0006-fix-CVE-2022-41723.patch

@@ -1,159 +0,0 @@
-From 6ea59034fb15b3649c70078065e15fd5bfff601d Mon Sep 17 00:00:00 2001
-From: bwzhang <zhangbowei@kylinos.cn>
-Date: Fri, 22 Mar 2024 09:24:48 +0800
-Subject: [PATCH] fix CVE-2022-41723
-
-http2/hpack: avoid quadratic complexity in hpack decoding
-
-When parsing a field literal containing two Huffman-encoded strings,
-don't decode the first string until verifying all data is present.
-Avoids forced quadratic complexity when repeatedly parsing a partial
-field, repeating the Huffman decoding of the string on each iteration.
-
-Thanks to Philippe Antoine (Catena cyber) for reporting this issue.
-
-Fixes golang/go#57855
-Fixes CVE-2022-41723
-
-Change-Id: I58a743df450a4a4923dddd5cf6bb0592b0a7bdf3
-Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1688184
-TryBot-Result: Security TryBots <security-trybots@go-security-trybots.iam.gserviceaccount.com>
-Reviewed-by: Julie Qiu <julieqiu@google.com>
-Run-TryBot: Damien Neil <dneil@google.com>
-Reviewed-by: Roland Shoemaker <bracewell@google.com>
-Reviewed-on: https://go-review.googlesource.com/c/net/+/468135
-Run-TryBot: Michael Pratt <mpratt@google.com>
-Reviewed-by: Roland Shoemaker <roland@golang.org>
-Reviewed-by: Than McIntosh <thanm@google.com>
-Auto-Submit: Michael Pratt <mpratt@google.com>
-TryBot-Result: Gopher Robot <gobot@golang.org>
----
- vendor/golang.org/x/net/http2/hpack/hpack.go | 79 ++++++++++++--------
- 1 file changed, 49 insertions(+), 30 deletions(-)
-
-diff --git a/vendor/golang.org/x/net/http2/hpack/hpack.go b/vendor/golang.org/x/net/http2/hpack/hpack.go
-index 85f18a2..279cccc 100644
---- a/vendor/golang.org/x/net/http2/hpack/hpack.go
-+++ b/vendor/golang.org/x/net/http2/hpack/hpack.go
-@@ -359,6 +359,7 @@ func (d *Decoder) parseFieldLiteral(n uint8, it indexType) error {
- 
- 	var hf HeaderField
- 	wantStr := d.emitEnabled || it.indexed()
-+	var undecodedName undecodedString
- 	if nameIdx > 0 {
- 		ihf, ok := d.at(nameIdx)
- 		if !ok {
-@@ -366,15 +367,27 @@ func (d *Decoder) parseFieldLiteral(n uint8, it indexType) error {
- 		}
- 		hf.Name = ihf.Name
- 	} else {
--		hf.Name, buf, err = d.readString(buf, wantStr)
-+		undecodedName, buf, err = d.readString(buf)
- 		if err != nil {
- 			return err
- 		}
- 	}
--	hf.Value, buf, err = d.readString(buf, wantStr)
-+	undecodedValue, buf, err := d.readString(buf)
- 	if err != nil {
- 		return err
- 	}
-+	if wantStr {
-+		if nameIdx <= 0 {
-+			hf.Name, err = d.decodeString(undecodedName)
-+			if err != nil {
-+				return err
-+			}
-+		}
-+		hf.Value, err = d.decodeString(undecodedValue)
-+		if err != nil {
-+			return err
-+		}
-+	}
- 	d.buf = buf
- 	if it.indexed() {
- 		d.dynTab.add(hf)
-@@ -459,46 +472,52 @@ func readVarInt(n byte, p []byte) (i uint64, remain []byte, err error) {
- 	return 0, origP, errNeedMore
- }
- 
--// readString decodes an hpack string from p.
-+// readString reads an hpack string from p.
