golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

.gitignore

@@ -1,3 +1,3 @@
 SOURCES/grafana-pcp-5.1.1.tar.gz
-SOURCES/grafana-pcp-vendor-5.1.1-8.tar.xz
+SOURCES/grafana-pcp-vendor-5.1.1-1.tar.xz
-SOURCES/grafana-pcp-webpack-5.1.1-8.tar.gz
+SOURCES/grafana-pcp-webpack-5.1.1-1.tar.gz

.grafana-pcp.metadata

@@ -1,3 +1,3 @@
 3b2c6875861e93eade0ab4321a49dfd6c692ca7a SOURCES/grafana-pcp-5.1.1.tar.gz
-0da8deb75d3eefa38949925375c8097671174586 SOURCES/grafana-pcp-vendor-5.1.1-8.tar.xz
+3eabf083226c04c7c5fa031d3b67d060cfc294f7 SOURCES/grafana-pcp-vendor-5.1.1-1.tar.xz
-f09017e8136fae1182ec8df6c76d2bac92733869 SOURCES/grafana-pcp-webpack-5.1.1-8.tar.gz
+55fa447cbf8ffddc4ba5e50dc81b81e89f0f2fc7 SOURCES/grafana-pcp-webpack-5.1.1-1.tar.gz

SOURCES/0002-add-uwsgi-dashboard.patch

@@ -1,197 +0,0 @@
-From e27f6d2954201734d30713a870d279de87fadd2d Mon Sep 17 00:00:00 2001
-From: Sam Feifer <sfeifer@redhat.com>
-Date: Tue, 2 Jul 2024 12:01:39 -0400
-Subject: [PATCH] uwsgi dashboard patch
-
----
- .../pcp-vector-uwsgi-overview.jsonnet         | 160 ++++++++++++++++++
- src/datasources/vector/plugin.json            |   5 +
- 2 files changed, 165 insertions(+)
- create mode 100644 src/datasources/vector/dashboards/pcp-vector-uwsgi-overview.jsonnet
-
-diff --git a/src/datasources/vector/dashboards/pcp-vector-uwsgi-overview.jsonnet b/src/datasources/vector/dashboards/pcp-vector-uwsgi-overview.jsonnet
-new file mode 100644
-index 0000000..2c9d2a4
---- /dev/null
-+++ b/src/datasources/vector/dashboards/pcp-vector-uwsgi-overview.jsonnet
-@@ -0,0 +1,160 @@
-+local grafana = import 'grafonnet/grafana.libsonnet';
-+
-+grafana.dashboard.new(
-+  'PCP Vector: UWSGI Overview',
-+  tags=['pcp-vector', 'uwsgi'],
-+  time_from='now-5m',
-+  time_to='now',
-+  refresh='5s',
-+)
-+.addTemplate(
-+  grafana.template.datasource(
-+    'datasource',
-+    'performancecopilot-vector-datasource',
-+    'PCP Vector',
-+  )
-+)
-+.addPanel(
-+  grafana.graphPanel.new(
-+    'Total Worker Count',
-+    datasource='$datasource',
-+    decimals=0,
-+    min=0
-+  )
-+  .addTargets([
-+    { expr: 'uwsgi.summary.total_workers', format: 'time_series', legendFormat: '$metric' },
-+  ]), gridPos={
-+    x: 0,
-+    y: 0,
-+    w: 12,
-+    h: 8,
-+  }
-+)
-+.addPanel(
-+  grafana.graphPanel.new(
-+    'Pause Worker Count',
-+    datasource='$datasource',
-+    decimals=0,
-+    min=0,
-+  )
-+  .addTargets([
-+    { expr: 'uwsgi.summary.total_pause_worker_count', format: 'time_series', legendFormat: '$metric' },
-+  ]), gridPos={
-+    x: 12,
-+    y: 0,
-+    w: 12,
-+    h: 8,
-+  }
-+)
-+.addPanel(
-+  grafana.graphPanel.new(
-+    'Idle Worker Count',
-+    datasource='$datasource',
-+    decimals=0,
-+    min=0,
-+  )
-+  .addTargets([
-+    { expr: 'uwsgi.summary.total_idle_worker_count', format: 'time_series', legendFormat: '$metric' },
-+  ]), gridPos={
-+    x: 0,
-+    y: 8,
-+    w: 12,
-+    h: 8,
-+  }
-+)
-+.addPanel(
-+  grafana.graphPanel.new(
-+    'Busy Worker Count',
-+    datasource='$datasource',
-+    decimals=0,
-+    min=0,
-+  )
-+  .addTargets([
-+    { expr: 'uwsgi.summary.total_busy_worker_count', format: 'time_series', legendFormat: '$metric' },
-+  ]), gridPos={
-+    x: 12,
-+    y: 8,
-+    w: 12,
-+    h: 8,
-+  }
-+)
-+.addPanel(
-+  grafana.graphPanel.new(
-+    'Harakiri Count',
-+    datasource='$datasource',
-+    decimals=0,
-+    min=0,
-+  )
-+  .addTargets([
-+    { expr: 'uwsgi.summary.total_harakiri_count', format: 'time_series', legendFormat: '$metric' },
-+  ]), gridPos={
-+    x: 0,
-+    y: 16,
-+    w: 12,
-+    h: 8,
-+  }
-+)
-+.addPanel(
-+  grafana.graphPanel.new(
-+    'Total Exceptions',
-+    datasource='$datasource',
-+    decimals=0,
-+    min=0,
-+  )
-+  .addTargets([
-+    { expr: 'uwsgi.summary.total_exceptions', format: 'time_series', legendFormat: '$metric' },
-+  ]), gridPos={
-+    x: 12,
-+    y: 16,
-+    w: 12,
-+    h: 8,
-+  }
-+)
-+.addPanel(
-+  grafana.graphPanel.new(
-+    'Total Workers Acceptions Requests',
-+    datasource='$datasource',
-+    decimals=0,
-+    min=0,
-+  )
-+  .addTargets([
-+    { expr: 'uwsgi.summary.total_workers_accepting_requests', format: 'time_series', legendFormat: '$metric' },
-+  ]), gridPos={
-+    x: 0,
-+    y: 24,
-+    w: 12,
-+    h: 8,
-+  }
-+)
-+.addPanel(
-+  grafana.graphPanel.new(
-+    'Total Requests Served',
-+    datasource='$datasource',
-+    decimals=0,
-+    min=0,
-+  )
-+  .addTargets([
-+    { expr: 'uwsgi.summary.total_requests_served', format: 'time_series', legendFormat: '$metric' },
-+  ]), gridPos={
-+    x: 12,
-+    y: 24,
-+    w: 12,
-+    h: 8,
-+  }
-+)
-+.addPanel(
-+  grafana.graphPanel.new(
-+    'Average Response Time (msec)',
-+    datasource='$datasource',
-+    decimals=0,
-+    min=0,
-+  )
-+  .addTargets([
-+    { expr: 'uwsgi.summary.avg_response_time_msec', format: 'time_series', legendFormat: '$metric' },
-+  ]), gridPos={
-+    x: 0,
-+    y: 32,
-+    w: 12,
-+    h: 8,
-+  }
-+)
-\ No newline at end of file
-diff --git a/src/datasources/vector/plugin.json b/src/datasources/vector/plugin.json
-index a28e3f4..277c8c9 100644
---- a/src/datasources/vector/plugin.json
-+++ b/src/datasources/vector/plugin.json
-@@ -45,6 +45,11 @@
-             "type": "dashboard",
-             "name": "PCP Vector: Microsoft SQL Server",
-             "path": "dashboards/pcp-vector-mssql-server.json"
-+        },
-+        {
-+            "type": "dashboard",
-+            "name": "PCP Vector: UWSGI Overview",
-+            "path": "dashboards/pcp-vector-uwsgi-overview.json"
-         }
-     ]
- }
--- 
-2.45.2
-

