[Low]patch flannel for CVE-2024-51744

SPECS/flannel/CVE-2024-51744.patch

@@ -0,0 +1,87 @@
+From 4bdd0781a0598fc63e255e17d1bf685014582ec8 Mon Sep 17 00:00:00 2001
+From: jykanase <[email protected]>
+Date: Wed, 19 Mar 2025 13:30:49 +0000
+Subject: [PATCH] CVE-2024-51744
+
+---
+ vendor/github.com/golang-jwt/jwt/v4/parser.go | 36 +++++++++++++++-----------
+ 1 file changed, 21 insertions(+), 15 deletions(-)
+
+diff --git a/vendor/github.com/golang-jwt/jwt/v4/parser.go b/vendor/github.com/golang-jwt/jwt/v4/parser.go
+index 2f61a69..2367289 100644
+--- a/vendor/github.com/golang-jwt/jwt/v4/parser.go
++++ b/vendor/github.com/golang-jwt/jwt/v4/parser.go
+@@ -36,12 +36,21 @@ func NewParser(options ...ParserOption) *Parser {
+ 	return p
+ }
+
+-// Parse parses, validates, verifies the signature and returns the parsed token.
+-// keyFunc will receive the parsed token and should return the key for validating.
++// Parse parses, validates, verifies the signature and returns the parsed token. keyFunc will
++// receive the parsed token and should return the key for validating.
+ func (p *Parser) Parse(tokenString string, keyFunc Keyfunc) (*Token, error) {
+ 	return p.ParseWithClaims(tokenString, MapClaims{}, keyFunc)
+ }
+
++// ParseWithClaims parses, validates, and verifies like Parse, but supplies a default object
++// implementing the Claims interface. This provides default values which can be overridden and
++// allows a caller to use their own type, rather than the default MapClaims implementation of
++// Claims.
++//
++// Note: If you provide a custom claim implementation that embeds one of the standard claims (such
++// as RegisteredClaims), make sure that a) you either embed a non-pointer version of the claims or
++// b) if you are using a pointer, allocate the proper memory for it before passing in the overall
++// claims, otherwise you might run into a panic.
+ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc) (*Token, error) {
+ 	token, parts, err := p.ParseUnverified(tokenString, claims)
+ 	if err != nil {
+@@ -77,13 +86,18 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
+ 		}
+ 		return token, &ValidationError{Inner: err, Errors: ValidationErrorUnverifiable}
+ 	}
++	// Perform validation
++ 	token.Signature = parts[2]
++ 	if err := token.Method.Verify(strings.Join(parts[0:2], "."), token.Signature, key); err != nil {
++ 		return token, &ValidationError{Inner: err, Errors: ValidationErrorSignatureInvalid}
++ 	}
++
+
+ 	vErr := &ValidationError{}
+
+ 	// Validate Claims
+ 	if !p.SkipClaimsValidation {
+ 		if err := token.Claims.Valid(); err != nil {
+-
+ 			// If the Claims Valid returned an error, check if it is a validation error,
+ 			// If it was another error type, create a ValidationError with a generic ClaimsInvalid flag set
+ 			if e, ok := err.(*ValidationError); !ok {
+@@ -91,22 +105,14 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
+ 			} else {
+ 				vErr = e
+ 			}
++			return token, vErr
+ 		}
+ 	}
+
+-	// Perform validation
+-	token.Signature = parts[2]
+-	if err = token.Method.Verify(strings.Join(parts[0:2], "."), token.Signature, key); err != nil {
+-		vErr.Inner = err
+-		vErr.Errors |= ValidationErrorSignatureInvalid
+-	}
+-
+-	if vErr.valid() {
+-		token.Valid = true
+-		return token, nil
+-	}
++	// No errors so far, token is valid.
++ 	token.Valid = true
+
+-	return token, vErr
++	return token, nil
+ }
+
+ // ParseUnverified parses the token but doesn't validate the signature.
+-- 
+2.45.2
+

SPECS/flannel/flannel.spec

@@ -3,7 +3,7 @@
 Summary:        Simple and easy way to configure a layer 3 network fabric designed for Kubernetes
 Name:           flannel
 Version:        0.24.2
-Release:        11%{?dist}
+Release:        12%{?dist}
 License:        ASL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -14,6 +14,7 @@ Source1:        %{name}-%{version}-vendor.tar.gz
 Patch0:         CVE-2024-24786.patch
 Patch1:         CVE-2023-44487.patch
 Patch2:         CVE-2023-45288.patch
+Patch3:         CVE-2024-51744.patch
 BuildRequires:  gcc
 BuildRequires:  glibc-devel
 BuildRequires:  glibc-static >= 2.38-9%{?dist}
@@ -50,6 +51,9 @@ install -p -m 755 -t %{buildroot}%{_bindir} ./dist/flanneld
 %{_bindir}/flanneld
 
 %changelog
+* Wed Mar 19 2025 Jyoti Kanase <[email protected]> - 0.24.2-12
+- Fix CVE-2024-51744
+
 * Tue Feb 25 2025 Chris Co <[email protected]> - 0.24.2-11
 - Bump to rebuild with updated glibc