- //
--// wantStr is whether s will be used. If false, decompression and
--// []byte->string garbage are skipped if s will be ignored
--// anyway. This does mean that huffman decoding errors for non-indexed
--// strings past the MAX_HEADER_LIST_SIZE are ignored, but the server
--// is returning an error anyway, and because they're not indexed, the error
--// won't affect the decoding state.
--func (d *Decoder) readString(p []byte, wantStr bool) (s string, remain []byte, err error) {
-+// It returns a reference to the encoded string data to permit deferring decode costs
-+// until after the caller verifies all data is present.
-+func (d *Decoder) readString(p []byte) (u undecodedString, remain []byte, err error) {
- 	if len(p) == 0 {
--		return "", p, errNeedMore
-+		return u, p, errNeedMore
- 	}
- 	isHuff := p[0]&128 != 0
- 	strLen, p, err := readVarInt(7, p)
- 	if err != nil {
--		return "", p, err
-+		return u, p, err
- 	}
- 	if d.maxStrLen != 0 && strLen > uint64(d.maxStrLen) {
--		return "", nil, ErrStringLength
-+		// Returning an error here means Huffman decoding errors
-+		// for non-indexed strings past the maximum string length
-+		// are ignored, but the server is returning an error anyway
-+		// and because the string is not indexed the error will not
-+		// affect the decoding state.
-+		return u, nil, ErrStringLength
- 	}
- 	if uint64(len(p)) < strLen {
--		return "", p, errNeedMore
--	}
--	if !isHuff {
--		if wantStr {
--			s = string(p[:strLen])
--		}
--		return s, p[strLen:], nil
-+		return u, p, errNeedMore
- 	}
-+	u.isHuff = isHuff
-+	u.b = p[:strLen]
-+	return u, p[strLen:], nil
-+}
- 
--	if wantStr {
--		buf := bufPool.Get().(*bytes.Buffer)
--		buf.Reset() // don't trust others
--		defer bufPool.Put(buf)
--		if err := huffmanDecode(buf, d.maxStrLen, p[:strLen]); err != nil {
--			buf.Reset()
--			return "", nil, err
--		}
-+type undecodedString struct {
-+	isHuff bool
-+	b      []byte
-+}
-+
-+func (d *Decoder) decodeString(u undecodedString) (string, error) {
-+	if !u.isHuff {
-+		return string(u.b), nil
-+	}
-+	buf := bufPool.Get().(*bytes.Buffer)
-+	buf.Reset() // don't trust others
-+	var s string
-+	err := huffmanDecode(buf, d.maxStrLen, u.b)
-+	if err == nil {
- 		s = buf.String()
--		buf.Reset() // be nice to GC
- 	}
--	return s, p[strLen:], nil
-+	buf.Reset() // be nice to GC
-+	bufPool.Put(buf)
-+	return s, err
- }
--- 
-2.20.1
-

0007-fix-CVE-2024-24786.patch

@@ -1,59 +0,0 @@
-From 171172b7a8a24104415f1d461da7a839dd9933a3 Mon Sep 17 00:00:00 2001
-From: bwzhang <zhangbowei@kylinos.cn>
-Date: Mon, 25 Mar 2024 10:47:11 +0800
-Subject: [PATCH] fix CVE-2024-24786
-
-encoding/protojson, internal/encoding/json: handle missing object values
-
-In internal/encoding/json, report an error when encountering a }
-when we are expecting an object field value. For example, the input
- now correctly results in an error at the closing } token.
-
-In encoding/protojson, check for an unexpected EOF token in
-skipJSONValue. This is redundant with the check in internal/encoding/json,
-but adds a bit more defense against any other similar bugs that
-might exist.
