diff --git a/SPECS/telegraf/CVE-2026-41602.patch b/SPECS/telegraf/CVE-2026-41602.patch index 07d165f912f..dc9315ad3da 100644 --- a/SPECS/telegraf/CVE-2026-41602.patch +++ b/SPECS/telegraf/CVE-2026-41602.patch @@ -1,55 +1,49 @@ -From 17ad5616555d45b546429e4c030e4a47f793392e Mon Sep 17 00:00:00 2001 -From: Jens Geyer -Date: Wed, 8 Apr 2026 23:06:45 +0200 -Subject: [PATCH] added int range checks +From 014e14050b309750f09c2b446e64ba88d22e7938 Mon Sep 17 00:00:00 2001 +From: Kanishk Bansal +Date: Mon, 3 Aug 2026 06:01:28 +0000 +Subject: [PATCH] upgrade thrift to v0.24.0 -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/apache/thrift/commit/630d66c633a88bbae4a2a090fcb41f72dd1adc6a.patch --- - .../thrift/lib/go/thrift/framed_transport.go | 14 ++++++++++++-- - 1 file changed, 12 insertions(+), 2 deletions(-) + go.mod | 4 ++-- + go.sum | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) -diff --git a/vendor/github.com/apache/thrift/lib/go/thrift/framed_transport.go b/vendor/github.com/apache/thrift/lib/go/thrift/framed_transport.go -index e3c323af..00f277e1 100644 ---- a/vendor/github.com/apache/thrift/lib/go/thrift/framed_transport.go -+++ b/vendor/github.com/apache/thrift/lib/go/thrift/framed_transport.go -@@ -26,6 +26,7 @@ import ( - "encoding/binary" - "fmt" - "io" -+ "math" - ) +diff --git a/go.mod b/go.mod +index 412d7a0..03c7aad 100644 +--- a/go.mod ++++ b/go.mod +@@ -1,6 +1,6 @@ + module github.com/influxdata/telegraf - // Deprecated: Use DEFAULT_MAX_FRAME_SIZE instead. -@@ -60,8 +61,13 @@ func NewTFramedTransportFactory(factory TTransportFactory) TTransportFactory { +-go 1.22.0 ++go 1.25 - // Deprecated: Use NewTFramedTransportFactoryConf instead. - func NewTFramedTransportFactoryMaxLength(factory TTransportFactory, maxLength uint32) TTransportFactory { -+ safeMax := maxLength -+ if safeMax > math.MaxInt32 { -+ safeMax = math.MaxInt32 -+ } -+ - return NewTFramedTransportFactoryConf(factory, &TConfiguration{ -- MaxFrameSize: int32(maxLength), -+ MaxFrameSize: int32(safeMax), - - noPropagation: true, - }) -@@ -196,8 +202,12 @@ func (p *TFramedTransport) WriteString(s string) (n int, err error) { - } - - func (p *TFramedTransport) Flush(ctx context.Context) error { -- defer bufPool.put(&p.writeBuf) - size := p.writeBuf.Len() -+ if size > math.MaxUint32 { -+ return NewTTransportException(UNKNOWN_TRANSPORT_EXCEPTION, fmt.Sprintf("frame too large: %d bytes exceeds uint32 max",size)) -+ } -+ -+ defer bufPool.put(&p.writeBuf) - buf := p.buffer[:4] - binary.BigEndian.PutUint32(buf, uint32(size)) - _, err := p.transport.Write(buf) + require ( + cloud.google.com/go/bigquery v1.61.0 +@@ -37,7 +37,7 @@ require ( + github.com/apache/arrow/go/v13 v13.0.0 + github.com/apache/arrow/go/v16 v16.0.0-20240319161736-1ee3da0064a0 + github.com/apache/iotdb-client-go v1.2.0-tsbs +- github.com/apache/thrift v0.19.0 ++ github.com/apache/thrift v0.24.0 + github.com/aristanetworks/goarista