From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Adrian Vovk To: git-commits@fedoraproject.org Subject: [rpms/rest] rawhide: Fix CVE-2026-16615 Date: Wed, 26 Aug 2026 01:26:57 GMT Message-ID: <178770761797.1.3918449404294571120.rpms-rest-7c41651584dc@fedoraproject.org> List-ID: X-Git-Repo: rpms/rest X-Git-Branch: rawhide X-Git-Rev: 7c41651584dc246f60accfd6a23ba795cfdc8ffb QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvcmVzdApCcmFuY2gg OiByYXdoaWRlCkNvbW1pdCA6IDdjNDE2NTE1ODRkYzI0NmY2MGFjY2ZkNmEyM2JhNzk1Y2ZkYzhm ZmIKQXV0aG9yIDogQWRyaWFuIFZvdmsgPGF2b3ZrQHJlZGhhdC5jb20+CkRhdGUgICA6IDIwMjYt MDgtMjVUMjE6MjQ6MjgtMDQ6MDAKU3RhdHMgIDogKzE4NC8tMCBpbiAyIGZpbGUocykKVVJMICAg IDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9yZXN0L2MvN2M0MTY1MTU4NGRj MjQ2ZjYwYWNjZmQ2YTIzYmE3OTVjZmRjOGZmYj9icmFuY2g9cmF3aGlkZQoKTG9nOgpGaXggQ1ZF LTIwMjYtMTY2MTUKCi0tLQpkaWZmIC0tZ2l0IGEvQ1ZFLTIwMjYtMTY2MTUucGF0Y2ggYi9DVkUt MjAyNi0xNjYxNS5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi43NDlj OTdiCi0tLSAvZGV2L251bGwKKysrIGIvQ1ZFLTIwMjYtMTY2MTUucGF0Y2gKQEAgLTAsMCArMSwx ODIgQEAKK0Zyb20gZmUxZTc2NzJlZmRmMjJlZWI1Y2JlMzBkNmFkYzQ4NWJjNTVmYTAyMSBNb24g U2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zyb206IE1pbGFuIENyaGEgPG1jcmhhQHJlZGhhdC5jb20+ CitEYXRlOiBUaHUsIDIzIEp1bCAyMDI2IDA5OjQ0OjMxICswMjAwCitTdWJqZWN0OiBbUEFUQ0hd IHV0aWxzOiBSZXBsYWNlIEdSYW5kIHdpdGggY3J5cHRvZ3JhcGhpY2FsbHkgc2VjdXJlIHJhbmRv bQorIGdlbmVyYXRvciAoQ1ZFLTIwMjYtMTY2MTUpCisKK1RoZSBHUmFuZCBpcyBub3Qgc3VwcG9z ZWQgdG8gYmUgdXNlZCBmb3IgY3J5cHRvZ3JhcGh5LCByZXBsYWNlIGl0Cit3aXRoIGEgY3J5cHRv Z3JhcGhpY2FsbHkgc2VjdXJlIHJhbmRvbSBnZW5lcmF0b3IgYW5kIHJlcXVpcmUgaXQKK3RvIGJl IGF2YWlsYWJsZSBkdXJpbmcgdGhlIHNldHVwIHBoYXNlLiBUaGUgbGlicmFyeSB3aWxsIGFib3J0 CitpbiBjYXNlIHRoZSBydW50aW1lIGNhbm5vdCBjcmVhdGUgYSByYW5kb20gbnVtYmVyIChvbmx5 