-
-Fixes CVE-2024-24786
-
-Change-Id: I03d52512acb5091c8549e31ca74541d57e56c99d
-Reviewed-on: https://go-review.googlesource.com/c/protobuf/+/569356
-TryBot-Bypass: Damien Neil <dneil@google.com>
-Reviewed-by: Roland Shoemaker <roland@golang.org>
-Commit-Queue: Damien Neil <dneil@google.com>
----
- .../protobuf/encoding/protojson/well_known_types.go           | 4 ++++
- .../protobuf/internal/encoding/json/decode.go                 | 2 +-
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
-index 72924a9..d3825ba 100644
---- a/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
-+++ b/vendor/google.golang.org/protobuf/encoding/protojson/well_known_types.go
-@@ -328,6 +328,10 @@ func (d decoder) skipJSONValue() error {
- 				if err := d.skipJSONValue(); err != nil {
- 					return err
- 				}
-+			case json.EOF:
-+				// This can only happen if there's a bug in Decoder.Read.
-+				// Avoid an infinite loop if this does happen.
-+				return errors.New("unexpected EOF")
- 			}
- 		}
- 
-diff --git a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
-index b13fd29..b2be4e8 100644
---- a/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
-+++ b/vendor/google.golang.org/protobuf/internal/encoding/json/decode.go
-@@ -121,7 +121,7 @@ func (d *Decoder) Read() (Token, error) {
- 
- 	case ObjectClose:
- 		if len(d.openStack) == 0 ||
--			d.lastToken.kind == comma ||
-+			d.lastToken.kind&(Name|comma) != 0 ||
- 			d.openStack[len(d.openStack)-1] != ObjectOpen {
- 			return Token{}, d.newSyntaxError(tok.pos, unexpectedFmt, tok.RawString())
- 		}
--- 
-2.20.1
-

0008-fix-CVE-2023-48795.patch

@@ -1,275 +0,0 @@
-From f8a809e46dcf040ffb98a7da355f36fa96f57e38 Mon Sep 17 00:00:00 2001
-From: bwzhang <zhangbowei@kylinos.cn>
-Date: Tue, 26 Mar 2024 16:06:23 +0800
-Subject: [PATCH] fix CVE-2023-48795
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-ssh: implement strict KEX protocol changes
-
-Implement the "strict KEX" protocol changes, as described in section
-1.9 of the OpenSSH PROTOCOL file (as of OpenSSH version 9.6/9.6p1).
-
-Namely this makes the following changes:
-  * Both the server and the client add an additional algorithm to the
-    initial KEXINIT message, indicating support for the strict KEX mode.
-  * When one side of the connection sees the strict KEX extension
-    algorithm, the strict KEX mode is enabled for messages originating
-    from the other side of the connection. If the sequence number for
-    the side which requested the extension is not 1 (indicating that it
-    has already received non-KEXINIT packets), the connection is
-    terminated.
-  * When strict kex mode is enabled, unexpected messages during the
-    handshake are considered fatal. Additionally when a key change
-    occurs (on the receipt of the NEWKEYS message) the message sequence
-    numbers are reset.
-
-Thanks to Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk from Ruhr
-University Bochum for reporting this issue.
-
-Fixes CVE-2023-48795
-Fixes golang/go#64784
-
-Change-Id: I96b53afd2bd2fb94d2b6f2a46a5dacf325357604
-Reviewed-on: https://go-review.googlesource.com/c/crypto/+/550715
-Reviewed-by: Nicola Murino <nicola.murino@gmail.com>
-Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
-TryBot-Result: Gopher Robot <gobot@golang.org>
-Run-TryBot: Roland Shoemaker <roland@golang.org>
-Reviewed-by: Damien Neil <dneil@google.com>
-LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
----
- vendor/golang.org/x/crypto/ssh/handshake.go | 62 ++++++++++++++++++++-
- vendor/golang.org/x/crypto/ssh/transport.go | 32 +++++++++--
- 2 files changed, 87 insertions(+), 7 deletions(-)
-
-diff --git a/vendor/golang.org/x/crypto/ssh/handshake.go b/vendor/golang.org/x/crypto/ssh/handshake.go
-index 2b10b05..1ac7a56 100644
---- a/vendor/golang.org/x/crypto/ssh/handshake.go
-+++ b/vendor/golang.org/x/crypto/ssh/handshake.go
-@@ -34,6 +34,16 @@ type keyingTransport interface {
- 	// direction will be effected if a msgNewKeys message is sent
- 	// or received.