v0.0.0-20190325233358-a123909ec740 + github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 + github.com/awnumar/memguard v0.22.5 +diff --git a/go.sum b/go.sum +index 60b357d..245dae3 100644 +--- a/go.sum ++++ b/go.sum +@@ -808,8 +808,8 @@ github.com/apache/iotdb-client-go v1.2.0-tsbs h1:hezGUydAkDSceCvsetYorI87S2e8HZ4 + github.com/apache/iotdb-client-go v1.2.0-tsbs/go.mod h1:3D6QYkqRmASS/4HsjU+U/3fscyc5M9xKRfywZsKuoZY= + github.com/apache/thrift v0.15.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU= + github.com/apache/thrift v0.16.0/go.mod h1:PHK3hniurgQaNMZYaCLEqXKsYK8upmhPbmdP2FXSqgU= +-github.com/apache/thrift v0.19.0 h1:sOqkWPzMj7w6XaYbJQG7m4sGqVolaW/0D28Ln7yPzMk= +-github.com/apache/thrift v0.19.0/go.mod h1:SUALL216IiaOw2Oy+5Vs9lboJ/t9g40C+G07Dc0QC1I= ++github.com/apache/thrift v0.24.0 h1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ= ++github.com/apache/thrift v0.24.0/go.mod h1:zPt6WxgvTOM6hF92y8C+MkEM5LMxZuk4JcQOiU4Esvs= + github.com/apex/log v1.6.0/go.mod h1:x7s+P9VtvFBXge9Vbn+8TrqKmuzmD35TTkeBHul8UtY= + github.com/apex/logs v1.0.0/go.mod h1:XzxuLZ5myVHDy9SAmYpamKKRNApGj54PfYLcFrXqDwo= + github.com/aphistic/golf v0.0.0-20180712155816-02c07f170c5a/go.mod h1:3NqKYiepwy8kCu4PNA+aP7WUV72eXWJeP9/r3/K9aLE= -- 2.45.4 diff --git a/SPECS/telegraf/telegraf.signatures.json b/SPECS/telegraf/telegraf.signatures.json index 1d2f0c9a2b6..fc6cf7e8ada 100644 --- a/SPECS/telegraf/telegraf.signatures.json +++ b/SPECS/telegraf/telegraf.signatures.json @@ -1,6 +1,6 @@ { "Signatures": { "telegraf-1.31.0.tar.gz": "c7a4725aefaf6cab4a354c577e06032187ce1c428337c795e48bbe7d7054d489", - "telegraf-1.31.0-vendor.tar.gz": "582012893525873ef2b93b95714ea87b002405a1425806a0392ac50e235d3ed0" + "telegraf-1.31.0-v1-vendor.tar.gz": "e2a1f51ade0483b61757a7f61ff223f45d3b9874cda91e066e3bee3d64b0b234" } } \ No newline at end of file diff --git a/SPECS/telegraf/telegraf.spec b/SPECS/telegraf/telegraf.spec index 6949b2a406c..eb6b44ea506 100644 --- a/SPECS/telegraf/telegraf.spec +++ b/SPECS/telegraf/telegraf.spec @@ -1,7 +1,7 @@ Summary: agent for collecting, processing, aggregating, and writing metrics. Name: telegraf Version: 1.31.0 -Release: 25%{?dist} +Release: 26%{?dist} License: MIT Vendor: Microsoft Corporation Distribution: Azure Linux @@ -9,7 +9,7 @@ Group: Development/Tools URL: https://github.com/influxdata/telegraf Source0: %{url}/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz # Use the generate_source_tarbbal.sh script to get the vendored sources. -Source1: %{name}-%{version}-vendor.tar.gz +Source1: %{name}-%{version}-v1-vendor.tar.gz Patch0: CVE-2024-35255.patch Patch1: CVE-2024-37298.patch @@ -130,6 +130,9 @@ fi %dir %{_sysconfdir}/%{name}/telegraf.d %changelog +* Mon Aug 03 2026 Kanishk Bansal - 1.31.0-26 +- Upgrade thrift module to 0.24.0 + * Tue Jul 28 2026 Azure Linux Security Servicing Account - 1.31.0-25 - Patch for CVE-2026-56852