public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/sblim-cmpi-base] f44: Fix CVE-2026-73585
@ 2026-09-09 9:37 Vitezslav Crhonek
0 siblings, 0 replies; only message in thread
From: Vitezslav Crhonek @ 2026-09-09 9:37 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/sblim-cmpi-base
Branch : f44
Commit : d139b523d5f842bf2946529c2cacf3f835c1536b
Author : Vitezslav Crhonek <vcrhonek@redhat.com>
Date : 2026-09-09T11:36:52+02:00
Stats : +155/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/sblim-cmpi-base/c/d139b523d5f842bf2946529c2cacf3f835c1536b?branch=f44
Log:
Fix CVE-2026-73585
---
diff --git a/sblim-cmpi-base-1.6.4-secure-tmpfiles.patch b/sblim-cmpi-base-1.6.4-secure-tmpfiles.patch
new file mode 100644
index 0000000..4352097
--- /dev/null
+++ b/sblim-cmpi-base-1.6.4-secure-tmpfiles.patch
@@ -0,0 +1,148 @@
+diff -up sblim-cmpi-base-1.6.4/provider-register.sh.secure-tmpfiles sblim-cmpi-base-1.6.4/provider-register.sh
+--- sblim-cmpi-base-1.6.4/provider-register.sh.secure-tmpfiles 2026-09-08 08:04:05.413130924 +0200
++++ sblim-cmpi-base-1.6.4/provider-register.sh 2026-09-08 08:12:42.207171826 +0200
+@@ -200,19 +200,11 @@ pegasus_install()
+ shift
+ done
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$$.mof
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+-
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if pegasus_transform $_REGFILENAME $myregs
++ if pegasus_transform "$_REGFILENAME" $myregs
+ then
+ chatter Registering providers with $state cimserver
+ $CIMMOF -uc -I $mofpath -n $namespace $mymofs &&
+@@ -290,16 +282,9 @@ pegasus_uninstall()
+ fi
+ CLASSES=`cat $myregs 2> /dev/null | grep -v '^[[:space:]]*#.*' | cut -d ' ' -f 1 | grep -v '^CIM_'`
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _DELETE_NAME=$TEMPDIR/delete-class.mof
+- break
+- fi
+- done
++ _DELETE_NAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+- trap "rm -f $_DELETE_NAME" EXIT
++ trap 'rm -f "$_DELETE_NAME"' EXIT
+
+ for cls in $CLASSES
+ do
+@@ -437,18 +422,11 @@ sfcb_install()
+ shift
+ done
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$baseregname.reg
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.reg") || return 1
+
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if sfcb_transform $_REGFILENAME $myregs
++ if sfcb_transform "$_REGFILENAME" $myregs
+ then
+ chatter "Staging provider registration."
+ sfcbstage -n $namespace -r $_REGFILENAME $mymofs
+@@ -524,13 +502,11 @@ openwbem_transform()
+ shift
+ moffiles=$*
+
+- if rm -f $OUTFILE
+- then
+- for _f in $moffiles
+- do
+- sed "s/Provider *( *\"cmpi:/Provider(\"cmpi::/g" < $_f >> $OUTFILE
+- done
+- fi
++ : > "$OUTFILE"
++ for _f in $moffiles
++ do
++ sed "s/Provider *( *\"cmpi:/Provider(\"cmpi::/g" < $_f >> "$OUTFILE"
++ done
+ }
+
+ openwbem_repository()
+@@ -568,25 +544,18 @@ openwbem_install()
+ state=inactive
+ fi
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$$.mof
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if openwbem_transform $_REGFILENAME $*
++ if openwbem_transform "$_REGFILENAME" $*
+ then
+ chatter Registering providers with $state owcimomd
+- $CIMMOF $_REGFILENAME > /dev/null
++ $CIMMOF "$_REGFILENAME" > /dev/null
+ else
+ echo "Failed to build OpenWBEM registration MOF." >&2
+ return 1
+- fi
++ fi
+ }
+
+ openwbem_uninstall()
+@@ -611,25 +580,18 @@ openwbem_uninstall()
+ state=inactive
+ fi
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$$.mof
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if openwbem_transform $_REGFILENAME $*
++ if openwbem_transform "$_REGFILENAME" $*
+ then
+ chatter Deregistering providers with $state owcimomd
+- $CIMMOF -r $_REGFILENAME > /dev/null
++ $CIMMOF -r "$_REGFILENAME" > /dev/null
+ else
+ echo "Failed to build OpenWBEM registration MOF." >&2
+ return 1
+- fi
++ fi
+ }
+
+ cim_server()
diff --git a/sblim-cmpi-base.spec b/sblim-cmpi-base.spec
index 9d916b3..dc9cc08 100644
--- a/sblim-cmpi-base.spec
+++ b/sblim-cmpi-base.spec
@@ -2,7 +2,7 @@
Name: sblim-cmpi-base
Version: 1.6.4
-Release: 32%{?dist}
+Release: 33%{?dist}
Summary: SBLIM CMPI Base Providers
License: EPL-1.0
@@ -30,6 +30,8 @@ Patch9: sblim-cmpi-base-1.6.4-fix-possible-null-dereference.patch
Patch10: sblim-cmpi-base-1.6.4-gcc15-fixes.patch
# Patch11: adds support for Image Mode
Patch11: sblim-cmpi-base-1.6.4-image-mode.patch
+# Patch12: uses mktemp for temporary files in provider registration script (CVE-2026-73585)
+Patch12: sblim-cmpi-base-1.6.4-secure-tmpfiles.patch
Requires: cim-server sblim-indication_helper
BuildRequires: make
BuildRequires: perl-generators
@@ -78,6 +80,7 @@ autoreconf --install --force
%patch -P9 -p1 -b .fix-possible-null-dereference
%patch -P10 -p1 -b .gcc15-fixes
%patch -P11 -p1 -b .image-mode
+%patch -P12 -p1 -b .secure-tmpfiles
%build
%configure \
@@ -136,6 +139,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/cmpi/*a
%postun -p /sbin/ldconfig
%changelog
+* Wed Sep 09 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-33
+- Use mktemp for temporary files in provider registration script (CVE-2026-73585)
+
* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.4-32
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-09 9:37 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-09 9:37 [rpms/sblim-cmpi-base] f44: Fix CVE-2026-73585 Vitezslav Crhonek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox