Upgrade iscsi-initiator-utils to version 2.1.12 for CVE-2026-44943, CVE-2026-44944 - #18322
Conversation
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
microsoft-github-policy-service
Bot
added
Packaging
3.0-dev
…VE-2026-44944 Upgrade open-iscsi from 2.1.9 to 2.1.12. The tag 2.1.12 tarball resolves to upstream commit 7e00642c40123e0b3f949e74c3945872c17a407e, which is the exact commit Fedora 45 packages. - Rebase downstream patches onto 2.1.12; drop hunks merged upstream - Drop removal of 'iface.example', no longer installed by upstream meson - Add '%check' running the upstream libopeniscsiusr test suite - Add missing '%license' macro - Update cgmanifest.json and signatures.json
4935045 to
497b67e
Compare
microsoft-github-policy-service
Bot
added
Tools
fasttrack/3.0
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
/azp run |
|
Commenter does not have sufficient privileges for PR 18322 in repo microsoft/azurelinux |
|
Buddy Build has passed. |
|
/azurepipelines run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). 1 pipeline(s) were filtered out due to trigger conditions. |
Kanishk Bansal (Kanishk-Bansal)
added
security
CVE-fixed-by-upgrade
There was a problem hiding this comment.
There is a runtime-breaking change in the spec file.
%installstill deletes the ExecStart target:rm $RPM_BUILD_ROOT/usr/sbin/iscsi-gen-initiatorname(and its man page).%installstill deletes/etc/iscsi/initiatorname.iscsi, so the package ships no IQN file.%filesstill ships%{_unitdir}/iscsi-init.service, whose 2.1.12 ExecStart is/usr/sbin/iscsi-gen-initiatorname. No applied patch neutralizes it. None of the patches rewrites theiscsi-init.serviceExecStart.
Resulting runtime failure: on a fresh boot with no initiatorname.iscsi, ConditionPathExists=!/etc/iscsi/initiatorname.iscsi is true → systemd runs ExecStart=/usr/sbin/iscsi-gen-initiatorname → file missing → status=203/EXEC → no InitiatorName generated → iscsid/logins fail.
PR: open-iscsi/open-iscsi#532
commit: open-iscsi/open-iscsi@f71c5cf
Please refer Fedora spec file for reference.
nit: 0024-minor-service-file-updates.patch is still present in the directory but isn't referenced in the spec. It was dropped from the spec during the 2.1.9 upgrade but never removed from the directory in #7250. Please delete the stale file.
There was a problem hiding this comment.
Thanks Akhila Guruju (@akhila-guruju). I’ve added iscsi-gen-initiatorname and its man page in the latest commit for now, since the upstream iscsi-init.service points to that helper. Looking more closely, though, the helper does more than generate a name: it first tries to use rd.initiatorname or an iBFT-provided name, and only falls back to iscsi-iname. AZL3 previously always generated a new name with iscsi-iname when the initiator name file was missing. Adopting the upstream helper could therefore may change existing customer expectations. I think we should patch the service to keep using iscsi-iname and continue excluding the new helper and its man page.
Buddy Build has passed. |
|
/azurepipelines run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). 1 pipeline(s) were filtered out due to trigger conditions. |
|
Auto cherry-pick results:
Auto cherry-pick pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1177653&view=results |
4 participants
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
This PR upgrades the
iscsi-initiator-utilspackage from 2.1.9 to 2.1.12 to fix CVE-2026-44943 and CVE-2026-44944.Source0now points at the upstream release tag instead of a bare commit hash. The tag2.1.12resolves to commit7e00642c40123e0b3f949e74c3945872c17a407e— the same commit Fedora 45 packages — and the tarball's git tree hash matches that commit exactly.The downstream patch set was rebased onto 2.1.12. Patch content is byte-identical to Fedora 45 apart from the Azure Linux-only
0201-mariner-fixes.patch:0009-Coverity-scan-fixes.patch— upstream renamed theiscsiuiologging macros toILOG_*, and already merged the twoLOCK_DIRmkdirfixes, so those hunks were dropped.0103-fix-libiscsi-firmware-discovery-issue-with-NULL-drec.patch— theusr/idbm.cNULL-drecguard is now upstream, so that hunk was dropped.0101-libiscsi.patch—libiscsi/setup.pyswitched fromdistutils.coretosetuptools(distutilswas removed in Python 3.12).0003/0007— rebased hunk offsets and context.iface.examplewas dropped from%install; upstream's meson no longer installs it (Fedora 45 dropped this too).Change Log
Source0, add%check, add%license, dropiface.exampleremovalsetuptoolsinstead ofdistutilsDoes this affect the toolchain?
NO
Associated issues
Links to CVEs
Test Methodology