- 	prepareKeyChange(*algorithms, *kexResult) error
-+
-+	// setStrictMode sets the strict KEX mode, notably triggering
-+	// sequence number resets on sending or receiving msgNewKeys.
-+	// If the sequence number is already > 1 when setStrictMode
-+	// is called, an error is returned.
-+	setStrictMode() error
-+
-+	// setInitialKEXDone indicates to the transport that the initial key exchange
-+	// was completed
-+	setInitialKEXDone()
- }
- 
- // handshakeTransport implements rekeying on top of a keyingTransport
-@@ -94,6 +104,10 @@ type handshakeTransport struct {
- 
- 	// The session ID or nil if first kex did not complete yet.
- 	sessionID []byte
-+
-+	// strictMode indicates if the other side of the handshake indicated
-+	// that we should be following the strict KEX protocol restrictions.
-+	strictMode bool
- }
- 
- type pendingKex struct {
-@@ -201,7 +215,10 @@ func (t *handshakeTransport) readLoop() {
- 			close(t.incoming)
- 			break
- 		}
--		if p[0] == msgIgnore || p[0] == msgDebug {
-+		// If this is the first kex, and strict KEX mode is enabled,
-+		// we don't ignore any messages, as they may be used to manipulate
-+		// the packet sequence numbers.
-+		if !(t.sessionID == nil && t.strictMode) && (p[0] == msgIgnore || p[0] == msgDebug) {
- 			continue
- 		}
- 		t.incoming <- p
-@@ -432,6 +449,11 @@ func (t *handshakeTransport) readOnePacket(first bool) ([]byte, error) {
- 	return successPacket, nil
- }
- 
-+const (
-+	kexStrictClient = "kex-strict-c-v00@openssh.com"
-+	kexStrictServer = "kex-strict-s-v00@openssh.com"
-+)
-+
- // sendKexInit sends a key change message.
- func (t *handshakeTransport) sendKexInit() error {
- 	t.mu.Lock()
-@@ -445,7 +467,6 @@ func (t *handshakeTransport) sendKexInit() error {
- 	}
- 
- 	msg := &kexInitMsg{
--		KexAlgos:                t.config.KeyExchanges,
- 		CiphersClientServer:     t.config.Ciphers,
- 		CiphersServerClient:     t.config.Ciphers,
- 		MACsClientServer:        t.config.MACs,
-@@ -455,13 +476,36 @@ func (t *handshakeTransport) sendKexInit() error {
- 	}
- 	io.ReadFull(rand.Reader, msg.Cookie[:])
- 
-+	// We mutate the KexAlgos slice, in order to add the kex-strict extension algorithm,
-+	// and possibly to add the ext-info extension algorithm. Since the slice may be the
-+	// user owned KeyExchanges, we create our own slice in order to avoid using user
-+	// owned memory by mistake.
-+	msg.KexAlgos = make([]string, 0, len(t.config.KeyExchanges)+2) // room for kex-strict and ext-info
-+	msg.KexAlgos = append(msg.KexAlgos, t.config.KeyExchanges...)
-+
- 	if len(t.hostKeys) > 0 {
- 		for _, k := range t.hostKeys {
- 			msg.ServerHostKeyAlgos = append(
- 				msg.ServerHostKeyAlgos, k.PublicKey().Type())
- 		}
-+
-+		if t.sessionID == nil {
-+			msg.KexAlgos = append(msg.KexAlgos, kexStrictServer)
-+		}
- 	} else {
- 		msg.ServerHostKeyAlgos = t.hostKeyAlgorithms
-+
-+		// As a client we opt in to receiving SSH_MSG_EXT_INFO so we know what
-+		// algorithms the server supports for public key authentication. See RFC
-+		// 8308, Section 2.1.
-+		//
-+		// We also send the strict KEX mode extension algorithm, in order to opt
-+		// into the strict KEX mode.
