From 82e40c2e8530f8c9f3f3847b477ab9888bbb8666 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Wed, 19 Aug 2026 19:42:07 +0000 Subject: [PATCH 1/2] Patch packer for CVE-2026-19589 --- SPECS/packer/CVE-2026-19589.patch | 44 +++++++++++++++++++++++++++++++ SPECS/packer/packer.spec | 6 ++++- 2 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 SPECS/packer/CVE-2026-19589.patch diff --git a/SPECS/packer/CVE-2026-19589.patch b/SPECS/packer/CVE-2026-19589.patch new file mode 100644 index 00000000000..c9c850fb022 --- /dev/null +++ b/SPECS/packer/CVE-2026-19589.patch @@ -0,0 +1,44 @@ +From dd30f800671df57defa1e676738c3851fd84c7e7 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Wed, 19 Aug 2026 19:35:11 +0000 +Subject: [PATCH] fix: prevent path traversal in GitHub plugin getter filename + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/hashicorp/packer/commit/da959768c508bdcf70aa219b36f6aec21e9a297f.patch +--- + packer/plugin-getter/github/getter.go | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/packer/plugin-getter/github/getter.go b/packer/plugin-getter/github/getter.go +index eb2aea3..18b2aab 100644 +--- a/packer/plugin-getter/github/getter.go ++++ b/packer/plugin-getter/github/getter.go +@@ -246,3 +246,25 @@ func (g *Getter) Get(what string, opts plugingetter.GetOptions) (io.ReadCloser, + + return transform(resp.Body) + } ++ ++func (g *Getter) Validate(opt plugingetter.GetOptions, expectedVersion string, installOpts plugingetter.BinaryInstallationOptions) error { ++\tentry, err := opt.Checksummer.GetCacheChecksumEntry() ++\tif err != nil { ++\t\treturn err ++\t} ++\tif expectedVersion != entry.Version { ++\t\treturn fmt.Errorf("expected version %q does not match checksum version %q", expectedVersion, entry.Version) ++\t} ++\treturn installOpts.CheckProtocolVersion(entry.ProtVersion) ++} ++ ++func (g *Getter) ExpectedFileName(pr *plugingetter.Requirement, version string, entry *plugingetter.ChecksumFileEntry, _ string) string { ++\tpluginSourceParts := strings.Split(pr.Identifier.Source, "/") ++\treturn strings.Join([]string{ ++\t\t"packer-plugin-" + pluginSourceParts[2], ++\t\tentry.BinVersion, ++\t\tentry.ProtVersion, ++\t\tentry.Os, ++\t\tentry.Arch + entry.Ext, ++\t}, "_") ++} +-- +2.45.4 + diff --git a/SPECS/packer/packer.spec b/SPECS/packer/packer.spec index 329933e9d19..24da0ce5f80 100644 --- a/SPECS/packer/packer.spec +++ b/SPECS/packer/packer.spec @@ -4,7 +4,7 @@ Summary: Tool for creating identical machine images for multiple platforms from a single source configuration. Name: packer Version: 1.9.5 -Release: 19%{?dist} +Release: 20%{?dist} License: MPLv2.0 Vendor: Microsoft Corporation Distribution: Azure Linux @@ -46,6 +46,7 @@ Patch10: CVE-2026-45571.patch Patch11: CVE-2026-56852.patch Patch12: CVE-2026-71556.patch Patch13: CVE-2026-71557.patch +Patch14: CVE-2026-19589.patch BuildRequires: golang >= 1.25 BuildRequires: kernel-headers @@ -77,6 +78,9 @@ go test -mod=vendor %{_bindir}/packer %changelog +* Wed Aug 19 2026 Azure Linux Security Servicing Account - 1.9.5-20 +- Patch for CVE-2026-19589 + * Tue Aug 11 2026 Azure Linux Security Servicing Account - 1.9.5-19 - Patch for CVE-2026-71557, CVE-2026-71556 From 3b16800a14f0ce1d64c4ac6f2731785991b7048f Mon Sep 17 00:00:00 2001 From: Swapnil Sahu Date: Fri, 21 Aug 2026 01:48:23 +0000 Subject: [PATCH 2/2] Update AI-generated patch --- SPECS/packer/CVE-2026-19589.patch | 59 +++++++++++++++++++------------ 1 file changed, 36 insertions(+), 23 deletions(-) diff --git a/SPECS/packer/CVE-2026-19589.patch