public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Vitezslav Crhonek <vcrhonek@redhat.com>
To: git-commits@fedoraproject.org
Subject: [rpms/sblim-cmpi-base] f45: Fix CVE-2026-73585
Date: Wed, 09 Sep 2026 08:41:38 GMT [thread overview]
Message-ID: <178894329823.1.6316405527868137395.rpms-sblim-cmpi-base-8c438f3661e1@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/sblim-cmpi-base
Branch : f45
Commit : 8c438f3661e101c45fcc5a1c0a4b36d3e793dda5
Author : Vitezslav Crhonek <vcrhonek@redhat.com>
Date : 2026-09-09T10:41:26+02:00
Stats : +155/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/sblim-cmpi-base/c/8c438f3661e101c45fcc5a1c0a4b36d3e793dda5?branch=f45
Log:
Fix CVE-2026-73585
---
diff --git a/sblim-cmpi-base-1.6.4-secure-tmpfiles.patch b/sblim-cmpi-base-1.6.4-secure-tmpfiles.patch
new file mode 100644
index 0000000..4352097
--- /dev/null
+++ b/sblim-cmpi-base-1.6.4-secure-tmpfiles.patch
@@ -0,0 +1,148 @@
+diff -up sblim-cmpi-base-1.6.4/provider-register.sh.secure-tmpfiles sblim-cmpi-base-1.6.4/provider-register.sh
+--- sblim-cmpi-base-1.6.4/provider-register.sh.secure-tmpfiles 2026-09-08 08:04:05.413130924 +0200
++++ sblim-cmpi-base-1.6.4/provider-register.sh 2026-09-08 08:12:42.207171826 +0200
+@@ -200,19 +200,11 @@ pegasus_install()
+ shift
+ done
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$$.mof
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+-
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if pegasus_transform $_REGFILENAME $myregs
++ if pegasus_transform "$_REGFILENAME" $myregs
+ then
+ chatter Registering providers with $state cimserver
+ $CIMMOF -uc -I $mofpath -n $namespace $mymofs &&
+@@ -290,16 +282,9 @@ pegasus_uninstall()
+ fi
+ CLASSES=`cat $myregs 2> /dev/null | grep -v '^[[:space:]]*#.*' | cut -d ' ' -f 1 | grep -v '^CIM_'`
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _DELETE_NAME=$TEMPDIR/delete-class.mof
+- break
+- fi
+- done
++ _DELETE_NAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+- trap "rm -f $_DELETE_NAME" EXIT
++ trap 'rm -f "$_DELETE_NAME"' EXIT
+
+ for cls in $CLASSES
+ do
+@@ -437,18 +422,11 @@ sfcb_install()
+ shift
+ done
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$baseregname.reg
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.reg") || return 1
+
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if sfcb_transform $_REGFILENAME $myregs
++ if sfcb_transform "$_REGFILENAME" $myregs
+ then
+ chatter "Staging provider registration."
+ sfcbstage -n $namespace -r $_REGFILENAME $mymofs
+@@ -524,13 +502,11 @@ openwbem_transform()
+ shift
+ moffiles=$*
+
+- if rm -f $OUTFILE
+- then
+- for _f in $moffiles
+- do
+- sed "s/Provider *( *\"cmpi:/Provider(\"cmpi::/g" < $_f >> $OUTFILE
+- done
+- fi
++ : > "$OUTFILE"
++ for _f in $moffiles
++ do
++ sed "s/Provider *( *\"cmpi:/Provider(\"cmpi::/g" < $_f >> "$OUTFILE"
++ done
+ }
+
+ openwbem_repository()
+@@ -568,25 +544,18 @@ openwbem_install()
+ state=inactive
+ fi
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$$.mof
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if openwbem_transform $_REGFILENAME $*
++ if openwbem_transform "$_REGFILENAME" $*
+ then
+ chatter Registering providers with $state owcimomd
+- $CIMMOF $_REGFILENAME > /dev/null
++ $CIMMOF "$_REGFILENAME" > /dev/null
+ else
+ echo "Failed to build OpenWBEM registration MOF." >&2
+ return 1
+- fi
++ fi
+ }
+
+ openwbem_uninstall()
+@@ -611,25 +580,18 @@ openwbem_uninstall()
+ state=inactive
+ fi
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$$.mof
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if openwbem_transform $_REGFILENAME $*
++ if openwbem_transform "$_REGFILENAME" $*
+ then
+ chatter Deregistering providers with $state owcimomd
+- $CIMMOF -r $_REGFILENAME > /dev/null
++ $CIMMOF -r "$_REGFILENAME" > /dev/null
+ else
+ echo "Failed to build OpenWBEM registration MOF." >&2
+ return 1
+- fi
++ fi
+ }
+
+ cim_server()
diff --git a/sblim-cmpi-base.spec b/sblim-cmpi-base.spec
index 1f33f3c..a3b1011 100644
--- a/sblim-cmpi-base.spec
+++ b/sblim-cmpi-base.spec
@@ -2,7 +2,7 @@
Name: sblim-cmpi-base
Version: 1.6.4
-Release: 33%{?dist}
+Release: 34%{?dist}
Summary: SBLIM CMPI Base Providers
License: EPL-1.0
@@ -30,6 +30,8 @@ Patch9: sblim-cmpi-base-1.6.4-fix-possible-null-dereference.patch
Patch10: sblim-cmpi-base-1.6.4-gcc15-fixes.patch
# Patch11: adds support for Image Mode
Patch11: sblim-cmpi-base-1.6.4-image-mode.patch
+# Patch12: uses mktemp for temporary files in provider registration script (CVE-2026-73585)
+Patch12: sblim-cmpi-base-1.6.4-secure-tmpfiles.patch
Requires: cim-server sblim-indication_helper
BuildRequires: make
BuildRequires: perl-generators
@@ -78,6 +80,7 @@ autoreconf --install --force
%patch -P9 -p1 -b .fix-possible-null-dereference
%patch -P10 -p1 -b .gcc15-fixes
%patch -P11 -p1 -b .image-mode
+%patch -P12 -p1 -b .secure-tmpfiles
%build
%configure \
@@ -136,6 +139,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/cmpi/*a
%postun -p /sbin/ldconfig
%changelog
+* Wed Sep 09 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-34
+- Use mktemp for temporary files in provider registration script (CVE-2026-73585)
+
* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.4-33
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
reply other threads:[~2026-09-09 8:41 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178894329823.1.6316405527868137395.rpms-sblim-cmpi-base-8c438f3661e1@fedoraproject.org \
--to=vcrhonek@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox