[AutoPR- Security] Patch telegraf for CVE-2026-26958 [LOW]#16091
[AutoPR- Security] Patch telegraf for CVE-2026-26958 [LOW]#16091azurelinux-security wants to merge 3 commits intomicrosoft:3.0-devfrom
Conversation
microsoft-github-policy-service
bot
added
Packaging
3.0-dev
🔒 CVE Patch Review: CVE-2026-26958PR #16091 — [AutoPR- Security] Patch telegraf for CVE-2026-26958 [LOW] Spec File Validation
Build Verification
🤖 AI Build Log Analysis
🧪 Test Log AnalysisNo test log found (package may not have a %check section). Patch Analysis
Detailed analysis
Conclusion: The PR patch is an effective backport of the upstream security fix, with only test-related hunks omitted. Risk is low. Raw diff (upstream vs PR)--- upstream
+++ pr
@@ -1,92 +1,47 @@
-From d1c650afb95fad0742b98d95f2eb2cf031393abb Mon Sep 17 00:00:00 2001
-From: Filippo Valsorda <hi@filippo.io>
-Date: Sun, 15 Feb 2026 22:00:22 +0100
-Subject: [PATCH] extra: initialize receiver in MultiScalarMult
-
-(*Point).MultiScalarMult failed to initialize its receiver.
-
-If the method is called on an initialized point that is not the identity
-point, MultiScalarMult produces an incorrect result.
-
-If the method is called on an uninitialized point, the behavior is
-undefined. In particular, if the receiver is the zero value,
-MultiScalarMult returns an invalid point that compares Equal to every
-point.
-
-This was independently reported by @WeebDataHoarder and @shaharcohen1.
-
-Fixes CVE-2026-26958
-Fixes GHSA-fw7p-63qq-7hpr
----
- edwards25519_test.go | 3 +++
- extra.go | 1 +
- extra_test.go | 30 ++++++++++++++++++++++++++++++
- 3 files changed, 34 insertions(+)
-
-diff --git a/edwards25519_test.go b/edwards25519_test.go
-index fe511bd..95b081d 100644
---- a/edwards25519_test.go
-+++ b/edwards25519_test.go
-@@ -18,6 +18,9 @@ var I = NewIdentityPoint()
- func checkOnCurve(t *testing.T, points ...*Point) {
- t.Helper()
- for i, p := range points {
-+ if p.z.Equal(new(field.Element)) == 1 {
-+ t.Errorf("point %d has Z == 0 (degenerate projective point)", i)
-+ }
- var XX, YY, ZZ, ZZZZ field.Element
- XX.Square(&p.x)
- YY.Square(&p.y)
-diff --git a/extra.go b/extra.go
-index d152d68..ab2e44a 100644
---- a/extra.go
-+++ b/extra.go
-@@ -265,6 +265,7 @@ func (v *Point) MultiScalarMult(scalars []*Scalar, points []*Point) *Point {
- tmp1 := &projP1xP1{}
- tmp2 := &projP2{}
- // Lookup-and-add the appropriate multiple of each input point
-+ v.Set(NewIdentityPoint())
- for j := range tables {
- tables[j].SelectInto(multiple, digits[j][63])
- tmp1.Add(v, multiple) // tmp1 = v + x_(j,63)*Q in P1xP1 coords
-diff --git a/extra_test.go b/extra_test.go
-index 6fb832a..2eaa3f0 100644
---- a/extra_test.go
-+++ b/extra_test.go
-@@ -149,6 +149,36 @@ func TestMultiScalarMultMatchesBaseMult(t *testing.T) {
- }
- }
-
-+func TestMultiScalarMultZeroReceiver(t *testing.T) {
-+ // A zero-value (uninitialized) receiver should be handled correctly,
-+ // producing a valid point on the curve.
-+ var p Point
-+ p.MultiScalarMult([]*Scalar{dalekScalar}, []*Point{B})
+diff --git a/SPECS/telegraf/CVE-2026-26958.patch b/SPECS/telegraf/CVE-2026-26958.patch
+new file mode 100644
+index 00000000000..2149ba52dc8
+--- /dev/null
++++ b/SPECS/telegraf/CVE-2026-26958.patch
+@@ -0,0 +1,41 @@
++From 2a91b328968b2f9d0e39aac8852af38cfdce5b0f Mon Sep 17 00:00:00 2001
++From: Filippo Valsorda <hi@filippo.io>
++Date: Sun, 15 Feb 2026 22:00:22 +0100
++Subject: [PATCH] extra: initialize receiver in MultiScalarMult
+
-+ var check Point
-+ check.ScalarBaseMult(dalekScalar)
++(*Point).MultiScalarMult failed to initialize its receiver.
+
-+ checkOnCurve(t, &p, &check)
-+ if p.Equal(&check) != 1 {
-+ t.Error("MultiScalarMult with zero-value receiver did not match ScalarBaseMult")
-+ }
-+}
++If the method is called on an initialized point that is not the identity
++point, MultiScalarMult produces an incorrect result.
+
-+func TestMultiScalarMultReceiverAliasing(t *testing.T) {
-+ // The receiver v aliasing one of the input points should produce
-+ // the correct result.
-+ p := NewGeneratorPoint()
-+ p.MultiScalarMult([]*Scalar{dalekScalar}, []*Point{p})
++If the method is called on an uninitialized point, the behavior is
++undefined. In particular, if the receiver is the zero value,
++MultiScalarMult returns an invalid point that compares Equal to every
++point.
+
-+ var check Point
-+ check.ScalarBaseMult(dalekScalar)
++This was independently reported by @WeebDataHoarder and @shaharcohen1.
+
-+ checkOnCurve(t, p, &check)
-+ if p.Equal(&check) != 1 {
-+ t.Error("MultiScalarMult with aliased receiver did not match ScalarBaseMult")
-+ }
-+}
++Fixes CVE-2026-26958
++Fixes GHSA-fw7p-63qq-7hpr
+
- func TestVarTimeMultiScalarMultMatchesBaseMult(t *testing.T) {
- varTimeMultiScalarMultMatchesBaseMult := func(x, y, z Scalar) bool {
- var p, q1, q2, q3, check Point
++Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
++Upstream-reference: https://github.com/FiloSottile/edwards25519/commit/d1c650afb95fad0742b98d95f2eb2cf031393abb
++---
++ vendor/filippo.io/edwards25519/extra.go | 1 +
++ 1 file changed, 1 insertion(+)
++
++diff --git a/vendor/filippo.io/edwards25519/extra.go b/vendor/filippo.io/edwards25519/extra.go
++index d152d68f..ab2e44a5 100644
++--- a/vendor/filippo.io/edwards25519/extra.go
+++++ b/vendor/filippo.io/edwards25519/extra.go
++@@ -265,6 +265,7 @@ func (v *Point) MultiScalarMult(scalars []*Scalar, points []*Point) *Point {
++ tmp1 := &projP1xP1{}
++ tmp2 := &projP2{}
++ // Lookup-and-add the appropriate multiple of each input point
+++ v.Set(NewIdentityPoint())
++ for j := range tables {
++ tables[j].SelectInto(multiple, digits[j][63])
++ tmp1.Add(v, multiple) // tmp1 = v + x_(j,63)*Q in P1xP1 coords
++--
++2.45.4
++
Verdict❌ CHANGES REQUESTED — Please address the issues flagged above. |
|
AI backported patch matches with the upstream patch. |
|
closing in favour of #16431 |
3 participants
Auto Patch telegraf for CVE-2026-26958.
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1061162&view=results
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
Change Log
Does this affect the toolchain?
YES/NO
Associated issues
Links to CVEs
Test Methodology