b/SPECS/packer/CVE-2026-19589.patch index c9c850fb022..1f57d9b8eaa 100644 --- a/SPECS/packer/CVE-2026-19589.patch +++ b/SPECS/packer/CVE-2026-19589.patch @@ -6,39 +6,52 @@ Subject: [PATCH] fix: prevent path traversal in GitHub plugin getter filename Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: AI Backport of https://github.com/hashicorp/packer/commit/da959768c508bdcf70aa219b36f6aec21e9a297f.patch --- - packer/plugin-getter/github/getter.go | 22 ++++++++++++++++++++++ - 1 file changed, 22 insertions(+) + packer/plugin-getter/github/getter.go | 10 ++++++++++ + packer/plugin-getter/plugins.go | 6 +++++- + 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/packer/plugin-getter/github/getter.go b/packer/plugin-getter/github/getter.go -index eb2aea3..18b2aab 100644 +index eb2aea3..e02ce63 100644 --- a/packer/plugin-getter/github/getter.go +++ b/packer/plugin-getter/github/getter.go -@@ -246,3 +246,25 @@ func (g *Getter) Get(what string, opts plugingetter.GetOptions) (io.ReadCloser, +@@ -246,3 +246,13 @@ func (g *Getter) Get(what string, opts plugingetter.GetOptions) (io.ReadCloser, return transform(resp.Body) } + -+func (g *Getter) Validate(opt plugingetter.GetOptions, expectedVersion string, installOpts plugingetter.BinaryInstallationOptions) error { -+\tentry, err := opt.Checksummer.GetCacheChecksumEntry() -+\tif err != nil { -+\t\treturn err -+\t} -+\tif expectedVersion != entry.Version { -+\t\treturn fmt.Errorf("expected version %q does not match checksum version %q", expectedVersion, entry.Version) -+\t} -+\treturn installOpts.CheckProtocolVersion(entry.ProtVersion) -+} -+ +func (g *Getter) ExpectedFileName(pr *plugingetter.Requirement, version string, entry *plugingetter.ChecksumFileEntry, _ string) string { -+\tpluginSourceParts := strings.Split(pr.Identifier.Source, "/") -+\treturn strings.Join([]string{ -+\t\t"packer-plugin-" + pluginSourceParts[2], -+\t\tentry.BinVersion, -+\t\tentry.ProtVersion, -+\t\tentry.Os, -+\t\tentry.Arch + entry.Ext, -+\t}, "_") ++ return strings.Join([]string{ ++ "packer-plugin-" + pr.Identifier.Type, ++ entry.BinVersion(), ++ entry.ProtVersion(), ++ entry.Os(), ++ entry.Arch() + entry.Ext(), ++ }, "_") +} +diff --git a/packer/plugin-getter/plugins.go b/packer/plugin-getter/plugins.go +index 84b5d8d..0eac0db 100644 +--- a/packer/plugin-getter/plugins.go ++++ b/packer/plugin-getter/plugins.go +@@ -356,6 +356,9 @@ type Getter interface { + // packer-plugin-amazon_v1.0.0_x5.0_linux_amd64 file that will be checksum + // verified then copied to the correct plugin location. + Get(what string, opts GetOptions) (io.ReadCloser, error) ++ ++ // ExpectedFileName returns the expected file name for the binary, which needs to be installed ++ ExpectedFileName(pr *Requirement, version string, entry *ChecksumFileEntry, zipFileName string) string + } + + type Release struct { +@@ -560,7 +563,8 @@ func (pr *Requirement) InstallLatest(opts InstallOptions) (*Installation, error) + Checksummer: checksummer, + } + expectedZipFilename := checksum.Filename +- expectedBinaryFilename := strings.TrimSuffix(expectedZipFilename, filepath.Ext(expectedZipFilename)) + opts.BinaryInstallationOptions.Ext ++ expectedBinFilename := getter.ExpectedFileName(pr, version.String(), &entry, expectedZipFilename) ++ expectedBinaryFilename := strings.TrimSuffix(expectedBinFilename, filepath.Ext(expectedBinFilename)) + opts.BinaryInstallationOptions.Ext + + for _, outputFolder := range opts.InFolders { + potentialOutputFilename := filepath.Join( -- 2.45.4