[AutoPR- Security] Patch packer for CVE-2026-19589 [HIGH]

SPECS/packer/CVE-2026-19589.patch

@@ -0,0 +1,57 @@
+From dd30f800671df57defa1e676738c3851fd84c7e7 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Wed, 19 Aug 2026 19:35:11 +0000
+Subject: [PATCH] fix: prevent path traversal in GitHub plugin getter filename
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/hashicorp/packer/commit/da959768c508bdcf70aa219b36f6aec21e9a297f.patch
+---
+ packer/plugin-getter/github/getter.go | 10 ++++++++++
+ packer/plugin-getter/plugins.go       |  6 +++++-
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/packer/plugin-getter/github/getter.go b/packer/plugin-getter/github/getter.go
+index eb2aea3..e02ce63 100644
+--- a/packer/plugin-getter/github/getter.go
++++ b/packer/plugin-getter/github/getter.go
+@@ -246,3 +246,13 @@ func (g *Getter) Get(what string, opts plugingetter.GetOptions) (io.ReadCloser,
+
+ 	return transform(resp.Body)
+ }
++
++func (g *Getter) ExpectedFileName(pr *plugingetter.Requirement, version string, entry *plugingetter.ChecksumFileEntry, _ string) string {
++	return strings.Join([]string{
++		"packer-plugin-" + pr.Identifier.Type,
++		entry.BinVersion(),
++		entry.ProtVersion(),
++		entry.Os(),
++		entry.Arch() + entry.Ext(),
++	}, "_")
++}
+diff --git a/packer/plugin-getter/plugins.go b/packer/plugin-getter/plugins.go
+index 84b5d8d..0eac0db 100644
+--- a/packer/plugin-getter/plugins.go
++++ b/packer/plugin-getter/plugins.go
+@@ -356,6 +356,9 @@ type Getter interface {
+ 	//    packer-plugin-amazon_v1.0.0_x5.0_linux_amd64 file that will be checksum
+ 	//    verified then copied to the correct plugin location.
+ 	Get(what string, opts GetOptions) (io.ReadCloser, error)
++
++	// ExpectedFileName returns the expected file name for the binary, which needs to be installed
++	ExpectedFileName(pr *Requirement, version string, entry *ChecksumFileEntry, zipFileName string) string
+ }
+
+ type Release struct {
+@@ -560,7 +563,8 @@ func (pr *Requirement) InstallLatest(opts InstallOptions) (*Installation, error)
+ 						Checksummer: checksummer,
+ 					}
+ 					expectedZipFilename := checksum.Filename
+-					expectedBinaryFilename := strings.TrimSuffix(expectedZipFilename, filepath.Ext(expectedZipFilename)) + opts.BinaryInstallationOptions.Ext
++					expectedBinFilename := getter.ExpectedFileName(pr, version.String(), &entry, expectedZipFilename)
++					expectedBinaryFilename := strings.TrimSuffix(expectedBinFilename, filepath.Ext(expectedBinFilename)) + opts.BinaryInstallationOptions.Ext
+
+ 					for _, outputFolder := range opts.InFolders {
+ 						potentialOutputFilename := filepath.Join(
+-- 
+2.45.4
+

SPECS/packer/packer.spec

@@ -4,7 +4,7 @@
 Summary:        Tool for creating identical machine images for multiple platforms from a single source configuration.
 Name:           packer
 Version:        1.9.5
-Release:        19%{?dist}
+Release:        20%{?dist}
 License:        MPLv2.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -46,6 +46,7 @@ Patch10:        CVE-2026-45571.patch
 Patch11:        CVE-2026-56852.patch
 Patch12:        CVE-2026-71556.patch
 Patch13:        CVE-2026-71557.patch
+Patch14:        CVE-2026-19589.patch
 
 BuildRequires:  golang >= 1.25
 BuildRequires:  kernel-headers
@@ -77,6 +78,9 @@ go test -mod=vendor
 %{_bindir}/packer
 
 %changelog
+* Wed Aug 19 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.9.5-20
+- Patch for CVE-2026-19589
+
 * Tue Aug 11 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.9.5-19
 - Patch for CVE-2026-71557, CVE-2026-71556