-+		if firstKeyExchange := t.sessionID == nil; firstKeyExchange {
-+			msg.KexAlgos = append(msg.KexAlgos, "ext-info-c")
-+			msg.KexAlgos = append(msg.KexAlgos, kexStrictClient)
-+		}
-+
- 	}
- 	packet := Marshal(msg)
- 
-@@ -557,6 +601,13 @@ func (t *handshakeTransport) enterKeyExchange(otherInitPacket []byte) error {
- 		return err
- 	}
- 
-+	if t.sessionID == nil && ((isClient && contains(serverInit.KexAlgos, kexStrictServer)) || (!isClient && contains(clientInit.KexAlgos, kexStrictClient))) {
-+		t.strictMode = true
-+		if err := t.conn.setStrictMode(); err != nil {
-+			return err
-+		}
-+	}
-+
- 	// We don't send FirstKexFollows, but we handle receiving it.
- 	//
- 	// RFC 4253 section 7 defines the kex and the agreement method for
-@@ -591,6 +642,7 @@ func (t *handshakeTransport) enterKeyExchange(otherInitPacket []byte) error {
- 		return err
- 	}
- 
-+	firstKeyExchange := t.sessionID == nil
- 	if t.sessionID == nil {
- 		t.sessionID = result.H
- 	}
-@@ -608,6 +660,12 @@ func (t *handshakeTransport) enterKeyExchange(otherInitPacket []byte) error {
- 		return unexpectedMessageError(msgNewKeys, packet[0])
- 	}
- 
-+	if firstKeyExchange {
-+		// Indicates to the transport that the first key exchange is completed
-+		// after receiving SSH_MSG_NEWKEYS.
-+		t.conn.setInitialKEXDone()
-+	}
-+
- 	return nil
- }
- 
-diff --git a/vendor/golang.org/x/crypto/ssh/transport.go b/vendor/golang.org/x/crypto/ssh/transport.go
-index 49ddc2e..379e4a8 100644
---- a/vendor/golang.org/x/crypto/ssh/transport.go
-+++ b/vendor/golang.org/x/crypto/ssh/transport.go
-@@ -48,6 +48,9 @@ type transport struct {
- 	rand      io.Reader
- 	isClient  bool
- 	io.Closer
-+
-+	strictMode     bool
-+	initialKEXDone bool
- }
- 
- // packetCipher represents a combination of SSH encryption/MAC
-@@ -73,6 +76,18 @@ type connectionState struct {
- 	pendingKeyChange chan packetCipher
- }
- 
-+func (t *transport) setStrictMode() error {
-+	if t.reader.seqNum != 1 {
-+		return errors.New("ssh: sequence number != 1 when strict KEX mode requested")
-+	}
-+	t.strictMode = true
-+	return nil
-+}
-+
-+func (t *transport) setInitialKEXDone() {
-+	t.initialKEXDone = true
-+}
-+
- // prepareKeyChange sets up key material for a keychange. The key changes in
- // both directions are triggered by reading and writing a msgNewKey packet
- // respectively.
-@@ -111,11 +126,12 @@ func (t *transport) printPacket(p []byte, write bool) {
- // Read and decrypt next packet.
