From b15fb660466ea6c7a71346c3e3c1a9501a44ff96 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Fri, 14 Aug 2026 21:56:05 +0000 Subject: [PATCH] Patch kube-vip-cloud-provider for CVE-2026-73500 --- .../CVE-2026-73500.patch | 48 +++++++++++++++++++ .../kube-vip-cloud-provider.spec | 6 ++- 2 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 SPECS/kube-vip-cloud-provider/CVE-2026-73500.patch diff --git a/SPECS/kube-vip-cloud-provider/CVE-2026-73500.patch b/SPECS/kube-vip-cloud-provider/CVE-2026-73500.patch new file mode 100644 index 00000000000..7823e142594 --- /dev/null +++ b/SPECS/kube-vip-cloud-provider/CVE-2026-73500.patch @@ -0,0 +1,48 @@ +From bf3a3eb75b5267ec178db70cc68f1ff2c6472fad Mon Sep 17 00:00:00 2001 +From: Benjamin Wang +Date: Tue, 21 Jul 2026 10:16:47 +0100 +Subject: [PATCH] Set a tlsHandshakeTimeout for tlsListener + +Signed-off-by: Benjamin Wang +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/etcd-io/etcd/commit/8e4dd0679a2c6b095d2a32a749fda2521c7809a3.patch +--- + .../etcd/client/pkg/v3/transport/listener_tls.go | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go b/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go +index 6f16009..7e009f1 100644 +--- a/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go ++++ b/vendor/go.etcd.io/etcd/client/pkg/v3/transport/listener_tls.go +@@ -23,6 +23,12 @@ import ( + "net" + "strings" + "sync" ++ "time" ++) ++ ++const ( ++ // tlsHandshakeTimeout bounds how long a single TLS handshake may block. ++ tlsHandshakeTimeout = 10 * time.Second + ) + + // tlsListener overrides a TLS listener so it will reject client +@@ -143,6 +149,7 @@ func (l *tlsListener) acceptLoop() { + }() + + tlsConn := conn.(*tls.Conn) ++ _ = tlsConn.SetDeadline(time.Now().Add(tlsHandshakeTimeout)) + herr := tlsConn.Handshake() + pendingMu.Lock() + delete(pending, conn) +@@ -152,6 +159,7 @@ func (l *tlsListener) acceptLoop() { + l.handshakeFailure(tlsConn, herr) + return + } ++ _ = tlsConn.SetDeadline(time.Time{}) + if err := l.check(ctx, tlsConn); err != nil { + l.handshakeFailure(tlsConn, err) + return +-- +2.45.4 + diff --git a/SPECS/kube-vip-cloud-provider/kube-vip-cloud-provider.spec b/SPECS/kube-vip-cloud-provider/kube-vip-cloud-provider.spec index 90932c37f78..fe1ab14d757 100644 --- a/SPECS/kube-vip-cloud-provider/kube-vip-cloud-provider.spec +++ b/SPECS/kube-vip-cloud-provider/kube-vip-cloud-provider.spec @@ -1,7 +1,7 @@ Summary: The Kube-Vip cloud provider functions as a general-purpose cloud provider for on-premises bare-metal or virtualized setups Name: kube-vip-cloud-provider Version: 0.0.10 -Release: 7%{?dist} +Release: 8%{?dist} License: ASL 2.0 URL: https://github.com/kube-vip/kube-vip-cloud-provider Group: Applications/Text @@ -32,6 +32,7 @@ Patch9: CVE-2026-25680.patch Patch10: CVE-2026-25681.patch Patch11: CVE-2026-42502.patch Patch12: CVE-2026-56852.patch +Patch13: CVE-2026-73500.patch BuildRequires: golang >= 1.22 @@ -52,6 +53,9 @@ install kube-vip-cloud-provider %{buildroot}%{_bindir}/kube-vip-cloud-provider %{_bindir}/kube-vip-cloud-provider %changelog +* Fri Aug 14 2026 Azure Linux Security Servicing Account - 0.0.10-8 +- Patch for CVE-2026-73500 + * Mon Jul 27 2026 Azure Linux Security Servicing Account - 0.0.10-7 - Patch for CVE-2026-56852