From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Adrian Vovk To: git-commits@fedoraproject.org Subject: [rpms/rest] f44: Fix CVE-2026-16615 Date: Wed, 26 Aug 2026 01:39:31 GMT Message-ID: <178770837187.1.442695494186594521.rpms-rest-11b1c16d26f5@fedoraproject.org> List-ID: X-Git-Repo: rpms/rest X-Git-Branch: f44 X-Git-Rev: 11b1c16d26f5bb29f2271ae76a39efa0e661b8bb QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvcmVzdApCcmFuY2gg OiBmNDQKQ29tbWl0IDogMTFiMWMxNmQyNmY1YmIyOWYyMjcxYWU3NmEzOWVmYTBlNjYxYjhiYgpB dXRob3IgOiBBZHJpYW4gVm92ayA8YXZvdmtAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0wOC0y NVQyMToyODo1NS0wNDowMApTdGF0cyAgOiArMTg0Ly0wIGluIDIgZmlsZShzKQpVUkwgICAgOiBo dHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL3Jlc3QvYy8xMWIxYzE2ZDI2ZjViYjI5 ZjIyNzFhZTc2YTM5ZWZhMGU2NjFiOGJiP2JyYW5jaD1mNDQKCkxvZzoKRml4IENWRS0yMDI2LTE2 NjE1CgotLS0KZGlmZiAtLWdpdCBhL0NWRS0yMDI2LTE2NjE1LnBhdGNoIGIvQ1ZFLTIwMjYtMTY2 MTUucGF0Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uNzQ5Yzk3YgotLS0g L2Rldi9udWxsCisrKyBiL0NWRS0yMDI2LTE2NjE1LnBhdGNoCkBAIC0wLDAgKzEsMTgyIEBACitG cm9tIGZlMWU3NjcyZWZkZjIyZWViNWNiZTMwZDZhZGM0ODViYzU1ZmEwMjEgTW9uIFNlcCAxNyAw MDowMDowMCAyMDAxCitGcm9tOiBNaWxhbiBDcmhhIDxtY3JoYUByZWRoYXQuY29tPgorRGF0ZTog VGh1LCAyMyBKdWwgMjAyNiAwOTo0NDozMSArMDIwMAorU3ViamVjdDogW1BBVENIXSB1dGlsczog UmVwbGFjZSBHUmFuZCB3aXRoIGNyeXB0b2dyYXBoaWNhbGx5IHNlY3VyZSByYW5kb20KKyBnZW5l cmF0b3IgKENWRS0yMDI2LTE2NjE1KQorCitUaGUgR1JhbmQgaXMgbm90IHN1cHBvc2VkIHRvIGJl IHVzZWQgZm9yIGNyeXB0b2dyYXBoeSwgcmVwbGFjZSBpdAord2l0aCBhIGNyeXB0b2dyYXBoaWNh bGx5IHNlY3VyZSByYW5kb20gZ2VuZXJhdG9yIGFuZCByZXF1aXJlIGl0Cit0byBiZSBhdmFpbGFi bGUgZHVyaW5nIHRoZSBzZXR1cCBwaGFzZS4gVGhlIGxpYnJhcnkgd2lsbCBhYm9ydAoraW4gY2Fz ZSB0aGUgcnVudGltZSBjYW5ub3QgY3JlYXRlIGEgcmFuZG9tIG51bWJlciAob25seSBmb3IKK3Jh