import UBI isns-utils-0.101-4.el9_8.1

SOURCES/isns-utils-0.101-CVE-2026-55995.patch

@@ -0,0 +1,36 @@
+From a264452f904c6c72e95ff1189246e3a09fd12da1 Mon Sep 17 00:00:00 2001
+From: Lee Duncan <lduncan@suse.com>
+Date: Tue, 28 Jul 2026 11:07:24 -0700
+Subject: [PATCH] Fix issue in error path causing double-free.
+
+In attrs.c, when buf_get() fails and allocated memory is
+freed, we also need to set the pointer to that memory to
+NULL, to prevent a double free from occuring, would could
+lead to a DoS attack.
+
+References: CVE-2026-55995
+Found-by: <keith@linnemanlabs.com>
+---
+ attrs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/attrs.c b/attrs.c
+index 44d9675..8e48170 100644
+--- a/attrs.c
++++ b/attrs.c
+@@ -1371,6 +1371,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value)
+ 	value->iv_string = isns_malloc(len + 1);
+ 	if (!buf_get(bp, value->iv_string, len)) {
+ 		isns_free(value->iv_string);
++		value->iv_string = NULL;
+ 		return 0;
+ 	}
+ 	value->iv_string[len] = '\0';
+@@ -1546,6 +1547,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value)
+ 	value->iv_opaque.ptr = isns_malloc(len);
+ 	if (!buf_get(bp, value->iv_opaque.ptr, len)) {
+ 		isns_free(value->iv_opaque.ptr);
++		value->iv_opaque.ptr = NULL;
+ 		return 0;
+ 	}
+ 

SOURCES/test_as_installed.patch

@@ -1,15 +1,15 @@
-From 420ae1af11fad3151b5bfa676e7218168e4e6f3f Mon Sep 17 00:00:00 2001
+From 224f1d45934346f1836c75d9ce257029960543b9 Mon Sep 17 00:00:00 2001
 From: Chris Leech <cleech@redhat.com>
 Date: Wed, 26 May 2021 10:00:17 -0700
 Subject: [PATCH 1/1] run tests with binaries from arbitrary paths
 
 ---
  tests/Makefile   | 4 ++++
- tests/harness.py | 4 ++++
- 2 files changed, 8 insertions(+)
+ tests/harness.py | 6 +++++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
 
 diff --git a/tests/Makefile b/tests/Makefile
-index 372572d..2c61183 100644
+index 372572d..93bcac7 100644
 --- a/tests/Makefile
 +++ b/tests/Makefile
 @@ -48,3 +48,7 @@ quick: tests-no-security
@@ -19,9 +19,9 @@ index 372572d..2c61183 100644
 +
 +tests-as-installed:
 +	@echo running tests from installed executables -- takes about 2 minutes
-+	./test-isns.py -s --path="/usr/sbin"
++	./test-isns.py --path="/usr/sbin"
 diff --git a/tests/harness.py b/tests/harness.py
-index 39fc5e6..b710f5a 100644
+index 39fc5e6..83091ea 100644
 --- a/tests/harness.py
 +++ b/tests/harness.py
 @@ -137,6 +137,9 @@ def new_initArgParsers(self):
@@ -42,6 +42,15 @@ index 39fc5e6..b710f5a 100644
      dprint("found: verbosity=%d, security=%s" % \
             (Global.verbosity, Global.security))
  
+@@ -415,7 +419,7 @@ def isns_external_test(client_config, args):
+     """
+     logfile = get_logfile_from_config(client_config.path)
+ 
+-    cmd = ['%s/%s' % (Global._isns_bin_dir, args[0]),
++    cmd = ['%s/%s' % ("..", args[0]),
+            '-c', client_config.path] + args[1:]
+     exit_val = run_cmd(cmd, logfile)
+     return (logfile, exit_val)
 -- 
-2.31.1
+2.55.0
 

SPECS/isns-utils.spec

@@ -1,6 +1,6 @@
 Name:           isns-utils
 Version:        0.101
-Release:        4%{?dist}
+Release:        4%{?dist}.1
 Summary:        The iSNS daemon and utility programs
 
 License:        LGPLv2+
@@ -8,6 +8,9 @@ URL:            https://github.com/open-iscsi/open-isns
 Source0:        https://github.com/open-iscsi/open-isns/archive/v%{version}.tar.gz#/open-isns-%{version}.tar.gz
 Source1:        isnsd.service
 Patch1:         test_as_installed.patch
+# https://issues.redhat.com/browse/RHEL-219470
+# https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb
+Patch2:         isns-utils-0.101-CVE-2026-55995.patch
 
 BuildRequires:  gcc
 BuildRequires:  automake pkgconfig systemd-devel systemd
@@ -15,6 +18,7 @@ BuildRequires: make
 Requires(post): systemd-units
 Requires(preun): systemd-units
 Requires(postun): systemd-units
+Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 
 %description
 The iSNS package contains the daemon and tools to setup a iSNS server,
@@ -104,6 +108,9 @@ install -p -m 644 %{SOURCE1} %{buildroot}%{_unitdir}/isnsd.service
 
 
 %changelog
+* Thu Jul 30 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 0.101-4.1
+- Fix CVE-2026-55995: prevent double-free in attrs.c error paths
+
 * Tue Sep 14 2021 Chris Leech <cleech@redhat.com> - 0.101-4
 - #1934951 remove DSA/SHA-1 based authentication support