Skip to content

Upgrade rpcbind to 1.2.9 for CVE-2026-16277 - #18086

Merged
jslobodzian merged 2 commits into
fasttrack/3.0from
cblmargh/rpcbind-upgrade-to-1.2.9-fasttrack/3.0
Jul 26, 2026
Merged

Upgrade rpcbind to 1.2.9 for CVE-2026-16277#18086
jslobodzian merged 2 commits into
fasttrack/3.0from
cblmargh/rpcbind-upgrade-to-1.2.9-fasttrack/3.0

Conversation

@Kanishk-Bansal

@Kanishk-Bansal Kanishk Bansal (Kanishk-Bansal) commented Jul 22, 2026

Copy link
Copy Markdown

No description provided.

@microsoft-github-policy-service microsoft-github-policy-service Bot added Packaging fasttrack/3.0 PRs Destined for Azure Linux 3.0 labels Jul 22, 2026
@Kanishk-Bansal

Kanishk Bansal (Kanishk-Bansal) commented Jul 22, 2026

Copy link
Copy Markdown
Author

commit which fixes CVE

commit bb9bb7286a4c345442946dc2ce3c9e7f67e96d4d
Author: Steve Dickson <steved@redhat.com>
Date:   Wed May 27 11:42:11 2026 -0400

    rpcinfo: stack buffer overflow in rpcinfo rpcbaddrlist()
    
    rpcinfo's rpcbaddrlist() formats two server-controlled, unbounded XDR strings into a fixed 128-byte stack buffer with sprintf(). A malicious or on-path rpcbind server overflows it when a user runs:
    rpcinfo -l <host> <prognum> <versnum>
    
    Reported-by: Michalis Vasileiadis <vmihalis.tmd@gmail.com>
    Signed-off-by: Steve Dickson <steved@redhat.com>

this is included in 1.2.9 tarball

@Kanishk-Bansal
Kanishk Bansal (Kanishk-Bansal) marked this pull request as ready for review July 23, 2026 06:02
@Kanishk-Bansal
Kanishk Bansal (Kanishk-Bansal) requested a review from a team as a code owner July 23, 2026 06:02
@Kanishk-Bansal Kanishk Bansal (Kanishk-Bansal) added the CVEFixReadyForMaintainerReview When a CVE fix has been reviewed by release manager and is ready for stable maintainer review label Jul 23, 2026
@jslobodzian
jslobodzian merged commit ef45e1e into fasttrack/3.0 Jul 26, 2026
30 checks passed
@jslobodzian
jslobodzian deleted the cblmargh/rpcbind-upgrade-to-1.2.9-fasttrack/3.0 branch July 26, 2026 13:31
@CBL-Mariner-Bot CBL-Mariner-Bot mentioned this pull request Jul 26, 2026
Merged
@CBL-Mariner-Bot

CBL-Mariner-Bot commented Jul 26, 2026

Copy link
Copy Markdown
Collaborator

Auto cherry-pick results:

Auto cherry-pick pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1168257&view=results

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jslobodzian jslobodzian jslobodzian approved these changes

Assignees

No one assigned

Labels

CVE-fixed-by-upgrade CVE fixed by package upgrade CVEFixReadyForMaintainerReview When a CVE fix has been reviewed by release manager and is ready for stable maintainer review fasttrack/3.0 PRs Destined for Azure Linux 3.0 Packaging security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Kanishk-Bansal @CBL-Mariner-Bot @jslobodzian