cmUgY2FzZXMgd2hlcmUgdGhlIHZlcnkgbGFzdCBmYWxsYmFjayB0byAvZGV2L3VyYW5kb20gZmFp bHMKK3RvIHJlYWQgZnJvbSB0aGUgZGV2aWNlLCB3aGljaCBpcyB1c2VkIG9uIHNvbWUgb2xkIHBs YXRmb3JtcykuCisKK0ZpeGVzIGh0dHBzOi8vZ2l0bGFiLmdub21lLm9yZy9HTk9NRS9saWJyZXN0 Ly0vaXNzdWVzLzI1CistLS0KKyBtZXNvbi5idWlsZCAgICAgICB8IDI5ICsrKysrKysrKysrKysr KysrKysrCisgcmVzdC9tZXNvbi5idWlsZCAgfCAgMiArLQorIHJlc3QvcmVzdC11dGlscy5jIHwg NzAgKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKy0tLS0KKyAzIGZp bGVzIGNoYW5nZWQsIDk1IGluc2VydGlvbnMoKyksIDYgZGVsZXRpb25zKC0pCisKK2RpZmYgLS1n aXQgYS9tZXNvbi5idWlsZCBiL21lc29uLmJ1aWxkCitpbmRleCA0ZTJhMjcyLi4yOTE5ZmI2IDEw MDY0NAorLS0tIGEvbWVzb24uYnVpbGQKKysrKyBiL21lc29uLmJ1aWxkCitAQCAtNjAsNiArNjAs OCBAQCBsaWJzb3VwX2RlcCA9IGRlcGVuZGVuY3kobGlic291cF9uYW1lLCB2ZXJzaW9uOiBsaWJz b3VwX3JlcV92ZXJzaW9uKQorIGxpYmpzb25fZ2xpYl9kZXAgPSBkZXBlbmRlbmN5KCdqc29uLWds aWItMS4wJykKKyBsaWJ4bWxfZGVwID0gZGVwZW5kZW5jeSgnbGlieG1sLTIuMCcpCisgCisrY2Mg PSBtZXNvbi5nZXRfY29tcGlsZXIoJ2MnKQorKworICMgY29uZmlnLmgKKyBjb25mID0gY29uZmln dXJhdGlvbl9kYXRhKCkKKyBjb25mLnNldF9xdW90ZWQoJ1BBQ0tBR0VfTkFNRScsIG1lc29uLnBy b2plY3RfbmFtZSgpKQorQEAgLTY4LDYgKzcwLDMzIEBAIGNvbmYuc2V0X3F1b3RlZCgnUEFDS0FH RV9WRVJTSU9OJywgbWVzb24ucHJvamVjdF92ZXJzaW9uKCkpCisgaWYgZ2V0X29wdGlvbignY2Ff Y2VydGlmaWNhdGVzJykKKyAgIGNvbmYuc2V0X3F1b3RlZCgnUkVTVF9TWVNURU1fQ0FfRklMRScs IGNhX2NlcnRpZmljYXRlc19wYXRoKQorIGVuZGlmCisrCisrIyBDU1BSTkcgZGV0ZWN0aW9uIGZv ciBzZWN1cmUgcmFuZG9tIHN0cmluZyBnZW5lcmF0aW9uIChyZXF1aXJlZCkKKytoYXZlX2NzcHJu ZyA9IGZhbHNlCisraWYgY2MuaGFzX2Z1bmN0aW9uKCdhcmM0cmFuZG9tX2J1ZicsIHByZWZpeDog JyNpbmNsdWRlIDxzdGRsaWIuaD4nKQorKyAgY29uZi5zZXQoJ0hBVkVfQVJDNFJBTkRPTV9CVUYn LCAxKQorKyAgaGF2ZV9jc3BybmcgPSB0cnVlCisrZW5kaWYKKytpZiBjYy5oYXNfZnVuY3Rpb24o J2dldHJhbmRvbScsIHByZWZpeDogJyNpbmNsdWRlIDxzeXMvcmFuZG9tLmg+JykKKysgIGNvbmYu