IGZvcgorcmFyZSBjYXNlcyB3aGVyZSB0aGUgdmVyeSBsYXN0IGZhbGxiYWNrIHRvIC9kZXYvdXJh bmRvbSBmYWlscwordG8gcmVhZCBmcm9tIHRoZSBkZXZpY2UsIHdoaWNoIGlzIHVzZWQgb24gc29t ZSBvbGQgcGxhdGZvcm1zKS4KKworRml4ZXMgaHR0cHM6Ly9naXRsYWIuZ25vbWUub3JnL0dOT01F L2xpYnJlc3QvLS9pc3N1ZXMvMjUKKy0tLQorIG1lc29uLmJ1aWxkICAgICAgIHwgMjkgKysrKysr KysrKysrKysrKysrKysKKyByZXN0L21lc29uLmJ1aWxkICB8ICAyICstCisgcmVzdC9yZXN0LXV0 aWxzLmMgfCA3MCArKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrLS0t LQorIDMgZmlsZXMgY2hhbmdlZCwgOTUgaW5zZXJ0aW9ucygrKSwgNiBkZWxldGlvbnMoLSkKKwor ZGlmZiAtLWdpdCBhL21lc29uLmJ1aWxkIGIvbWVzb24uYnVpbGQKK2luZGV4IDRlMmEyNzIuLjI5 MTlmYjYgMTAwNjQ0CistLS0gYS9tZXNvbi5idWlsZAorKysrIGIvbWVzb24uYnVpbGQKK0BAIC02 MCw2ICs2MCw4IEBAIGxpYnNvdXBfZGVwID0gZGVwZW5kZW5jeShsaWJzb3VwX25hbWUsIHZlcnNp b246IGxpYnNvdXBfcmVxX3ZlcnNpb24pCisgbGlianNvbl9nbGliX2RlcCA9IGRlcGVuZGVuY3ko J2pzb24tZ2xpYi0xLjAnKQorIGxpYnhtbF9kZXAgPSBkZXBlbmRlbmN5KCdsaWJ4bWwtMi4wJykK KyAKKytjYyA9IG1lc29uLmdldF9jb21waWxlcignYycpCisrCisgIyBjb25maWcuaAorIGNvbmYg PSBjb25maWd1cmF0aW9uX2RhdGEoKQorIGNvbmYuc2V0X3F1b3RlZCgnUEFDS0FHRV9OQU1FJywg bWVzb24ucHJvamVjdF9uYW1lKCkpCitAQCAtNjgsNiArNzAsMzMgQEAgY29uZi5zZXRfcXVvdGVk KCdQQUNLQUdFX1ZFUlNJT04nLCBtZXNvbi5wcm9qZWN0X3ZlcnNpb24oKSkKKyBpZiBnZXRfb3B0 aW9uKCdjYV9jZXJ0aWZpY2F0ZXMnKQorICAgY29uZi5zZXRfcXVvdGVkKCdSRVNUX1NZU1RFTV9D QV9GSUxFJywgY2FfY2VydGlmaWNhdGVzX3BhdGgpCisgZW5kaWYKKysKKysjIENTUFJORyBkZXRl Y3Rpb24gZm9yIHNlY3VyZSByYW5kb20gc3RyaW5nIGdlbmVyYXRpb24gKHJlcXVpcmVkKQorK2hh dmVfY3Nwcm5nID0gZmFsc2UKKytpZiBjYy5oYXNfZnVuY3Rpb24oJ2FyYzRyYW5kb21fYnVmJywg cHJlZml4OiAnI2luY2x1ZGUgPHN0ZGxpYi5oPicpCisrICBjb25mLnNldCgnSEFWRV9BUkM0UkFO RE9NX0JVRicsIDEpCisrICBoYXZlX2NzcHJuZyA9IHRydWUKKytlbmRpZgorK2lmIGNjLmhhc19m dW5jdGlvbignZ2V0cmFuZG9tJywgcHJlZml4OiAnI2luY2x1ZGUgPHN5cy9yYW5kb20uaD4nKQor KyAgY29uZi5zZXQoJ0hBVkVfR0VUUkFORE9NJywgMSkKKysgIGhhdmVfY3Nwcm5nID0gdHJ1ZQor K2VuZGlmCisrCisrY3Nwcm5nX2RlcHMgPSBbXQorK2lmIGhvc3RfbWFjaGluZS5zeXN0ZW0oKSA9 PSAnd2luZG93cycKKysgIGJjcnlwdF9saWIgPSBjYy5maW5kX2xpYnJhcnkoJ2JjcnlwdCcsIHJl cXVpcmVkOiBmYWxzZSkKKysgIGlmIGJjcnlwdF9saWIuZm91bmQoKQorKyAgICBjc3BybmdfZGVw cyArPSBiY3J5cHRfbGliCisrICAgIGNvbmYuc2V0KCdIQVZFX0JDUllQVEdFTlJBTkRPTScsIDEp CisrICAgIGhhdmVfY3Nwcm5nID0gdHJ1ZQorKyAgZW5kaWYKKytlbmRpZgorKworK2lmIG5vdCBo YXZlX2NzcHJuZworKyAgZXJyb3IoJ05vIGNyeXB0b2dyYXBoaWNhbGx5IHNlY3VyZSByYW5kb20g c291cmNlIGZvdW5kLiAnICsKKysgICAgICAgICdsaWJyZXN0IHJlcXVpcmVzIGFyYzRyYW5kb21f YnVmKCksIGdldHJhbmRvbSgpLCBvciBCQ3J5cHRHZW5SYW5kb20oKS4nKQorK2VuZGlmCisrCisg Y29uZmlnX2ggPSBjb25maWd1cmVfZmlsZShvdXRwdXQ6ICdjb25maWcuaCcsIGNvbmZpZ3VyYXRp b246IGNvbmYpCisgcm9vdF9pbmMgPSBpbmNsdWRlX2RpcmVjdG9yaWVzKCcuJykKKyBjb25maWdf ZGVwID0gZGVjbGFyZV9kZXBlbmRlbmN5KAorZGlmZiAtLWdpdCBhL3Jlc3QvbWVzb24uYnVpbGQg Yi9yZXN0L21lc29uLmJ1aWxkCitpbmRleCBiZmVjYjlmLi4xYzFjYmQ1IDEwMDY0NAorLS0tIGEv cmVzdC9tZXNvbi5idWlsZAorKysrIGIvcmVzdC9tZXNvbi5idWlsZAorQEAgLTYyLDcgKzYyLDcg QEAgbGlicmVzdF9kZXBzID0gWworICAgbGlianNvbl9nbGliX2RlcCwKKyAgIGxpYnhtbF9kZXAs CisgICBjb25maWdfZGVwLAorLV0KKytdICsgY3Nwcm5nX2RlcHMKKyAKKyBsaWJyZXN0X2NfYXJn cyA9IFsKKyAgICctREdfTE9HX0RPTUFJTj0iUmVzdCInLAorZGlmZiAtLWdpdCBhL3Jlc3QvcmVz dC11dGlscy5jIGIvcmVzdC9yZXN0LXV0aWxzLmMKK2luZGV4IGRmMjgzZTAuLjM0NmM4M2IgMTAw NjQ0CistLS0gYS9yZXN0L3Jlc3QtdXRpbHMuYworKysrIGIvcmVzdC9yZXN0LXV0aWxzLmMKK0BA IC0xNiwyOSArMTYsODkgQEAKKyAgKiBJbmMuLCA1MSBGcmFua2xpbiBTdCAtIEZpZnRoIEZsb29y LCBCb3N0b24sIE1BIDAyMTEwLTEzMDEgVVNBLgorICAqLworIAorKyNpbmNsdWRlICJjb25maWcu aCIKKyAjaW5jbHVkZSAicmVzdC11dGlscy5oIgorIAorKyNpZmRlZiBIQVZFX0FSQzRSQU5ET01f QlVGCisrI2luY2x1ZGUgPHN0ZGxpYi5oPgorKyNlbmRpZgorKworKyNpZmRlZiBIQVZFX0dFVFJB