From 4f306652180a6b8737539b48b6c13b9b6890ea28 Mon Sep 17 00:00:00 2001
From: eabdullin <ed.abdullin.1@gmail.com>
Date: Wed, 15 Oct 2025 23:58:23 +0000
Subject: [PATCH] import UBI libsoup3-3.6.5-3.el10_0.7

---
 RHEL-117630.patch | 53 +++++++++++++++++++++++++++++++++++++++++++++++
 libsoup3.spec     |  8 ++++++-
 2 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 RHEL-117630.patch

diff --git a/RHEL-117630.patch b/RHEL-117630.patch
new file mode 100644
index 0000000..5230d49
--- /dev/null
+++ b/RHEL-117630.patch
@@ -0,0 +1,53 @@
+From 093a544bfbedcda96d619b49973e574933f2ed28 Mon Sep 17 00:00:00 2001
+From: Alynx Zhou <alynx.zhou@gmail.com>
+Date: Sat, 11 Oct 2025 15:52:47 +0800
+Subject: [PATCH] cookies: Avoid expires attribute if date is invalid
+
+According to CVE-2025-11021, we may get invalid on processing date
+string with timezone offset, this commit will ignore it.
+
+Closes #459
+---
+ libsoup/cookies/soup-cookie.c | 9 +++++----
+ libsoup/soup-date-utils.c     | 3 +++
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/libsoup/cookies/soup-cookie.c b/libsoup/cookies/soup-cookie.c
+index b6d7716..1213402 100644
+--- a/libsoup/cookies/soup-cookie.c
++++ b/libsoup/cookies/soup-cookie.c
+@@ -774,12 +774,13 @@ serialize_cookie (SoupCookie *cookie, GString *header, gboolean set_cookie)
+ 
+ 	if (cookie->expires) {
+ 		char *timestamp;
+-
+-		g_string_append (header, "; expires=");
+ 		timestamp = soup_date_time_to_string (cookie->expires,
+ 						      SOUP_DATE_COOKIE);
+-		g_string_append (header, timestamp);
+-		g_free (timestamp);
++                if (timestamp) {
++                        g_string_append (header, "; expires=");
++                        g_string_append (header, timestamp);
++                        g_free (timestamp);
++                }
+ 	}
+ 	if (cookie->path) {
+ 		g_string_append (header, "; path=");
+diff --git a/libsoup/soup-date-utils.c b/libsoup/soup-date-utils.c
+index fd785f5..e5aa805 100644
+--- a/libsoup/soup-date-utils.c
++++ b/libsoup/soup-date-utils.c
+@@ -95,6 +95,9 @@ soup_date_time_to_string (GDateTime      *date,
+                 char *date_format;
+                 char *formatted_date;
+ 
++                if (!utcdate)
++                        return NULL;
++
+                 // We insert days/months ourselves to avoid locale specific formatting
+                 if (format == SOUP_DATE_HTTP) {
+ 			/* "Sun, 06 Nov 1994 08:49:37 GMT" */
+-- 
+2.47.3
+
diff --git a/libsoup3.spec b/libsoup3.spec
index 6773fad..716a3f5 100644
--- a/libsoup3.spec
+++ b/libsoup3.spec
@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.6.5)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 6;
+    release_number = 7;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -39,6 +39,8 @@ Patch:   CVE-2025-4948.patch
 Patch:   CVE-2025-32049.patch
 # https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452
 Patch:   CVE-2025-32907.patch
+# CVE-2025-11021
+Patch:   RHEL-117630.patch
 
 BuildRequires: ca-certificates
 BuildRequires: gcc
@@ -133,6 +135,10 @@ install -m 644 -D tests/libsoup.supp %{buildroot}%{_datadir}/libsoup-3.0/libsoup
 
 %changelog
 ## START: Generated by rpmautospec
+* Wed Oct 15 2025 RHEL Packaging Agent <jotnar@redhat.com> - 3.6.5-7
+- Fix handling of invalid dates in cookie expires attribute
+  (CVE-2025-11021)
+
 * Wed May 21 2025 Michael Catanzaro <mcatanzaro@redhat.com> - 3.6.5-6
 - Add patch for CVE-2025-32907