c2V0KCdIQVZFX0dFVFJBTkRPTScsIDEpCisrICBoYXZlX2NzcHJuZyA9IHRydWUKKytlbmRpZgor KworK2NzcHJuZ19kZXBzID0gW10KKytpZiBob3N0X21hY2hpbmUuc3lzdGVtKCkgPT0gJ3dpbmRv d3MnCisrICBiY3J5cHRfbGliID0gY2MuZmluZF9saWJyYXJ5KCdiY3J5cHQnLCByZXF1aXJlZDog ZmFsc2UpCisrICBpZiBiY3J5cHRfbGliLmZvdW5kKCkKKysgICAgY3Nwcm5nX2RlcHMgKz0gYmNy eXB0X2xpYgorKyAgICBjb25mLnNldCgnSEFWRV9CQ1JZUFRHRU5SQU5ET00nLCAxKQorKyAgICBo YXZlX2NzcHJuZyA9IHRydWUKKysgIGVuZGlmCisrZW5kaWYKKysKKytpZiBub3QgaGF2ZV9jc3By bmcKKysgIGVycm9yKCdObyBjcnlwdG9ncmFwaGljYWxseSBzZWN1cmUgcmFuZG9tIHNvdXJjZSBm b3VuZC4gJyArCisrICAgICAgICAnbGlicmVzdCByZXF1aXJlcyBhcmM0cmFuZG9tX2J1ZigpLCBn ZXRyYW5kb20oKSwgb3IgQkNyeXB0R2VuUmFuZG9tKCkuJykKKytlbmRpZgorKworIGNvbmZpZ19o ID0gY29uZmlndXJlX2ZpbGUob3V0cHV0OiAnY29uZmlnLmgnLCBjb25maWd1cmF0aW9uOiBjb25m KQorIHJvb3RfaW5jID0gaW5jbHVkZV9kaXJlY3RvcmllcygnLicpCisgY29uZmlnX2RlcCA9IGRl Y2xhcmVfZGVwZW5kZW5jeSgKK2RpZmYgLS1naXQgYS9yZXN0L21lc29uLmJ1aWxkIGIvcmVzdC9t ZXNvbi5idWlsZAoraW5kZXggYmZlY2I5Zi4uMWMxY2JkNSAxMDA2NDQKKy0tLSBhL3Jlc3QvbWVz b24uYnVpbGQKKysrKyBiL3Jlc3QvbWVzb24uYnVpbGQKK0BAIC02Miw3ICs2Miw3IEBAIGxpYnJl c3RfZGVwcyA9IFsKKyAgIGxpYmpzb25fZ2xpYl9kZXAsCisgICBsaWJ4bWxfZGVwLAorICAgY29u ZmlnX2RlcCwKKy1dCisrXSArIGNzcHJuZ19kZXBzCisgCisgbGlicmVzdF9jX2FyZ3MgPSBbCisg ICAnLURHX0xPR19ET01BSU49IlJlc3QiJywKK2RpZmYgLS1naXQgYS9yZXN0L3Jlc3QtdXRpbHMu YyBiL3Jlc3QvcmVzdC11dGlscy5jCitpbmRleCBkZjI4M2UwLi4zNDZjODNiIDEwMDY0NAorLS0t IGEvcmVzdC9yZXN0LXV0aWxzLmMKKysrKyBiL3Jlc3QvcmVzdC11dGlscy5jCitAQCAtMTYsMjkg KzE2LDg5IEBACisgICogSW5jLiwgNTEgRnJhbmtsaW4gU3QgLSBGaWZ0aCBGbG9vciwgQm9zdG9u LCBNQSAwMjExMC0xMzAxIFVTQS4KKyAgKi8KKyAKKysjaW5jbHVkZSAiY29uZmlnLmgiCisgI2lu Y2x1ZGUgInJlc3QtdXRpbHMuaCIKKyAKKysjaWZkZWYgSEFWRV9BUkM0UkFORE9NX0JVRgorKyNp