public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/sblim-cmpi-base] f43: Fix CVE-2026-73585
@ 2026-09-09 12:27 Vitezslav Crhonek
0 siblings, 0 replies; only message in thread
From: Vitezslav Crhonek @ 2026-09-09 12:27 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/sblim-cmpi-base
Branch : f43
Commit : 75aaa3a98ee150b7fb3b9b706a234ed1712ec942
Author : Vitezslav Crhonek <vcrhonek@redhat.com>
Date : 2026-09-09T14:26:53+02:00
Stats : +155/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/sblim-cmpi-base/c/75aaa3a98ee150b7fb3b9b706a234ed1712ec942?branch=f43
Log:
Fix CVE-2026-73585
---
diff --git a/sblim-cmpi-base-1.6.4-secure-tmpfiles.patch b/sblim-cmpi-base-1.6.4-secure-tmpfiles.patch
new file mode 100644
index 0000000..a8ce675
--- /dev/null
+++ b/sblim-cmpi-base-1.6.4-secure-tmpfiles.patch
@@ -0,0 +1,148 @@
+diff -up sblim-cmpi-base-1.6.4/provider-register.sh.secure-tmpfiles sblim-cmpi-base-1.6.4/provider-register.sh
+--- sblim-cmpi-base-1.6.4/provider-register.sh.secure-tmpfiles 2026-09-09 13:56:45.723728008 +0200
++++ sblim-cmpi-base-1.6.4/provider-register.sh 2026-09-09 13:56:45.731039666 +0200
+@@ -200,19 +200,11 @@ pegasus_install()
+ shift
+ done
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$$.mof
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+-
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if pegasus_transform $_REGFILENAME $myregs
++ if pegasus_transform "$_REGFILENAME" $myregs
+ then
+ chatter Registering providers with $state cimserver
+ $CIMMOF -uc -I $mofpath -n $namespace $mymofs &&
+@@ -276,16 +268,9 @@ pegasus_uninstall()
+ fi
+ CLASSES=`cat $myregs 2> /dev/null | grep -v '^[[:space:]]*#.*' | cut -d ' ' -f 1 | grep -v '^CIM_'`
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _DELETE_NAME=$TEMPDIR/delete-class.mof
+- break
+- fi
+- done
++ _DELETE_NAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+- trap "rm -f $_DELETE_NAME" EXIT
++ trap 'rm -f "$_DELETE_NAME"' EXIT
+
+ for cls in $CLASSES
+ do
+@@ -408,18 +393,11 @@ sfcb_install()
+ shift
+ done
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$baseregname.reg
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.reg") || return 1
+
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if sfcb_transform $_REGFILENAME $myregs
++ if sfcb_transform "$_REGFILENAME" $myregs
+ then
+ chatter "Staging provider registration."
+ sfcbstage -n $namespace -r $_REGFILENAME $mymofs
+@@ -467,13 +445,11 @@ openwbem_transform()
+ shift
+ moffiles=$*
+
+- if rm -f $OUTFILE
+- then
+- for _f in $moffiles
+- do
+- sed "s/Provider *( *\"cmpi:/Provider(\"cmpi::/g" < $_f >> $OUTFILE
+- done
+- fi
++ : > "$OUTFILE"
++ for _f in $moffiles
++ do
++ sed "s/Provider *( *\"cmpi:/Provider(\"cmpi::/g" < $_f >> "$OUTFILE"
++ done
+ }
+
+ openwbem_repository()
+@@ -511,25 +487,18 @@ openwbem_install()
+ state=inactive
+ fi
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$$.mof
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if openwbem_transform $_REGFILENAME $*
++ if openwbem_transform "$_REGFILENAME" $*
+ then
+ chatter Registering providers with $state owcimomd
+- $CIMMOF $_REGFILENAME > /dev/null
++ $CIMMOF "$_REGFILENAME" > /dev/null
+ else
+ echo "Failed to build OpenWBEM registration MOF." >&2
+ return 1
+- fi
++ fi
+ }
+
+ openwbem_uninstall()
+@@ -554,25 +523,18 @@ openwbem_uninstall()
+ state=inactive
+ fi
+
+- for _TEMPDIR in /var/tmp /tmp
+- do
+- if test -w $_TEMPDIR
+- then
+- _REGFILENAME=$_TEMPDIR/$$.mof
+- break
+- fi
+- done
++ _REGFILENAME=$(mktemp "${TMPDIR:-/tmp}/provider-register.XXXXXX.mof") || return 1
+
+- trap "rm -f $_REGFILENAME" EXIT
++ trap 'rm -f "$_REGFILENAME"' EXIT
+
+- if openwbem_transform $_REGFILENAME $*
++ if openwbem_transform "$_REGFILENAME" $*
+ then
+ chatter Deregistering providers with $state owcimomd
+- $CIMMOF -r $_REGFILENAME > /dev/null
++ $CIMMOF -r "$_REGFILENAME" > /dev/null
+ else
+ echo "Failed to build OpenWBEM registration MOF." >&2
+ return 1
+- fi
++ fi
+ }
+
+ cim_server()
diff --git a/sblim-cmpi-base.spec b/sblim-cmpi-base.spec
index c5900f0..31e27ce 100644
--- a/sblim-cmpi-base.spec
+++ b/sblim-cmpi-base.spec
@@ -2,7 +2,7 @@
Name: sblim-cmpi-base
Version: 1.6.4
-Release: 30%{?dist}
+Release: 31%{?dist}
Summary: SBLIM CMPI Base Providers
License: EPL-1.0
@@ -28,6 +28,8 @@ Patch8: sblim-cmpi-base-1.6.4-fix-get-os-install-date.patch
Patch9: sblim-cmpi-base-1.6.4-fix-possible-null-dereference.patch
# Patch10: fixes issues that causes FTBFS with GCC15
Patch10: sblim-cmpi-base-1.6.4-gcc15-fixes.patch
+# Patch11: uses mktemp for temporary files in provider registration script (CVE-2026-73585)
+Patch11: sblim-cmpi-base-1.6.4-secure-tmpfiles.patch
Requires: cim-server sblim-indication_helper
BuildRequires: make
BuildRequires: perl-generators
@@ -75,6 +77,7 @@ autoreconf --install --force
%patch -P8 -p1 -b .fix-get-os-install-date
%patch -P9 -p1 -b .fix-possible-null-dereference
%patch -P10 -p1 -b .gcc15-fixes
+%patch -P11 -p1 -b .secure-tmpfiles
%build
%configure \
@@ -133,6 +136,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/cmpi/*a
%postun -p /sbin/ldconfig
%changelog
+* Wed Sep 09 2026 Vitezslav Crhonek <vcrhonek@redhat.com> - 1.6.4-31
+- Use mktemp for temporary files in provider registration script (CVE-2026-73585)
+
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.4-30
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-09 12:27 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-09 12:27 [rpms/sblim-cmpi-base] f43: Fix CVE-2026-73585 Vitezslav Crhonek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox