Add the krb5 patch to fix CVE-2024-37370 (#65)

Add the krb5 patch to fix CVE-2024-37370 See more detail: krb5/krb5@55fbf43
sonic-net · Jul 15, 2024 · 495c89c · 495c89c
1 parent fe7eb30
commit 495c89c
Show file tree

Hide file tree

Showing 8 changed files with 723 additions and 5 deletions.
diff --git a/.azure-pipelines/test-multiarch.sh b/.azure-pipelines/test-multiarch.sh
@@ -5,7 +5,6 @@ set -ex
 export ARCH=armhf
 
 # Install packages
-apt-get update && apt-get install -y sudo
 sudo mkdir -p $HOME
 
 # Make SymCrypt and OpenSSL

diff --git a/.azure-pipelines/test-template-armhf.yml b/.azure-pipelines/test-template-armhf.yml
@@ -22,7 +22,7 @@ jobs:
 - job: QemuTest
   dependsOn: Build${{ parameters.arch }}
   displayName: Qemu-test-${{ parameters.arch }}
-  pool: sonicbld
+  pool: sonicbld-1es
   timeoutInMinutes: 600
   steps:
   - script: |
@@ -41,7 +41,7 @@ jobs:
     displayName: 'Show download pacakges'
   - script: |
       set -ex
-      docker run --rm --privileged multiarch/qemu-user-static --reset -p yes --credential yes
+      sudo docker run --rm --privileged multiarch/qemu-user-static --reset -p yes --credential yes
       pushd .azure-pipelines
       DEFAULT_CONTAINER_REGISTRY=publicmirror.azurecr.io/ ARCH=${{ parameters.arch }} DIST=${{ parameters.dist }} j2 Dockerfile.j2 > Dockerfile
       docker build --build-arg user=$USER --build-arg uid=$(id -u) --build-arg guid=$(id -g) --build-arg hostname=$HOSTNAME -t build-agent .

diff --git a/azure-pipelines.yml b/azure-pipelines.yml
@@ -9,6 +9,7 @@ schedules:
   branches:
     include:
     - main
+    - 202205
   always: true
 
 trigger: none

diff --git a/rules/krb5.mk b/rules/krb5.mk
@@ -1,6 +1,6 @@
 # krb5
 
-KRB5_VERSION = 1.18.3-6+deb11u4
+KRB5_VERSION = 1.18.3-6+deb11u5
 KRB5_VERSION_FIPS = $(KRB5_VERSION)+fips
 KRB5 = libk5crypto3_$(KRB5_VERSION_FIPS)_$(ARCH).deb
 $(KRB5)_SRC_PATH = $(SRC_PATH)/krb5

diff --git a/rules/symcrypt-openssl.mk b/rules/symcrypt-openssl.mk
@@ -1,6 +1,6 @@
 # SYMCRYPT_OPENSSL
 
-SYMCRYPT_OPENSSL_VERSION = 0.12
+SYMCRYPT_OPENSSL_VERSION = 0.13
 SYMCRYPT_OPENSSL = symcrypt-openssl_$(SYMCRYPT_OPENSSL_VERSION)_$(ARCH).deb
 $(SYMCRYPT_OPENSSL)_SRC_PATH = $(SRC_PATH)/SymCrypt-OpenSSL-Debian
 $(SYMCRYPT_OPENSSL)_MAKEFILE = Makefile