From 4ab50a028454973abb13ab8497f229366246d897 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Tue, 18 Aug 2026 19:50:33 +0530 Subject: [PATCH 1/4] [AutoPR- Security] Patch flannel for CVE-2026-73500 [HIGH] (#18455) (cherry picked from commit 1127304e4ec5067ad2524969afccb80dc7fab4f9) --- SPECS/flannel/CVE-2026-73500.patch | 48 ++++++++++++++++++++++++++++++ SPECS/flannel/flannel.spec | 6 ++++ 2 files changed, 54 insertions(+) create mode 100644 SPECS/flannel/CVE-2026-73500.patch diff --git a/SPECS/flannel/CVE-2026-73500.patch b/SPECS/flannel/CVE-2026-73500.patch new file mode 100644 index 00000000000..7f8df7195cd --- /dev/null +++ b/SPECS/flannel/CVE-2026-73500.patch @@ -0,0 +1,48 @@ +From e3210e9f43988400c61dc1be04f8acf889e5dc1d Mon Sep 17 00:00:00 2001 +From: Benjamin Wang +Date: Tue, 21 Jul 2026 10:16:47 +0100 +Subject: [PATCH] Set a tlsHandshakeTimeout for tlsListener + +Signed-off-by: Benjamin Wang +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3.patch +--- + .../etcd/client/pkg/v3/transport/listener_tls.go | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go b/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go +index 6f16009..7e009f1 100644 +--- a/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go ++++ b/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go +@@ -23,6 +23,12 @@ import ( + "net" + "strings" + "sync" ++ "time" ++) ++ ++const ( ++ // tlsHandshakeTimeout bounds how long a single TLS handshake may block. ++ tlsHandshakeTimeout = 10 * time.Second + ) + + // tlsListener overrides a TLS listener so it will reject client +@@ -143,6 +149,7 @@ func (l *tlsListener) acceptLoop() { + }() + + tlsConn := conn.(*tls.Conn) ++ _ = tlsConn.SetDeadline(time.Now().Add(tlsHandshakeTimeout)) + herr := tlsConn.Handshake() + pendingMu.Lock() + delete(pending, conn) +@@ -152,6 +159,7 @@ func (l *tlsListener) acceptLoop() { + l.handshakeFailure(tlsConn, herr) + return + } ++ _ = tlsConn.SetDeadline(time.Time{}) + if err := l.check(ctx, tlsConn); err != nil { + l.handshakeFailure(tlsConn, err) + return +-- +2.45.4 + diff --git a/SPECS/flannel/flannel.spec b/SPECS/flannel/flannel.spec index b18262e63cc..80467176d7d 100644 --- a/SPECS/flannel/flannel.spec +++ b/SPECS/flannel/flannel.spec @@ -20,6 +20,7 @@ Patch5: CVE-2025-65637.patch Patch6: CVE-2026-32241.patch Patch7: CVE-2026-39821.patch Patch8: CVE-2026-56852.patch +Patch9: CVE-2026-73500.patch BuildRequires: gcc BuildRequires: glibc-devel BuildRequires: glibc-static >= 2.38-21%{?dist} @@ -56,8 +57,13 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./dist/flanneld %{_bindir}/flanneld %changelog +<<<<<<< HEAD * Wed Aug 12 2026 Kshitiz Godara - 0.24.2-30 - Bump to rebuild with updated glibc +======= +* Fri Aug 14 2026 Azure Linux Security Servicing Account - 0.24.2-30 +- Patch for CVE-2026-73500 +>>>>>>> 1127304e4e ([AutoPR- Security] Patch flannel for CVE-2026-73500 [HIGH] (#18455)) * Mon Jul 27 2026 Azure Linux Security Servicing Account - 0.24.2-29 - Patch for CVE-2026-56852 From 764d96147ca49e13ac958a888a61f6f45cefa801 Mon Sep 17 00:00:00 2001 From: "azurelinux-ci-jwt-app[bot]" <293883219+azurelinux-ci-jwt-app[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 14:29:46 +0000 Subject: [PATCH 2/4] Conflicts resolved by Auto-Cherry Pick for SPECS/flannel/flannel.spec --- SPECS/flannel/flannel.spec | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/SPECS/flannel/flannel.spec b/SPECS/flannel/flannel.spec index 80467176d7d..529662b3d13 100644 --- a/SPECS/flannel/flannel.spec +++ b/SPECS/flannel/flannel.spec @@ -2,8 +2,17 @@ %define our_gopath %{_topdir}/.gopath Summary: Simple and easy way to configure a layer 3 network fabric designed for Kubernetes Name: flannel -Version: 0.24.2 -Release: 30%{?dist} +%{_bindir}/flanneld + +%changelog +* Tue Aug 18 2026 Kshitiz Godara - 0.24.2-31 +- Bump to rebuild with updated glibc + +* Fri Aug 14 2026 Azure Linux Security Servicing Account - 0.24.2-30 +- Patch for CVE-2026-73500 + +* Mon Jul 27 2026 Azure Linux Security Servicing Account - 0.24.2-29 +- Patch for CVE-2026-56852 License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Azure Linux @@ -54,19 +63,10 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./dist/flanneld %defattr(-,root,root) %doc README.md CONTRIBUTING.md DCO %license LICENSE -%{_bindir}/flanneld - -%changelog -<<<<<<< HEAD -* Wed Aug 12 2026 Kshitiz Godara - 0.24.2-30 -- Bump to rebuild with updated glibc -======= -* Fri Aug 14 2026 Azure Linux Security Servicing Account - 0.24.2-30 -- Patch for CVE-2026-73500 ->>>>>>> 1127304e4e ([AutoPR- Security] Patch flannel for CVE-2026-73500 [HIGH] (#18455)) - -* Mon Jul 27 2026 Azure Linux Security Servicing Account - 0.24.2-29 -- Patch for CVE-2026-56852 +Patch6: CVE-2026-32241.patch +Patch7: CVE-2026-39821.patch +Patch8: CVE-2026-56852.patch +Patch9: CVE-2026-73500.patch * Wed May 27 2026 Azure Linux Security Servicing Account - 0.24.2-28 - Patch for CVE-2026-39821 From 1b53001eb1841abd20649f7475e089e653e091c8 Mon Sep 17 00:00:00 2001 From: jslobodzian Date: Wed, 19 Aug 2026 15:24:47 -0400 Subject: [PATCH 3/4] Fix garbled auto-merge of flannel.spec (CVE-2026-73500 cherry-pick) The AI conflict resolver corrupted the spec: deleted Version/Release from the preamble, relocated %changelog into the header, and duplicated Patch6-9 into %files. Rebuilt from the canonical fasttrack/3.0 spec (Release 30 + CVE-2026-73500 at Patch9) and re-sequenced the 3.0-dev glibc rebuild bump on top as 0.24.2-31. --- SPECS/flannel/flannel.spec | 30 ++++++++++++++---------------- 1 file changed, 14 insertions(+), 16 deletions(-) diff --git a/SPECS/flannel/flannel.spec b/SPECS/flannel/flannel.spec index 529662b3d13..14db8a05ef8 100644 --- a/SPECS/flannel/flannel.spec +++ b/SPECS/flannel/flannel.spec @@ -2,17 +2,8 @@ %define our_gopath %{_topdir}/.gopath Summary: Simple and easy way to configure a layer 3 network fabric designed for Kubernetes Name: flannel -%{_bindir}/flanneld - -%changelog -* Tue Aug 18 2026 Kshitiz Godara - 0.24.2-31 -- Bump to rebuild with updated glibc - -* Fri Aug 14 2026 Azure Linux Security Servicing Account - 0.24.2-30 -- Patch for CVE-2026-73500 - -* Mon Jul 27 2026 Azure Linux Security Servicing Account - 0.24.2-29 -- Patch for CVE-2026-56852 +Version: 0.24.2 +Release: 31%{?dist} License: ASL 2.0 Vendor: Microsoft Corporation Distribution: Azure Linux @@ -32,7 +23,7 @@ Patch8: CVE-2026-56852.patch Patch9: CVE-2026-73500.patch BuildRequires: gcc BuildRequires: glibc-devel -BuildRequires: glibc-static >= 2.38-21%{?dist} +BuildRequires: glibc-static >= 2.38-20%{?dist} BuildRequires: golang < 1.25 BuildRequires: kernel-headers @@ -63,10 +54,17 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./dist/flanneld %defattr(-,root,root) %doc README.md CONTRIBUTING.md DCO %license LICENSE -Patch6: CVE-2026-32241.patch -Patch7: CVE-2026-39821.patch -Patch8: CVE-2026-56852.patch -Patch9: CVE-2026-73500.patch +%{_bindir}/flanneld + +%changelog +* Wed Aug 19 2026 Kshitiz Godara - 0.24.2-31 +- Bump to rebuild with updated glibc + +* Fri Aug 14 2026 Azure Linux Security Servicing Account - 0.24.2-30 +- Patch for CVE-2026-73500 + +* Mon Jul 27 2026 Azure Linux Security Servicing Account - 0.24.2-29 +- Patch for CVE-2026-56852 * Wed May 27 2026 Azure Linux Security Servicing Account - 0.24.2-28 - Patch for CVE-2026-39821 From d07dc54e1c53e9ac17b764e060519b69c3ef0813 Mon Sep 17 00:00:00 2001 From: jslobodzian Date: Wed, 19 Aug 2026 15:26:09 -0400 Subject: [PATCH 4/4] Preserve 3.0-dev glibc-static >= 2.38-21 BuildRequires in flannel merge Follow-up to the spec rebuild: the 3.0-dev '-30' glibc rebuild bump also raised glibc-static from 2.38-20 to 2.38-21. Keep the higher requirement alongside the re-sequenced 0.24.2-31 changelog entry. --- SPECS/flannel/flannel.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SPECS/flannel/flannel.spec b/SPECS/flannel/flannel.spec index 14db8a05ef8..eef13c45a47 100644 --- a/SPECS/flannel/flannel.spec +++ b/SPECS/flannel/flannel.spec @@ -23,7 +23,7 @@ Patch8: CVE-2026-56852.patch Patch9: CVE-2026-73500.patch BuildRequires: gcc BuildRequires: glibc-devel -BuildRequires: glibc-static >= 2.38-20%{?dist} +BuildRequires: glibc-static >= 2.38-21%{?dist} BuildRequires: golang < 1.25 BuildRequires: kernel-headers