TkRPTQorKyNpbmNsdWRlIDxlcnJuby5oPgorKyNpbmNsdWRlIDxzeXMvcmFuZG9tLmg+CisrI2Vu ZGlmCisrCisrI2lmZGVmIEhBVkVfQkNSWVBUR0VOUkFORE9NCisrI2RlZmluZSBXSU4zMl9MRUFO X0FORF9NRUFOCisrI2luY2x1ZGUgPHdpbmRvd3MuaD4KKysjaW5jbHVkZSA8YmNyeXB0Lmg+Cisr I2VuZGlmCisrCisrI2lmIGRlZmluZWQoSEFWRV9BUkM0UkFORE9NX0JVRikKKysKKytzdGF0aWMg dm9pZAorK2NyeXB0b19yYW5kb21fYnl0ZXMgKGd1Y2hhciAqYnVmZmVyLAorKyAgICAgICAgICAg ICAgICAgICAgIGdzaXplICAgbGVuZ3RoKQorK3sKKysgIGFyYzRyYW5kb21fYnVmIChidWZmZXIs IGxlbmd0aCk7CisrfQorKworKyNlbGlmIGRlZmluZWQoSEFWRV9CQ1JZUFRHRU5SQU5ET00pCisr Cisrc3RhdGljIHZvaWQKKytjcnlwdG9fcmFuZG9tX2J5dGVzIChndWNoYXIgKmJ1ZmZlciwKKysg ICAgICAgICAgICAgICAgICAgICBnc2l6ZSAgIGxlbmd0aCkKKyt7CisrICBCQ3J5cHRHZW5SYW5k b20gKE5VTEwsIGJ1ZmZlciwgKFVMT05HKSBsZW5ndGgsCisrICAgICAgICAgICAgICAgICAgIEJD UllQVF9VU0VfU1lTVEVNX1BSRUZFUlJFRF9STkcpOworK30KKysKKysjZWxpZiBkZWZpbmVkKEhB VkVfR0VUUkFORE9NKQorKworK3N0YXRpYyB2b2lkCisrY3J5cHRvX3JhbmRvbV9ieXRlcyAoZ3Vj aGFyICpidWZmZXIsCisrICAgICAgICAgICAgICAgICAgICAgZ3NpemUgICBsZW5ndGgpCisrewor KyAgZ3NpemUgcG9zID0gMDsKKysKKysgIHdoaWxlIChwb3MgPCBsZW5ndGgpCisrICAgIHsKKysg ICAgICBnc3NpemUgcmV0ID0gZ2V0cmFuZG9tIChidWZmZXIgKyBwb3MsIGxlbmd0aCAtIHBvcywg MCk7CisrICAgICAgaWYgKHJldCA8IDApCisrICAgICAgICB7CisrICAgICAgICAgIGlmIChlcnJu byA9PSBFSU5UUikKKysgICAgICAgICAgICBjb250aW51ZTsKKysgICAgICAgICAgZ19lcnJvciAo ImdldHJhbmRvbSgpIGZhaWxlZDogJXMiLCBnX3N0cmVycm9yIChlcnJubykpOworKyAgICAgICAg fQorKyAgICAgIHBvcyArPSAoZ3NpemUpIHJldDsKKysgICAgfQorK30KKysKKysjZW5kaWYgLyog cGxhdGZvcm0gc2VsZWN0aW9uICovCisrCisgLyoqCisgICogcmFuZG9tX3N0cmluZzoKKyAgKiBA bGVuZ3RoOiB0aGUgbGVuZ3RoIG9mIHRoZSByYW5kb20gc3RyaW5nCisgICoKKy0gKiBDcmVhdGVz IGEgcmFuZG9tIHN0cmluZyBmcm9tIGEgZ2l2ZW4gYWxwaGFiZXRoIHdpdGggbGVuZ3RoIEBsZW5n