bmNsdWRlIDxzdGRsaWIuaD4KKysjZW5kaWYKKysKKysjaWZkZWYgSEFWRV9HRVRSQU5ET00KKysj aW5jbHVkZSA8ZXJybm8uaD4KKysjaW5jbHVkZSA8c3lzL3JhbmRvbS5oPgorKyNlbmRpZgorKwor KyNpZmRlZiBIQVZFX0JDUllQVEdFTlJBTkRPTQorKyNkZWZpbmUgV0lOMzJfTEVBTl9BTkRfTUVB TgorKyNpbmNsdWRlIDx3aW5kb3dzLmg+CisrI2luY2x1ZGUgPGJjcnlwdC5oPgorKyNlbmRpZgor KworKyNpZiBkZWZpbmVkKEhBVkVfQVJDNFJBTkRPTV9CVUYpCisrCisrc3RhdGljIHZvaWQKKytj cnlwdG9fcmFuZG9tX2J5dGVzIChndWNoYXIgKmJ1ZmZlciwKKysgICAgICAgICAgICAgICAgICAg ICBnc2l6ZSAgIGxlbmd0aCkKKyt7CisrICBhcmM0cmFuZG9tX2J1ZiAoYnVmZmVyLCBsZW5ndGgp OworK30KKysKKysjZWxpZiBkZWZpbmVkKEhBVkVfQkNSWVBUR0VOUkFORE9NKQorKworK3N0YXRp YyB2b2lkCisrY3J5cHRvX3JhbmRvbV9ieXRlcyAoZ3VjaGFyICpidWZmZXIsCisrICAgICAgICAg ICAgICAgICAgICAgZ3NpemUgICBsZW5ndGgpCisreworKyAgQkNyeXB0R2VuUmFuZG9tIChOVUxM LCBidWZmZXIsIChVTE9ORykgbGVuZ3RoLAorKyAgICAgICAgICAgICAgICAgICBCQ1JZUFRfVVNF X1NZU1RFTV9QUkVGRVJSRURfUk5HKTsKKyt9CisrCisrI2VsaWYgZGVmaW5lZChIQVZFX0dFVFJB TkRPTSkKKysKKytzdGF0aWMgdm9pZAorK2NyeXB0b19yYW5kb21fYnl0ZXMgKGd1Y2hhciAqYnVm ZmVyLAorKyAgICAgICAgICAgICAgICAgICAgIGdzaXplICAgbGVuZ3RoKQorK3sKKysgIGdzaXpl IHBvcyA9IDA7CisrCisrICB3aGlsZSAocG9zIDwgbGVuZ3RoKQorKyAgICB7CisrICAgICAgZ3Nz aXplIHJldCA9IGdldHJhbmRvbSAoYnVmZmVyICsgcG9zLCBsZW5ndGggLSBwb3MsIDApOworKyAg ICAgIGlmIChyZXQgPCAwKQorKyAgICAgICAgeworKyAgICAgICAgICBpZiAoZXJybm8gPT0gRUlO VFIpCisrICAgICAgICAgICAgY29udGludWU7CisrICAgICAgICAgIGdfZXJyb3IgKCJnZXRyYW5k b20oKSBmYWlsZWQ6ICVzIiwgZ19zdHJlcnJvciAoZXJybm8pKTsKKysgICAgICAgIH0KKysgICAg ICBwb3MgKz0gKGdzaXplKSByZXQ7CisrICAgIH0KKyt9CisrCisrI2VuZGlmIC8qIHBsYXRmb3Jt IHNlbGVjdGlvbiAqLworKworIC8qKgorICAqIHJhbmRvbV9zdHJpbmc6CisgICogQGxlbmd0aDog dGhlIGxlbmd0aCBvZiB0aGUgcmFuZG9tIHN0cmluZworICAqCistICogQ3JlYXRlcyBhIHJhbmRv bSBzdHJpbmcgZnJvbSBhIGdpdmVuIGFscGhhYmV0aCB3aXRoIGxlbmd0aCBAbGVuZ3RoCisrICog