systemd-bootstrap: fix CVE-2022-4415 (#5094)

Co-authored-by: CBL-Mariner Servicing Account <cblmargh@microsoft.com>

SPECS/systemd/systemd-bootstrap.spec

@@ -1,7 +1,7 @@
 Summary:        Bootstrap version of systemd. Workaround for systemd circular dependency.
 Name:           systemd-bootstrap
 Version:        250.3
-Release:        11%{?dist}
+Release:        12%{?dist}
 License:        LGPLv2+ AND GPLv2+ AND MIT
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -23,6 +23,8 @@ Patch2:         gpt-auto-devno-not-determined.patch
 Patch3:         CVE-2022-3821.patch
 # Patch4 can be removed once we update to version 252
 Patch4:         CVE-2022-45873.patch
+Patch5:         backport-helper-util-macros.patch
+Patch6:         CVE-2022-4415.patch
 BuildRequires:  docbook-dtd-xml
 BuildRequires:  docbook-style-xsl
 BuildRequires:  gettext
@@ -244,6 +246,10 @@ fi
 %{_datadir}/pkgconfig/udev.pc
 
 %changelog
+* Mon Mar 13 2023 Nicolas Guibourge <nicolasg@microsoft.com> - 250.3-12
+- Add patch for CVE-2022-4415
+- Add patch backport-helper-util-macros.patch to backport needed macros for CVE-2022-4415.patch
+
 * Wed Jan 25 2023 Adit Jha <aditjha@microsoft.com> - 250.3-11
 - Add 99-mariner.preset to disable systemd-oomd by default
 

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -551,10 +551,10 @@ sqlite-devel-3.39.2-2.cm2.aarch64.rpm
 sqlite-libs-3.39.2-2.cm2.aarch64.rpm
 swig-4.0.2-3.cm2.aarch64.rpm
 swig-debuginfo-4.0.2-3.cm2.aarch64.rpm
-systemd-bootstrap-250.3-11.cm2.aarch64.rpm
-systemd-bootstrap-debuginfo-250.3-11.cm2.aarch64.rpm
-systemd-bootstrap-devel-250.3-11.cm2.aarch64.rpm
-systemd-bootstrap-rpm-macros-250.3-11.cm2.noarch.rpm
+systemd-bootstrap-250.3-12.cm2.aarch64.rpm
+systemd-bootstrap-debuginfo-250.3-12.cm2.aarch64.rpm
+systemd-bootstrap-devel-250.3-12.cm2.aarch64.rpm
+systemd-bootstrap-rpm-macros-250.3-12.cm2.noarch.rpm
 tar-1.34-1.cm2.aarch64.rpm
 tar-debuginfo-1.34-1.cm2.aarch64.rpm
 tdnf-3.2.2-4.cm2.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -551,10 +551,10 @@ sqlite-devel-3.39.2-2.cm2.x86_64.rpm
 sqlite-libs-3.39.2-2.cm2.x86_64.rpm
 swig-4.0.2-3.cm2.x86_64.rpm
 swig-debuginfo-4.0.2-3.cm2.x86_64.rpm
-systemd-bootstrap-250.3-11.cm2.x86_64.rpm
-systemd-bootstrap-debuginfo-250.3-11.cm2.x86_64.rpm
-systemd-bootstrap-devel-250.3-11.cm2.x86_64.rpm
-systemd-bootstrap-rpm-macros-250.3-11.cm2.noarch.rpm
+systemd-bootstrap-250.3-12.cm2.x86_64.rpm
+systemd-bootstrap-debuginfo-250.3-12.cm2.x86_64.rpm
+systemd-bootstrap-devel-250.3-12.cm2.x86_64.rpm
+systemd-bootstrap-rpm-macros-250.3-12.cm2.noarch.rpm
 tar-1.34-1.cm2.x86_64.rpm
 tar-debuginfo-1.34-1.cm2.x86_64.rpm
 tdnf-3.2.2-4.cm2.x86_64.rpm