVE-2026-47729 + * Thu Mar 26 2026 Azure Linux Security Servicing Account - 6.13-4 - Patch for CVE-2026-33526, CVE-2026-33515, CVE-2026-32748 From 44bcda9fe5fdcdafbbba11195e6e319f7a846b80 Mon Sep 17 00:00:00 2001 From: Swapnil Sahu Date: Mon, 20 Jul 2026 10:55:19 +0000 Subject: [PATCH 2/2] backported patch manually --- SPECS/squid/CVE-2026-50012.patch | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/SPECS/squid/CVE-2026-50012.patch b/SPECS/squid/CVE-2026-50012.patch index 071d3e0778a..0decdfe21b4 100644 --- a/SPECS/squid/CVE-2026-50012.patch +++ b/SPECS/squid/CVE-2026-50012.patch @@ -9,6 +9,8 @@ mask_size declared in the digest itself. Ignore the digest in case this happens. +Modified to apply to azurelinux. + Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: https://github.com/squid-cache/squid/commit/19fcfe922717c8b255270c032dcde4071c003bcd.patch --- @@ -16,16 +18,16 @@ Upstream-reference: https://github.com/squid-cache/squid/commit/19fcfe922717c8b2 1 file changed, 5 insertions(+) diff --git a/src/peer_digest.cc b/src/peer_digest.cc -index 7027f5c..e6ce231 100644 +index 7027f5c..09c1794 100644 --- a/src/peer_digest.cc +++ b/src/peer_digest.cc @@ -622,6 +622,11 @@ peerDigestSwapInMask(void *data, char *buf, ssize_t size) * NOTENOTENOTENOTENOTE: buf doesn't point to pd->cd->mask anymore! * we need to do the copy ourselves! */ -+ Assure(size >= 0); ++ assert(size >= 0); + if (fetch->mask_offset + size > static_cast(pd->cd->mask_size)) { -+ finishAndDeleteFetch(fetch, "peer digest mask data too large", true); ++ peerDigestFetchAbort(fetch, buf, "peer digest mask data too large"); + return -1; + } memcpy(pd->cd->mask + fetch->mask_offset, buf, size);