From 650002998d686a3ad33d177ec5dc3b57d1263cee Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Fri, 14 Aug 2026 21:55:55 +0000 Subject: [PATCH] Patch cloud-provider-kubevirt for CVE-2026-73500 --- .../CVE-2026-73500.patch | 48 +++++++++++++++++++ .../cloud-provider-kubevirt.spec | 6 ++- 2 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 SPECS/cloud-provider-kubevirt/CVE-2026-73500.patch diff --git a/SPECS/cloud-provider-kubevirt/CVE-2026-73500.patch b/SPECS/cloud-provider-kubevirt/CVE-2026-73500.patch new file mode 100644 index 00000000000..64df11e6499 --- /dev/null +++ b/SPECS/cloud-provider-kubevirt/CVE-2026-73500.patch @@ -0,0 +1,48 @@ +From 37a73733a7af0dfdeaca57b9f74442321950eb75 Mon Sep 17 00:00:00 2001 +From: Benjamin Wang +Date: Tue, 21 Jul 2026 10:16:47 +0100 +Subject: [PATCH] Set a tlsHandshakeTimeout for tlsListener + +Signed-off-by: Benjamin Wang +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3.patch +--- + .../etcd/client/pkg/v3/transport/listener_tls.go | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go b/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go +index 6f16009..7e009f1 100644 +--- a/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go ++++ b/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go +@@ -23,6 +23,12 @@ import ( + "net" + "strings" + "sync" ++ "time" ++) ++ ++const ( ++ // tlsHandshakeTimeout bounds how long a single TLS handshake may block. ++ tlsHandshakeTimeout = 10 * time.Second + ) + + // tlsListener overrides a TLS listener so it will reject client +@@ -143,6 +149,7 @@ func (l *tlsListener) acceptLoop() { + }() + + tlsConn := conn.(*tls.Conn) ++ _ = tlsConn.SetDeadline(time.Now().Add(tlsHandshakeTimeout)) + herr := tlsConn.Handshake() + pendingMu.Lock() + delete(pending, conn) +@@ -152,6 +159,7 @@ func (l *tlsListener) acceptLoop() { + l.handshakeFailure(tlsConn, herr) + return + } ++ _ = tlsConn.SetDeadline(time.Time{}) + if err := l.check(ctx, tlsConn); err != nil { + l.handshakeFailure(tlsConn, err) + return +-- +2.45.4 + diff --git a/SPECS/cloud-provider-kubevirt/cloud-provider-kubevirt.spec b/SPECS/cloud-provider-kubevirt/cloud-provider-kubevirt.spec index 8ee3e701abd..1c22bfaba7c 100644 --- a/SPECS/cloud-provider-kubevirt/cloud-provider-kubevirt.spec +++ b/SPECS/cloud-provider-kubevirt/cloud-provider-kubevirt.spec @@ -1,7 +1,7 @@ Summary: Package to create the cloud-provider-kubevirt binary. Name: cloud-provider-kubevirt Version: 0.5.1 -Release: 6%{?dist} +Release: 7%{?dist} License: ASL 2.0 URL: https://github.com/kubevirt/cloud-provider-kubevirt/ Group: System/Management @@ -38,6 +38,7 @@ Patch9: CVE-2026-25680.patch Patch10: CVE-2026-25681.patch Patch11: CVE-2026-42502.patch Patch12: CVE-2026-56852.patch +Patch13: CVE-2026-73500.patch %global debug_package %{nil} BuildRequires: golang < 1.25 @@ -78,6 +79,9 @@ make test %{_bindir}/kubevirt-cloud-controller-manager %changelog +* Fri Aug 14 2026 Azure Linux Security Servicing Account - 0.5.1-7 +- Patch for CVE-2026-73500 + * Mon Jul 27 2026 Azure Linux Security Servicing Account - 0.5.1-6 - Patch for CVE-2026-56852