[AutoPR- Security] Patch kata-containers-cc for CVE-2026-55969, CVE-2026-48586, CVE-2026-43871 [HIGH]

SPECS/kata-containers-cc/CVE-2026-43871.patch

@@ -0,0 +1,51 @@
+From 30a34feb076d3f7980a3ee7498e3c9da25382368 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Mon, 3 Aug 2026 18:23:26 +0000
+Subject: [PATCH] Add varint byte-count limit to compact protocol reader
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/d5152211af61f850ec393604316804096dd4632e.patch
+---
+ .../thrift/lib/go/thrift/compact_protocol.go          | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go
+index a49225d..3e1988c 100644
+--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go
++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/compact_protocol.go
+@@ -754,25 +754,28 @@ func (p *TCompactProtocol) readVarint32() (int32, error) {
+ 	return int32(v), err
+ }
+
++// maxVarint64Bytes is the maximum wire size of a varint-encoded 64-bit integer:
++// ceil(64/7) = 10 bytes, matching the protobuf wire-format specification.
++const maxVarint64Bytes = 10
++
+ // Read an i64 from the wire as a proper varint. The MSB of each byte is set
+ // if there is another byte to follow. This can read up to 10 bytes.
+ func (p *TCompactProtocol) readVarint64() (int64, error) {
+ 	shift := uint(0)
+ 	result := int64(0)
+-	for {
++	for rsize := 0; rsize < maxVarint64Bytes; rsize++ {
+ 		b, err := p.readByteDirect()
+ 		if err != nil {
+ 			return 0, err
+ 		}
+ 		result |= int64(b&0x7f) << shift
+ 		if (b & 0x80) != 0x80 {
+-			break
++			return result, nil
+ 		}
+ 		shift += 7
+ 	}
+-	return result, nil
++	return 0, NewTProtocolExceptionWithType(INVALID_DATA, errors.New("variable-length int over 10 bytes"))
+ }
+-
+ // Read a byte, unlike ReadByte that reads Thrift-byte that is i8.
+ func (p *TCompactProtocol) readByteDirect() (byte, error) {
+ 	return p.trans.ReadByte()
+-- 
+2.45.4
+

SPECS/kata-containers-cc/CVE-2026-48586.patch

@@ -0,0 +1,76 @@
+From 5fabe062a1881923a08032fd5cf53e25f94e5c6b Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Mon, 3 Aug 2026 18:23:10 +0000
+Subject: [PATCH] Add decompressed data size limit to TZlibTransport Client: go
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/apache/thrift/commit/aed9eb012c76d3d59618cbdc225c65f013ce3ab0.patch
+---
+ .../thrift/lib/go/thrift/zlib_transport.go    | 23 +++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go
+index 259943a6..328c7049 100644
+--- a/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go
++++ b/src/runtime/vendor/go.opentelemetry.io/otel/exporters/jaeger/internal/third_party/thrift/lib/go/thrift/zlib_transport.go
+@@ -22,6 +22,7 @@ package thrift
+ import (
+ 	"compress/zlib"
+ 	"context"
++	"fmt"
+ 	"io"
+ )
+
+@@ -33,9 +34,11 @@ type TZlibTransportFactory struct {
+
+ // TZlibTransport is a TTransport implementation that makes use of zlib compression.
+ type TZlibTransport struct {
+-	reader    io.ReadCloser
+-	transport TTransport
+-	writer    *zlib.Writer
++	reader      io.ReadCloser
++	transport   TTransport
++	writer      *zlib.Writer
++	conf        *TConfiguration
++	bytesRead   int64
+ }
+
+ // GetTransport constructs a new instance of NewTZlibTransport
+@@ -78,6 +81,7 @@ func NewTZlibTransport(trans TTransport, level int) (*TZlibTransport, error) {
+ // Close closes the reader and writer (flushing any unwritten data) and closes
+ // the underlying transport.
+ func (z *TZlibTransport) Close() error {
++	z.bytesRead = 0
+ 	if z.reader != nil {
+ 		if err := z.reader.Close(); err != nil {
+ 			return err
+@@ -116,7 +120,17 @@ func (z *TZlibTransport) Read(p []byte) (int, error) {
+ 		z.reader = r
+ 	}
+
+-	return z.reader.Read(p)
++	n, err := z.reader.Read(p)
++	if n > 0 {
++		z.bytesRead += int64(n)
++		if maxSize := int64(z.conf.GetMaxMessageSize()); z.bytesRead > maxSize {
++			return n, NewTProtocolExceptionWithType(
++				SIZE_LIMIT,
++				fmt.Errorf("decompressed size exceeded limit of %d bytes", maxSize),
++			)
++		}
++	}
++	return n, err
+ }
+
+ // RemainingBytes returns the size in bytes of the data that is still to be
+@@ -131,6 +145,7 @@ func (z *TZlibTransport) Write(p []byte) (int, error) {
+
+ // SetTConfiguration implements TConfigurationSetter for propagation.
+ func (z *TZlibTransport) SetTConfiguration(conf *TConfiguration) {
++	z.conf = conf
+ 	PropagateTConfiguration(z.transport, conf)
+ }
+
+-- 
+2.45.4
+