From 6688bc9cacaa317768d4f9cc08052e8ee80fd1f9 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 11 Aug 2026 16:29:50 -0400 Subject: [PATCH] import UBI isns-utils-0.101-4.el9_8.1 --- SOURCES/isns-utils-0.101-CVE-2026-55995.patch | 36 +++++++++++++++++++ SOURCES/test_as_installed.patch | 23 ++++++++---- SPECS/isns-utils.spec | 9 ++++- 3 files changed, 60 insertions(+), 8 deletions(-) create mode 100644 SOURCES/isns-utils-0.101-CVE-2026-55995.patch diff --git a/SOURCES/isns-utils-0.101-CVE-2026-55995.patch b/SOURCES/isns-utils-0.101-CVE-2026-55995.patch new file mode 100644 index 0000000..cb45be1 --- /dev/null +++ b/SOURCES/isns-utils-0.101-CVE-2026-55995.patch @@ -0,0 +1,36 @@ +From a264452f904c6c72e95ff1189246e3a09fd12da1 Mon Sep 17 00:00:00 2001 +From: Lee Duncan +Date: Tue, 28 Jul 2026 11:07:24 -0700 +Subject: [PATCH] Fix issue in error path causing double-free. + +In attrs.c, when buf_get() fails and allocated memory is +freed, we also need to set the pointer to that memory to +NULL, to prevent a double free from occuring, would could +lead to a DoS attack. + +References: CVE-2026-55995 +Found-by: +--- + attrs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/attrs.c b/attrs.c +index 44d9675..8e48170 100644 +--- a/attrs.c ++++ b/attrs.c +@@ -1371,6 +1371,7 @@ isns_attr_type_string_decode(buf_t *bp, size_t len, isns_value_t *value) + value->iv_string = isns_malloc(len + 1); + if (!buf_get(bp, value->iv_string, len)) { + isns_free(value->iv_string); ++ value->iv_string = NULL; + return 0; + } + value->iv_string[len] = '\0'; +@@ -1546,6 +1547,7 @@ isns_attr_type_opaque_decode(buf_t *bp, size_t len, isns_value_t *value) + value->iv_opaque.ptr = isns_malloc(len); + if (!buf_get(bp, value->iv_opaque.ptr, len)) { + isns_free(value->iv_opaque.ptr); ++ value->iv_opaque.ptr = NULL; + return 0; + } + diff --git a/SOURCES/test_as_installed.patch b/SOURCES/test_as_installed.patch index 7f08d8a..0619060 100644 --- a/SOURCES/test_as_installed.patch +++ b/SOURCES/test_as_installed.patch @@ -1,15 +1,15 @@ -From 420ae1af11fad3151b5bfa676e7218168e4e6f3f Mon Sep 17 00:00:00 2001 +From 224f1d45934346f1836c75d9ce257029960543b9 Mon Sep 17 00:00:00 2001 From: Chris Leech Date: Wed, 26 May 2021 10:00:17 -0700 Subject: [PATCH 1/1] run tests with binaries from arbitrary paths --- tests/Makefile | 4 ++++ - tests/harness.py | 4 ++++ - 2 files changed, 8 insertions(+) + tests/harness.py | 6 +++++- + 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/tests/Makefile b/tests/Makefile -index 372572d..2c61183 100644 +index 372572d..93bcac7 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -48,3 +48,7 @@ quick: tests-no-security @@ -19,9 +19,9 @@ index 372572d..2c61183 100644 + +tests-as-installed: + @echo running tests from installed executables -- takes about 2 minutes -+ ./test-isns.py -s --path="/usr/sbin" ++ ./test-isns.py --path="/usr/sbin" diff --git a/tests/harness.py b/tests/harness.py -index 39fc5e6..b710f5a 100644 +index 39fc5e6..83091ea 100644 --- a/tests/harness.py +++ b/tests/harness.py @@ -137,6 +137,9 @@ def new_initArgParsers(self): @@ -42,6 +42,15 @@ index 39fc5e6..b710f5a 100644 dprint("found: verbosity=%d, security=%s" % \ (Global.verbosity, Global.security)) +@@ -415,7 +419,7 @@ def isns_external_test(client_config, args): + """ + logfile = get_logfile_from_config(client_config.path) + +- cmd = ['%s/%s' % (Global._isns_bin_dir, args[0]), ++ cmd = ['%s/%s' % ("..", args[0]), + '-c', client_config.path] + args[1:] + exit_val = run_cmd(cmd, logfile) + return (logfile, exit_val) -- -2.31.1 +2.55.0 diff --git a/SPECS/isns-utils.spec b/SPECS/isns-utils.spec index 1d6c909..676e012 100644 --- a/SPECS/isns-utils.spec +++ b/SPECS/isns-utils.spec @@ -1,6 +1,6 @@ Name: isns-utils Version: 0.101 -Release: 4%{?dist} +Release: 4%{?dist}.1 Summary: The iSNS daemon and utility programs License: LGPLv2+ @@ -8,6 +8,9 @@ URL: https://github.com/open-iscsi/open-isns Source0: https://github.com/open-iscsi/open-isns/archive/v%{version}.tar.gz#/open-isns-%{version}.tar.gz Source1: isnsd.service Patch1: test_as_installed.patch +# https://issues.redhat.com/browse/RHEL-219470 +# https://github.com/open-iscsi/open-isns/commit/56718d4e9d1a4f51c30697b5c0534144bb41c9bb +Patch2: isns-utils-0.101-CVE-2026-55995.patch BuildRequires: gcc BuildRequires: automake pkgconfig systemd-devel systemd @@ -15,6 +18,7 @@ BuildRequires: make Requires(post): systemd-units Requires(preun): systemd-units Requires(postun): systemd-units +Requires: %{name}-libs%{?_isa} = %{version}-%{release} %description The iSNS package contains the daemon and tools to setup a iSNS server, @@ -104,6 +108,9 @@ install -p -m 644 %{SOURCE1} %{buildroot}%{_unitdir}/isnsd.service %changelog +* Thu Jul 30 2026 RHEL Packaging Agent - 0.101-4.1 +- Fix CVE-2026-55995: prevent double-free in attrs.c error paths + * Tue Sep 14 2021 Chris Leech - 0.101-4 - #1934951 remove DSA/SHA-1 based authentication support