rpms/git-lfs
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-39821 in vendored golang.org/x/net/idna package

Browse Source 
Backport upstream commit 8c4c965e028475082408749b50ed7a686df0d265
from github.com/golang/net to fix CVE-2026-39821 in the vendored
golang.org/x/net/idna package.

The fix causes the idna package to correctly reject xn-- labels
which decode to all-ASCII labels, addressing a specification bug
corrected in UTS 46 revision 33. The patch modifies 13 files in
the vendored idna package, removing obsolete version-specific
files and updating core functionality.

CVE: CVE-2026-33811, CVE-2026-39821
Upstream patches:
 - https://github.com/golang/net/commit/8c4c965e0284.patch
Resolves: RHEL-183684, RHEL-187159

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-13 12:35:57 +00:00
parent d229ea4f46
commit f4128a54b0
2 changed files with 24746 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24742
git-lfs-3.7.1-CVE-2026-39821.patch Normal file
View File

File diff suppressed because it is too large Load Diff

4
git-lfs.spec
View File

@ -28,6 +28,10 @@ Source1: README.Fedora
# https://github.com/git-lfs/git-lfs/pull/6237
Patch0: 0001-commands-fix-format-string-type-mismatch-in-lockveri.patch
# CVE-2026-39821: vendored golang.org/x/net/idna fix
# https://github.com/golang/net/commit/8c4c965e0284
Patch1: git-lfs-3.7.1-CVE-2026-39821.patch
# Generated provides by vendor2provides.py
# https://src.fedoraproject.org/rpms/syncthing/blob/603e4e03a92a7d704d199629dd85304018e8279d/f/vendor2provides.py
Provides: bundled(golang(github.com/alexbrainman/sspi)) = 909beea