dGgKKysgKiBDcmVhdGVzIGEgcmFuZG9tIHN0cmluZyBmcm9tIGEgZ2l2ZW4gYWxwaGFiZXQgd2l0 aCBsZW5ndGggQGxlbmd0aC4KKyAgKgorICAqIFJldHVybnM6ICh0cmFuc2ZlciBmdWxsKTogYSBy YW5kb20gc3RyaW5nCisgICovCisgZ2NoYXIgKgorIHJhbmRvbV9zdHJpbmcgKGd1aW50IGxlbmd0 aCkKKyB7CistICBnX2F1dG9wdHIoR1JhbmQpIHJhbmQgPSBnX3JhbmRfbmV3ICgpOworICAgZ2No YXIgKmJ1ZmZlciA9IGdfbWFsbG9jMCAoc2l6ZW9mIChnY2hhcikgKiBsZW5ndGggKyAxKTsKKy0g IGdjaGFyIGFscGhhYmV0aFtdID0gImFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6QUJDREVGR0hJ SktMTU5PUFFSU1RVVldYWVowMTIzNDU2Nzg5LS5ffiI7CisrICBnY2hhciBhbHBoYWJldFtdID0g ImFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVowMTIz NDU2Nzg5LS5ffiI7CisrICBndWludCBhbHBoYWJldF9sZW4gPSBzaXplb2YgKGFscGhhYmV0KSAt IDE7CisrICBnX2F1dG9mcmVlIGd1Y2hhciAqcmFuZF9ieXRlcyA9IGdfbWFsbG9jIChsZW5ndGgp OworKworKyAgY3J5cHRvX3JhbmRvbV9ieXRlcyAocmFuZF9ieXRlcywgbGVuZ3RoKTsKKyAKKyAg IGZvciAoZ3VpbnQgaSA9IDA7IGkgPCBsZW5ndGg7IGkrKykKKyAgICAgeworLSAgICAgIGJ1ZmZl cltpXSA9IGFscGhhYmV0aFtnX3JhbmRfaW50IChyYW5kKSAlIChzaXplb2YgKGFscGhhYmV0aCkg LSAxKV07CisrICAgICAgYnVmZmVyW2ldID0gYWxwaGFiZXRbcmFuZF9ieXRlc1tpXSAlIGFscGhh YmV0X2xlbl07CisgICAgIH0KKyAgIGJ1ZmZlcltsZW5ndGhdID0gJ1wwJzsKKyAKKyAgIHJldHVy biBidWZmZXI7CisgfQorLQorLS0gCitHaXRMYWIKKwoKZGlmZiAtLWdpdCBhL3Jlc3Quc3BlYyBi L3Jlc3Quc3BlYwppbmRleCA2MGZjMTNmLi5kYjI0MjZiIDEwMDY0NAotLS0gYS9yZXN0LnNwZWMK KysrIGIvcmVzdC5zcGVjCkBAIC03LDYgKzcsOCBAQCBMaWNlbnNlOiAgICAgICBMR1BMLTIuMS1v bmx5CiBVUkw6ICAgICAgICAgICBodHRwczovL2dpdGxhYi5nbm9tZS5vcmcvR05PTUUvbGlicmVz dAogU291cmNlMDogICAgICAgaHR0cHM6Ly9kb3dubG9hZC5nbm9tZS5vcmcvc291cmNlcy9saWJy ZXN0LyV7Z25vbWVfbWFqb3JfbWlub3JfdmVyc2lvbn0vbGlicmVzdC0le3ZlcnNpb259LnRhci54 egogCitQYXRjaDA6IENWRS0yMDI2LTE2NjE1LnBhdGNoCisKIEJ1aWxkUmVxdWlyZXM6IG1lc29u CiBCdWlsZFJlcXVpcmVzOiBwa2djb25maWcoZ2xpYi0yLjApCiBCdWlsZFJlcXVpcmVzOiBwa2dj b25maWcoZ2lvLTIuMCkK