8add3116c9
Add a minimal targeted patch (Patch3) to fix CVE-2026-39821 in the
vendored golang.org/x/net IDNA package. The patch adds an all-ASCII
rejection check in the process() method so that xn-- labels that
decode to pure ASCII are properly rejected with an A3 error. This
addresses a specification bug in UTS 46 (corrected in revision 33).
The upstream unicode16 version guard was intentionally removed since
RHEL 8 ships Go 1.21 with Unicode 15.0.0, ensuring the fix is
always active.
CVE: CVE-2026-39821
Upstream patches:
- 8c4c965e02.patch
Resolves: RHEL-183731
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
40 lines
1.5 KiB
Diff
40 lines
1.5 KiB
Diff
From adfb8ef6fc0e091b061472cf8e68122be1bbd907 Mon Sep 17 00:00:00 2001
|
|
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
|
|
Date: Fri, 12 Jun 2026 11:09:33 +0000
|
|
Subject: [PATCH] idna: reject xn-- labels that decode to all-ASCII
|
|
|
|
Add an all-ASCII rejection check in the process method of the IDNA
|
|
package. After Punycode decoding an xn-- label, check if the decoded
|
|
result is pure ASCII. If so, return an A3 error (invalid Punycode label).
|
|
|
|
This fixes a specification bug in UTS 46 (corrected in revision 33)
|
|
where xn-- labels that decode to all-ASCII were not properly rejected.
|
|
|
|
The upstream fix in golang/net@8c4c965 guards this check behind a
|
|
unicode16 flag, but since RHEL 8 ships Go 1.21 with Unicode 15.0.0,
|
|
the guard is removed here so the fix is always active.
|
|
|
|
For golang/go#78760
|
|
CVE: CVE-2026-39821
|
|
---
|
|
vendor/golang.org/x/net/idna/idna10.0.0.go | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/vendor/golang.org/x/net/idna/idna10.0.0.go b/vendor/golang.org/x/net/idna/idna10.0.0.go
|
|
index 64ccf85..170095d 100644
|
|
--- a/vendor/golang.org/x/net/idna/idna10.0.0.go
|
|
+++ b/vendor/golang.org/x/net/idna/idna10.0.0.go
|
|
@@ -371,6 +371,9 @@ func (p *Profile) process(s string, toASCII bool) (string, error) {
|
|
// Spec says keep the old label.
|
|
continue
|
|
}
|
|
+ if err == nil && ascii(u) {
|
|
+ err = punyError(label[len(acePrefix):])
|
|
+ }
|
|
isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight
|
|
labels.set(u)
|
|
if err == nil && p.fromPuny != nil {
|
|
--
|
|
2.52.0
|
|
|