diff --git a/SPECS/bison/CVE-2026-56389.patch b/SPECS/bison/CVE-2026-56389.patch new file mode 100644 index 00000000000..87f6d96f4ba --- /dev/null +++ b/SPECS/bison/CVE-2026-56389.patch @@ -0,0 +1,58 @@ +From 1cb3f579ec8868c5bb6de8112fc7f72f5f13f3ec Mon Sep 17 00:00:00 2001 +From: Paul Eggert +Date: Thu, 23 Apr 2026 09:20:43 -0700 +Subject: [PATCH] html: use xsltproc from PATH +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +* src/print-xml.c (print_html): +* src/reader.c (prepare_percent_define_front_end_variables): +Drop undocumented support for lines like ‘%define tool.xsltproc +"whatever"’, as this can cause more trouble than it cures. + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://cgit.git.savannah.gnu.org/cgit/bison.git/patch/?id=3169c1e7a2c6acc4c59dfcf8b089896d6881925b +--- + src/print-xml.c | 4 +--- + src/reader.c | 1 - + 2 files changed, 1 insertion(+), 4 deletions(-) + +diff --git a/src/print-xml.c b/src/print-xml.c +index 78801db..ddfdeee 100644 +--- a/src/print-xml.c ++++ b/src/print-xml.c +@@ -543,10 +543,9 @@ print_html (void) + assert (xml_flag); + + char *xml2html = xpath_join (pkgdatadir (), "xslt/xml2xhtml.xsl"); +- char *xsltproc = muscle_percent_define_get ("tool.xsltproc"); + char const *argv[11]; + int i = 0; +- argv[i++] = xsltproc; ++ argv[i++] = "xsltproc"; + argv[i++] = "-o"; + argv[i++] = spec_html_file; + argv[i++] = xml2html; +@@ -572,6 +571,5 @@ print_html (void) + /* termsigp */ NULL); + if (status) + complain (NULL, complaint, _("%s failed with status %d"), argv[0], status); +- free (xsltproc); + free (xml2html); + } +diff --git a/src/reader.c b/src/reader.c +index 024606d..36b3494 100644 +--- a/src/reader.c ++++ b/src/reader.c +@@ -788,7 +788,6 @@ prepare_percent_define_front_end_variables (void) + muscle_percent_define_default ("lr.default-reduction", "accepting"); + free (lr_type); + } +- muscle_percent_define_default ("tool.xsltproc", "xsltproc"); + + /* Check %define front-end variables. */ + { +-- +2.45.4 + diff --git a/SPECS/bison/CVE-2026-56390.patch b/SPECS/bison/CVE-2026-56390.patch new file mode 100644 index 00000000000..72920736e03 --- /dev/null +++ b/SPECS/bison/CVE-2026-56390.patch @@ -0,0 +1,208 @@ +From 9258aa099de0e756606561dd3af27ee1a9cc8b06 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Thu, 30 Jul 2026 09:53:00 +0000 +Subject: [PATCH] bison: tighten up output file names + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://cgit.git.savannah.gnu.org/cgit/bison.git/patch/?id=8d101c19d4d9aaedf83a448c925513742d4efcf0 +--- + doc/bison.texi | 2 ++ + src/parse-gram.c | 56 ++++++++++++++++++++++++++++++++---------------- + src/parse-gram.y | 31 ++++++++++++++++++++++----- + 3 files changed, 66 insertions(+), 23 deletions(-) + +diff --git a/doc/bison.texi b/doc/bison.texi +index a559649..44a4e15 100644 +--- a/doc/bison.texi ++++ b/doc/bison.texi +@@ -5973,6 +5973,7 @@ Introduced in Bison 3.8. + + @deffn {Directive} %header @var{header-file} + Same as above, but save in the file @file{@var{header-file}}. ++The @var{header-file} name should not contain slashes. + @end deffn + + @deffn {Directive} %language "@var{language}" +@@ -6026,6 +6027,7 @@ file, treating it as an independent source file in its own right. + + @deffn {Directive} %output "@var{file}" + Generate the parser implementation in @file{@var{file}}. ++The @var{file} name should not contain slashes. + @end deffn + + @deffn {Directive} %pure-parser +diff --git a/src/parse-gram.c b/src/parse-gram.c +index 3c1d822..7f6deb3 100644 +--- a/src/parse-gram.c ++++ b/src/parse-gram.c +@@ -276,8 +276,11 @@ typedef enum yysymbol_kind_t yysymbol_kind_t; + string from the scanner (should be CODE). */ + static char const *translate_code_braceless (char *code, location loc); + ++ /* Is FILE a valid output file name? */ ++ static bool valid_output_file_name (char const *file); ++ + /* Handle a %header directive. */ +- static void handle_header (char const *value); ++ static void handle_header (location const *loc, char const *value); + + /* Handle a %error-verbose directive. */ + static void handle_error_verbose (location const *loc, char const *directive); +@@ -663,19 +666,19 @@ union yyalloc + /* YYRLINE[YYN] -- Source line where rule number YYN was defined. */ + static const yytype_int16 yyrline[] = + { +- 0, 310, 310, 319, 320, 324, 325, 331, 335, 340, +- 341, 342, 343, 344, 345, 350, 355, 356, 357, 358, +- 359, 360, 360, 361, 362, 363, 364, 365, 366, 367, +- 368, 372, 373, 382, 383, 387, 398, 402, 406, 414, +- 424, 425, 435, 436, 442, 455, 455, 460, 460, 465, +- 465, 470, 480, 481, 482, 483, 488, 489, 493, 494, +- 499, 500, 504, 505, 509, 510, 511, 524, 533, 537, +- 541, 549, 550, 554, 567, 568, 573, 574, 575, 593, +- 597, 601, 609, 611, 616, 623, 633, 637, 641, 649, +- 655, 668, 669, 675, 676, 677, 684, 684, 692, 693, +- 694, 699, 702, 704, 706, 708, 710, 712, 714, 716, +- 718, 723, 724, 733, 757, 758, 759, 760, 772, 774, +- 798, 803, 804, 809, 817, 818 ++ 0, 314, 314, 323, 324, 328, 329, 335, 339, 344, ++ 345, 346, 347, 348, 349, 354, 359, 360, 361, 362, ++ 363, 372, 372, 373, 374, 375, 376, 377, 378, 379, ++ 380, 384, 385, 394, 395, 399, 410, 414, 418, 426, ++ 436, 437, 447, 448, 454, 467, 467, 472, 472, 477, ++ 477, 482, 492, 493, 494, 495, 500, 501, 505, 506, ++ 511, 512, 516, 517, 521, 522, 523, 536, 545, 549, ++ 553, 561, 562, 566, 579, 580, 585, 586, 587, 605, ++ 609, 613, 621, 623, 628, 635, 645, 649, 653, 661, ++ 667, 680, 681, 687, 688, 689, 696, 696, 704, 705, ++ 706, 711, 714, 716, 718, 720, 722, 724, 726, 728, ++ 730, 735, 736, 745, 769, 770, 771, 772, 784, 786, ++ 810, 815, 816, 821, 829, 830 + }; + #endif + +@@ -2217,7 +2220,7 @@ yyreduce: + + case 9: /* prologue_declaration: "%header" string.opt */ + #line 340 "src/parse-gram.y" +- { handle_header ((yyvsp[0].yykind_75)); } ++ { handle_header (&(yylsp[0]), (yyvsp[0].yykind_75)); } + #line 2222 "src/parse-gram.c" + break; + +@@ -2289,7 +2292,14 @@ yyreduce: + + case 20: /* prologue_declaration: "%output" "string" */ + #line 359 "src/parse-gram.y" +- { spec_outfile = unquote ((yyvsp[0].STRING)); gram_scanner_last_string_free (); } ++ { ++ char *file = unquote ((yyvsp[0].STRING)); ++ if (valid_output_file_name (file)) ++ spec_outfile = file; ++ else ++ complain (&(yylsp[0]), complaint, _("invalid %%output file name ignored")); ++ gram_scanner_last_string_free (); ++ } + #line 2294 "src/parse-gram.c" + break; + +@@ -3290,14 +3300,24 @@ add_param (param_type type, char *decl, location loc) + } + + ++static bool ++valid_output_file_name (char const *file) ++{ ++ return !strchr (file, '/'); ++} ++ ++ + static void +-handle_header (char const *value) ++handle_header (location const *loc, char const *value) + { + header_flag = true; + if (value) + { + char *file = unquote (value); +- spec_header_file = xstrdup (file); ++ if (valid_output_file_name (file)) ++ spec_header_file = xstrdup (file); ++ else ++ complain (loc, complaint, _("invalid %%header file name ignored")); + gram_scanner_last_string_free (); + unquote_free (file); + } +diff --git a/src/parse-gram.y b/src/parse-gram.y +index 15180cb..114c5c4 100644 +--- a/src/parse-gram.y ++++ b/src/parse-gram.y +@@ -95,8 +95,11 @@ + string from the scanner (should be CODE). */ + static char const *translate_code_braceless (char *code, location loc); + ++ /* Is FILE a valid output file name? */ ++ static bool valid_output_file_name (char const *file); ++ + /* Handle a %header directive. */ +- static void handle_header (char const *value); ++ static void handle_header (location const *loc, char const *value); + + /* Handle a %error-verbose directive. */ + static void handle_error_verbose (location const *loc, char const *directive); +@@ -337,7 +340,7 @@ prologue_declaration: + muscle_percent_define_insert ($2, @$, $3.kind, $3.chars, + MUSCLE_PERCENT_DEFINE_GRAMMAR_FILE); + } +-| "%header" string.opt { handle_header ($2); } ++| "%header" string.opt { handle_header (&@2, $2); } + | "%error-verbose" { handle_error_verbose (&@$, $1); } + | "%expect" INT_LITERAL { expected_sr_conflicts = $2; } + | "%expect-rr" INT_LITERAL { expected_rr_conflicts = $2; } +@@ -356,7 +359,15 @@ prologue_declaration: + | "%name-prefix" STRING { handle_name_prefix (&@$, $1, $2); } + | "%no-lines" { no_lines_flag = true; } + | "%nondeterministic-parser" { nondeterministic_parser = true; } +-| "%output" STRING { spec_outfile = unquote ($2); gram_scanner_last_string_free (); } ++| "%output" STRING ++ { ++ char *file = unquote ($2); ++ if (valid_output_file_name (file)) ++ spec_outfile = file; ++ else ++ complain (&@2, complaint, _("invalid %%output file name ignored")); ++ gram_scanner_last_string_free (); ++ } + | "%param" { current_param = $1; } params { current_param = param_none; } + | "%pure-parser" { handle_pure_parser (&@$, $1); } + | "%require" STRING { handle_require (&@2, $2); } +@@ -952,14 +963,24 @@ add_param (param_type type, char *decl, location loc) + } + + ++static bool ++valid_output_file_name (char const *file) ++{ ++ return !strchr (file, '/'); ++} ++ ++ + static void +-handle_header (char const *value) ++handle_header (location const *loc, char const *value) + { + header_flag = true; + if (value) + { + char *file = unquote (value); +- spec_header_file = xstrdup (file); ++ if (valid_output_file_name (file)) ++ spec_header_file = xstrdup (file); ++ else ++ complain (loc, complaint, _("invalid %%header file name ignored")); + gram_scanner_last_string_free (); + unquote_free (file); + } +-- +2.45.4 + diff --git a/SPECS/bison/bison.spec b/SPECS/bison/bison.spec index 98720385231..22e1abbec12 100644 --- a/SPECS/bison/bison.spec +++ b/SPECS/bison/bison.spec @@ -1,13 +1,15 @@ Summary: Contains a parser generator Name: bison Version: 3.8.2 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv3+ Vendor: Microsoft Corporation Distribution: Azure Linux Group: System Environment/Base URL: https://www.gnu.org/software/bison Source0: https://ftp.gnu.org/gnu/%{name}/%{name}-%{version}.tar.xz +Patch0: CVE-2026-56389.patch +Patch1: CVE-2026-56390.patch BuildRequires: flex BuildRequires: m4 @@ -20,7 +22,7 @@ Provides: %{name}-runtime = %{version}-%{release} This package contains a parser generator %prep -%setup -q +%autosetup -p1 %build #make some fixes required by glibc-2.28: @@ -47,6 +49,7 @@ make %{?_smp_mflags} check %files -f %{name}.lang %defattr(-,root,root) %license COPYING +%exclude %{_docdir}/%{name}/COPYING %{_bindir}/* %{_libdir}/*.a %{_datarootdir}/%{name}/* @@ -55,6 +58,9 @@ make %{?_smp_mflags} check %{_docdir}/bison/* %changelog +* Wed Sep 02 2026 Swapnil Sahu - 3.8.2-2 +- Patch for CVE-2026-56390, CVE-2026-56389 + * Mon Oct 16 2023 CBL-Mariner Servicing Account - 3.8.2-1 - Auto-upgrade to 3.8.2 - Azure Linux 3.0 - package upgrades diff --git a/SPECS/frr/0006-fix-bison-output-file-directives.patch b/SPECS/frr/0006-fix-bison-output-file-directives.patch new file mode 100644 index 00000000000..763a84a1361 --- /dev/null +++ b/SPECS/frr/0006-fix-bison-output-file-directives.patch @@ -0,0 +1,46 @@ +From 82dcd117d0ac8a34096b3f721d85f71fdd61023a Mon Sep 17 00:00:00 2001 +From: Swapnil Sahu +Date: Sat, 22 Aug 2026 12:43:36 +0000 +Subject: [PATCH] pass bison output file names on the command line + +Hardened bison (CVE-2026-56390/56389) rejects %output/%defines directives whose +value contains a slash, breaking FRR's "lib/command_parse.c" build. Drop those +directives and pass the output path via bison's -o flag in the .y.c rule instead. + +--- + lib/command_parse.y | 5 ++--- + lib/subdir.am | 2 +- + 2 files changed, 3 insertions(+), 4 deletions(-) + +diff --git a/lib/command_parse.y b/lib/command_parse.y +index fdb36c3..ea199dd 100644 +--- a/lib/command_parse.y ++++ b/lib/command_parse.y +@@ -16,9 +16,8 @@ + %define api.pure full + /* define api.prefix {cmd_yy} */ + +-/* names for generated header and parser files */ +-%defines "lib/command_parse.h" +-%output "lib/command_parse.c" ++/* Output/header file names are supplied on the bison command line (-o) in ++ * lib/subdir.am; hardened bison rejects %output/%defines paths with a slash. */ + + /* note: code blocks are output in order, to both .c and .h: + * 1. %code requires +diff --git a/lib/subdir.am b/lib/subdir.am +index a598fe4..f667dd3 100644 +--- a/lib/subdir.am ++++ b/lib/subdir.am +@@ -534,7 +534,7 @@ CLEANFILES += vtysh/vtysh_cmd.c $(vtysh_cmd_split) + .l.c: + $(AM_V_LEX)$(am__skiplex) $(LEXCOMPILE) $< + .y.c: +- $(AM_V_YACC)$(am__skipyacc) $(YACCCOMPILE) $< ++ $(AM_V_YACC)$(am__skipyacc) $(YACCCOMPILE) -o $@ $< + + # + # generated sources & extra foo +-- +2.45.4 + diff --git a/SPECS/frr/frr.spec b/SPECS/frr/frr.spec index cd58876ff18..5aa1b04eeb1 100644 --- a/SPECS/frr/frr.spec +++ b/SPECS/frr/frr.spec @@ -3,7 +3,7 @@ Summary: Routing daemon Name: frr Version: 10.5.4 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later Vendor: Microsoft Corporation Distribution: Azure Linux @@ -17,6 +17,7 @@ Patch2: 0002-disable-eigrp-crypto.patch Patch3: 0003-fips-mode.patch Patch4: 0004-remove-grpc-test.patch Patch5: 0001-Fix-frr-c90-complaint-error.patch +Patch6: 0006-fix-bison-output-file-directives.patch BuildRequires: autoconf BuildRequires: automake BuildRequires: bison @@ -196,6 +197,9 @@ rm tests/lib/*grpc* %{_sysusersdir}/%{name}.conf %changelog +* Wed Sep 02 2026 Swapnil Sahu - 10.5.4-2 +- Pass bison output file names via -o to build with hardened bison + * Mon May 04 2026 Kanishk Bansal - 10.5.4-1 - Upgrade to 10.5.4 for CVE-2026-37457 diff --git a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt index 1349a92959d..09fe722729c 100644 --- a/toolkit/resources/manifests/package/pkggen_core_aarch64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_aarch64.txt @@ -84,7 +84,7 @@ zstd-libs-1.5.5-2.azl3.aarch64.rpm libtool-2.4.7-2.azl3.aarch64.rpm flex-2.6.4-7.azl3.aarch64.rpm flex-devel-2.6.4-7.azl3.aarch64.rpm -bison-3.8.2-1.azl3.aarch64.rpm +bison-3.8.2-2.azl3.aarch64.rpm popt-1.19-1.azl3.aarch64.rpm popt-devel-1.19-1.azl3.aarch64.rpm popt-lang-1.19-1.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index 92a56a6eace..159bbd8a09d 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -84,7 +84,7 @@ zstd-libs-1.5.5-2.azl3.x86_64.rpm libtool-2.4.7-2.azl3.x86_64.rpm flex-2.6.4-7.azl3.x86_64.rpm flex-devel-2.6.4-7.azl3.x86_64.rpm -bison-3.8.2-1.azl3.x86_64.rpm +bison-3.8.2-2.azl3.x86_64.rpm popt-1.19-1.azl3.x86_64.rpm popt-devel-1.19-1.azl3.x86_64.rpm popt-lang-1.19-1.azl3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index a2afd9b623b..a6f44bef434 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -33,8 +33,8 @@ bash-lang-5.2.15-3.azl3.aarch64.rpm binutils-2.41-13.azl3.aarch64.rpm binutils-debuginfo-2.41-13.azl3.aarch64.rpm binutils-devel-2.41-13.azl3.aarch64.rpm -bison-3.8.2-1.azl3.aarch64.rpm -bison-debuginfo-3.8.2-1.azl3.aarch64.rpm +bison-3.8.2-2.azl3.aarch64.rpm +bison-debuginfo-3.8.2-2.azl3.aarch64.rpm bzip2-1.0.8-2.azl3.aarch64.rpm bzip2-debuginfo-1.0.8-2.azl3.aarch64.rpm bzip2-devel-1.0.8-2.azl3.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 4d6fd92ab2c..d39ca5ba99a 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -36,8 +36,8 @@ binutils-2.41-13.azl3.x86_64.rpm binutils-aarch64-linux-gnu-2.41-13.azl3.x86_64.rpm binutils-debuginfo-2.41-13.azl3.x86_64.rpm binutils-devel-2.41-13.azl3.x86_64.rpm -bison-3.8.2-1.azl3.x86_64.rpm -bison-debuginfo-3.8.2-1.azl3.x86_64.rpm +bison-3.8.2-2.azl3.x86_64.rpm +bison-debuginfo-3.8.2-2.azl3.x86_64.rpm bzip2-1.0.8-2.azl3.x86_64.rpm bzip2-debuginfo-1.0.8-2.azl3.x86_64.rpm bzip2-devel-1.0.8-2.azl3.x86_64.rpm