SOURCES/create_bundles.sh

@@ -26,9 +26,6 @@ go mod vendor
 awk '$2 ~ /^v/ && $4 != "indirect" {print "Provides: bundled(golang(" $1 ")) = " substr($2, 2)}' go.mod | \
     sed -E 's/=(.*)-(.*)-(.*)/=\1-\2.\3/g' > "../${VENDOR_TAR}.manifest"
 
-# patch in uwsgi dashboard before webpack compilation
-patch -p1 --fuzz=0 < ../0002-add-uwsgi-dashboard.patch
-
 # Vendor Node.js dependencies
 patch -p1 --fuzz=0 < ../0001-remove-unused-frontend-crypto.patch
 yarn install --frozen-lockfile

SPECS/grafana-pcp.spec

@@ -16,20 +16,20 @@ end}
 
 Name:           grafana-pcp
 Version:        5.1.1
-Release:        9%{?dist}
+Release:        2%{?dist}.alma.1
 Summary:        Performance Co-Pilot Grafana Plugin
 License:        ASL 2.0
 URL:            https://github.com/performancecopilot/grafana-pcp
 
 Source0:        https://github.com/performancecopilot/grafana-pcp/archive/v%{version}/%{name}-%{version}.tar.gz
-Source1:        grafana-pcp-vendor-%{version}-8.tar.xz
+Source1:        grafana-pcp-vendor-%{version}-1.tar.xz
 # Note: In case there were no changes to this tarball, the NVR of this tarball
 # lags behind the NVR of this package.
 %if %{compile_frontend} == 0
 # Source2 contains the precompiled frontend and dashboards
 # Note: In case there were no changes to this tarball, the NVR of this tarball
 # lags behind the NVR of this package.
-Source2:        grafana-pcp-webpack-%{version}-8.tar.gz
+Source2:        grafana-pcp-webpack-%{version}-1.tar.gz
 %endif
 Source3:        create_bundles.sh
 Source4:        build_frontend.sh
@@ -37,7 +37,6 @@ Source5:        list_bundled_nodejs_packages.py
 Source6:        create_bundles_in_container.sh
 
 Patch1:         0001-remove-unused-frontend-crypto.patch
-Patch2:         0002-add-uwsgi-dashboard.patch
 
 # Intersection of go_arches and nodejs_arches
 ExclusiveArch: %{grafanapcp_arches}
@@ -135,7 +134,7 @@ bpftrace scripts from pmdabpftrace(1), as well as several dashboards.
 %endif
 
 %patch -P 1 -p1
-%patch -P 2 -p1
+
 
 %build
 # Build frontend data sources
@@ -194,14 +193,8 @@ yarn test
 
 
 %changelog
-* Thu Oct 10 2024 Sam Feifer <sfeifer@redhat.com> - 5.1.1-9
+* Wed Apr 03 2024 Andrew Lukoshko <alukoshko@almalinux.org> 5.1.1-2.alma.1
-- Resolves RHEL-61780: CVE-2024-9355
+- golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
-
-* Mon Jul 8 2024 Sam Feifer <sfeifer@redhat.com> - 5.1.1-8
-- Add a premade uwsgi dashboard for the vector datasource
-
-* Tue Apr 16 2024 Sam Feifer <sfeifer@redhat.com> 5.1.1-2
-- fix CVE-2024-1394
 
 * Thu Apr 20 2023 Stan Cox <scox@redhat.com> 5.1.1-1
 - update to 5.1.1 tagged upstream community sources, see CHANGELOG