diff mbox series

[02/21] libmodulemd: upgrade 2.15.3 -> 2.15.4

Message ID 20261109134034.74458-3-jaipaul.cheernam@est.tech
State New
Headers show
Series Upgrades on 9th November 2026 | expand

Commit Message

Jaipaul Cheernam Nov. 9, 2026, 1:40 p.m. UTC 
2.15.4      2026-11-06

Possibly incompatible fixes:
- Compressed YAML files which decompress to much are rejected
  (CVE-2026-92823). If libmodulemd is built with "rpmio" feature,
  modulemd_module_index_update_from_file() decompresses compressed input
  files. Small compressed files can decompress to very large data. Then
  processing the large data consumes unexpectedly large amount of memory. This
  amplification of use of resources can be interpreted as a denial of service.
  To avoid it, a limit for decompressed data was imposed. The limit is
  a maximum of 64 MiB and 64 times the compressed size of the input file. When
  the limit is reached, a Glib warning is emitted and
  modulemd_module_index_update_from_file() returns FALSE. This flaw was added
  with aad63a59ca02be2cc7afb6e6c8a0c3bd5a036dd6 commit ("Add helpers for
  reading compressed files") and first released in 2.8.0 version.

- Introduce a recursion limit for YAML documents (CVE-2026-92822). Parsing
  a modulemd document with "xmd" YAML tree with enormously nested nodes may
  exhaust all heap or stack memory when duplicating subdocuments in
  modulemd_yaml_parse_document_type_internal(). This is fixed by adding
  a "recursion_limit" build-time option defining a maximal depth of acceptable
  YAML documents. Default is 64. This flaw was confirmed in current 2.15.3
  version and back to 1.4.0 version. Earlier versions might be affected as well.

Other fixes:
- Iterating over checksums in modulemd_module_stream_v2_emit_rpm_map() was
  fixed (CVE-2026-92824). When serializing a module index into a YAML string
  where a number of hash types was different from a number of hashes of
  a particular type in "rpm-map" modulemd-v2 YAML element, not all hashes were
  serialized or an invalid memory was read. This flaw was introduced with
  b5abf3bbedd211a403122fccfec192581e2bbe8f commit ("Add rpm-map to
  ModuleStreamV2") and first released in 2.2.0 version.
- Harden modulemd_module_add_translation() against null-pointer dereferences.
- Harden modulemd_module_add_obsoletes() against null-pointer dereferences.

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 .../{libmodulemd_2.15.3.bb => libmodulemd_2.15.4.bb}            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-devtools/libmodulemd/{libmodulemd_2.15.3.bb => libmodulemd_2.15.4.bb} (94%)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/libmodulemd/libmodulemd_2.15.3.bb b/meta/recipes-devtools/libmodulemd/libmodulemd_2.15.4.bb
similarity index 94%
rename from meta/recipes-devtools/libmodulemd/libmodulemd_2.15.3.bb
rename to meta/recipes-devtools/libmodulemd/libmodulemd_2.15.4.bb
index 4627e534286..52558707b5d 100644
--- a/meta/recipes-devtools/libmodulemd/libmodulemd_2.15.3.bb
+++ b/meta/recipes-devtools/libmodulemd/libmodulemd_2.15.4.bb
@@ -6,7 +6,7 @@  LIC_FILES_CHKSUM = "file://COPYING;md5=25a3927bff3ee4f5b21bcb0ed3fcd6bb"
 
 SRC_URI = "git://github.com/fedora-modularity/libmodulemd;protocol=https;branch=main;tag=${PV}"
 
-SRCREV = "a8f1c5b1243a8e844a276094007a2bbf8a13b40f"
+SRCREV = "2f75d47da15a4e4847c3deeb3101b58ad67a0723"
 
 inherit meson gobject-introspection pkgconfig manpages