From efc36e094ce9001fdd33b0d67699ceb59c0fce87 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Wed, 17 Dec 2025 05:13:13 +0000 Subject: [PATCH] Patch influxdb for CVE-2025-10543 --- SPECS/influxdb/CVE-2025-10543.patch | 32 +++++++++++++++++++++++++++++ SPECS/influxdb/influxdb.spec | 6 +++++- 2 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 SPECS/influxdb/CVE-2025-10543.patch diff --git a/SPECS/influxdb/CVE-2025-10543.patch b/SPECS/influxdb/CVE-2025-10543.patch new file mode 100644 index 00000000000..7a2bd05570c --- /dev/null +++ b/SPECS/influxdb/CVE-2025-10543.patch @@ -0,0 +1,32 @@ +From 2cea7c730d27e252186cdae3a74c34897d43f566 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Wed, 17 Dec 2025 05:03:42 +0000 +Subject: [PATCH] Fields over 65535 bytes noe encoded correctly + +When encoding strings (1.5.3 in spec), and some other variable length fields, if the user passed in more then 65535 bytes the ouput would not be as expected (due to 16 byte header there is a hard limit). This change truncates output to 65535 bytes. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://patch-diff.githubusercontent.com/raw/eclipse-paho/paho.mqtt.golang/pull/714.patch +--- + .../github.com/eclipse/paho.mqtt.golang/packets/packets.go | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go b/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go +index 42eeb46..c185c83 100644 +--- a/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go ++++ b/vendor/github.com/eclipse/paho.mqtt.golang/packets/packets.go +@@ -304,6 +304,11 @@ func decodeBytes(b io.Reader) ([]byte, error) { + } + + func encodeBytes(field []byte) []byte { ++ // Attempting to encode more than 65,535 bytes would lead to an unexpected 16-bit length and extra data written ++ // (which would be parsed as later parts of the message). The safest option is to truncate. ++ if len(field) > 65535 { ++ field = field[0:65535] ++ } + fieldLength := make([]byte, 2) + binary.BigEndian.PutUint16(fieldLength, uint16(len(field))) + return append(fieldLength, field...) +-- +2.45.4 + diff --git a/SPECS/influxdb/influxdb.spec b/SPECS/influxdb/influxdb.spec index 0aff524ca89..e8e80337867 100644 --- a/SPECS/influxdb/influxdb.spec +++ b/SPECS/influxdb/influxdb.spec @@ -18,7 +18,7 @@ Summary: Scalable datastore for metrics, events, and real-time analytics Name: influxdb Version: 2.6.1 -Release: 25%{?dist} +Release: 26%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Mariner @@ -64,6 +64,7 @@ Patch5: CVE-2025-27144.patch Patch6: CVE-2025-22870.patch Patch7: CVE-2024-51744.patch Patch8: CVE-2025-65637.patch +Patch9: CVE-2025-10543.patch BuildRequires: clang BuildRequires: golang <= 1.18.8 BuildRequires: kernel-headers @@ -153,6 +154,9 @@ go test ./... %{_tmpfilesdir}/influxdb.conf %changelog +* Wed Dec 17 2025 Azure Linux Security Servicing Account - 2.6.1-26 +- Patch for CVE-2025-10543 + * Mon Dec 08 2025 Azure Linux Security Servicing Account - 2.6.1-25 - Patch for CVE-2025-65637