Q3JlYXRlcyBhIHJhbmRvbSBzdHJpbmcgZnJvbSBhIGdpdmVuIGFscGhhYmV0IHdpdGggbGVuZ3Ro IEBsZW5ndGguCisgICoKKyAgKiBSZXR1cm5zOiAodHJhbnNmZXIgZnVsbCk6IGEgcmFuZG9tIHN0 cmluZworICAqLworIGdjaGFyICoKKyByYW5kb21fc3RyaW5nIChndWludCBsZW5ndGgpCisgewor LSAgZ19hdXRvcHRyKEdSYW5kKSByYW5kID0gZ19yYW5kX25ldyAoKTsKKyAgIGdjaGFyICpidWZm ZXIgPSBnX21hbGxvYzAgKHNpemVvZiAoZ2NoYXIpICogbGVuZ3RoICsgMSk7CistICBnY2hhciBh bHBoYWJldGhbXSA9ICJhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ekFCQ0RFRkdISUpLTE1OT1BR UlNUVVZXWFlaMDEyMzQ1Njc4OS0uX34iOworKyAgZ2NoYXIgYWxwaGFiZXRbXSA9ICJhYmNkZWZn aGlqa2xtbm9wcXJzdHV2d3h5ekFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaMDEyMzQ1Njc4OS0u X34iOworKyAgZ3VpbnQgYWxwaGFiZXRfbGVuID0gc2l6ZW9mIChhbHBoYWJldCkgLSAxOworKyAg Z19hdXRvZnJlZSBndWNoYXIgKnJhbmRfYnl0ZXMgPSBnX21hbGxvYyAobGVuZ3RoKTsKKysKKysg IGNyeXB0b19yYW5kb21fYnl0ZXMgKHJhbmRfYnl0ZXMsIGxlbmd0aCk7CisgCisgICBmb3IgKGd1 aW50IGkgPSAwOyBpIDwgbGVuZ3RoOyBpKyspCisgICAgIHsKKy0gICAgICBidWZmZXJbaV0gPSBh bHBoYWJldGhbZ19yYW5kX2ludCAocmFuZCkgJSAoc2l6ZW9mIChhbHBoYWJldGgpIC0gMSldOwor KyAgICAgIGJ1ZmZlcltpXSA9IGFscGhhYmV0W3JhbmRfYnl0ZXNbaV0gJSBhbHBoYWJldF9sZW5d OworICAgICB9CisgICBidWZmZXJbbGVuZ3RoXSA9ICdcMCc7CisgCisgICByZXR1cm4gYnVmZmVy OworIH0KKy0KKy0tIAorR2l0TGFiCisKCmRpZmYgLS1naXQgYS9yZXN0LnNwZWMgYi9yZXN0LnNw ZWMKaW5kZXggNWUzYTU4MS4uYzc5ODc3ZCAxMDA2NDQKLS0tIGEvcmVzdC5zcGVjCisrKyBiL3Jl c3Quc3BlYwpAQCAtNyw2ICs3LDggQEAgTGljZW5zZTogICAgICAgTEdQTC0yLjEtb25seQogVVJM OiAgICAgICAgICAgaHR0cHM6Ly9naXRsYWIuZ25vbWUub3JnL0dOT01FL2xpYnJlc3QKIFNvdXJj ZTA6ICAgICAgIGh0dHBzOi8vZG93bmxvYWQuZ25vbWUub3JnL3NvdXJjZXMvbGlicmVzdC8wLjEw L2xpYnJlc3QtJXt2ZXJzaW9ufS50YXIueHoKIAorUGF0Y2gwOiBDVkUtMjAyNi0xNjYxNS5wYXRj aAorCiBCdWlsZFJlcXVpcmVzOiBtZXNvbgogQnVpbGRSZXF1aXJlczogcGtnY29uZmlnKGdsaWIt Mi4wKQogQnVpbGRSZXF1aXJlczogcGtnY29uZmlnKGdpby0yLjApCg==