- func (t *transport) readPacket() (p []byte, err error) {
- 	for {
--		p, err = t.reader.readPacket(t.bufReader)
-+		p, err = t.reader.readPacket(t.bufReader, t.strictMode)
- 		if err != nil {
- 			break
- 		}
--		if len(p) == 0 || (p[0] != msgIgnore && p[0] != msgDebug) {
-+		// in strict mode we pass through DEBUG and IGNORE packets only during the initial KEX
-+		if len(p) == 0 || (t.strictMode && !t.initialKEXDone) || (p[0] != msgIgnore && p[0] != msgDebug) {
- 			break
- 		}
- 	}
-@@ -126,7 +142,7 @@ func (t *transport) readPacket() (p []byte, err error) {
- 	return p, err
- }
- 
--func (s *connectionState) readPacket(r *bufio.Reader) ([]byte, error) {
-+func (s *connectionState) readPacket(r *bufio.Reader, strictMode bool) ([]byte, error) {
- 	packet, err := s.packetCipher.readCipherPacket(s.seqNum, r)
- 	s.seqNum++
- 	if err == nil && len(packet) == 0 {
-@@ -139,6 +155,9 @@ func (s *connectionState) readPacket(r *bufio.Reader) ([]byte, error) {
- 			select {
- 			case cipher := <-s.pendingKeyChange:
- 				s.packetCipher = cipher
-+				if strictMode {
-+					s.seqNum = 0
-+				}
- 			default:
- 				return nil, errors.New("ssh: got bogus newkeys message")
- 			}
-@@ -169,10 +188,10 @@ func (t *transport) writePacket(packet []byte) error {
- 	if debugTransport {
- 		t.printPacket(packet, true)
- 	}
--	return t.writer.writePacket(t.bufWriter, t.rand, packet)
-+	return t.writer.writePacket(t.bufWriter, t.rand, packet, t.strictMode)
- }
- 
--func (s *connectionState) writePacket(w *bufio.Writer, rand io.Reader, packet []byte) error {
-+func (s *connectionState) writePacket(w *bufio.Writer, rand io.Reader, packet []byte, strictMode bool) error {
- 	changeKeys := len(packet) > 0 && packet[0] == msgNewKeys
- 
- 	err := s.packetCipher.writeCipherPacket(s.seqNum, w, rand, packet)
-@@ -187,6 +206,9 @@ func (s *connectionState) writePacket(w *bufio.Writer, rand io.Reader, packet []
- 		select {
- 		case cipher := <-s.pendingKeyChange:
- 			s.packetCipher = cipher
-+			if strictMode {
-+				s.seqNum = 0
-+			}
- 		default:
- 			panic("ssh: no key material for msgNewKeys")
- 		}
--- 
-2.20.1
-

0009-fix-CVE-2024-28180.patch

@@ -1,64 +0,0 @@
-From 1c45722eafa2472be93499378135324a6f1514e9 Mon Sep 17 00:00:00 2001
-From: bwzhang <zhangbowei@kylinos.cn>
-Date: Tue, 2 Apr 2024 16:31:36 +0800
-Subject: [PATCH] fix CVE-2024-28180
-
----
- vendor/gopkg.in/square/go-jose.v2/encoding.go | 21 +++++++++++++++----
- 1 file changed, 17 insertions(+), 4 deletions(-)
-
-diff --git a/vendor/gopkg.in/square/go-jose.v2/encoding.go b/vendor/gopkg.in/square/go-jose.v2/encoding.go
-index 70f7385..c31eb91 100644
---- a/vendor/gopkg.in/square/go-jose.v2/encoding.go
-+++ b/vendor/gopkg.in/square/go-jose.v2/encoding.go
-@@ -21,6 +21,7 @@ import (
- 	"compress/flate"
- 	"encoding/base64"
- 	"encoding/binary"
-+	"fmt"
- 	"io"
- 	"math/big"
- 	"strings"
-@@ -85,7 +86,7 @@ func decompress(algorithm CompressionAlgorithm, input []byte) ([]byte, error) {
- 	}
- }
- 
--// Compress with DEFLATE
-+// deflate compresses the input.
- func deflate(input []byte) ([]byte, error) {
- 	output := new(bytes.Buffer)
- 
-@@ -97,15 +98,27 @@ func deflate(input []byte) ([]byte, error) {
- 	return output.Bytes(), err
- }
- 
--// Decompress with DEFLATE
-+// inflate decompresses the input.
-+//
-+// Errors if the decompressed data would be >250kB or >10x the size of the
-+// compressed data, whichever is larger
- func inflate(input []byte) ([]byte, error) {
- 	output := new(bytes.Buffer)
- 	reader := flate.NewReader(bytes.NewBuffer(input))
- 
--	_, err := io.Copy(output, reader)
--	if err != nil {
-+	maxCompressedSize := 10 * int64(len(input))
-+	if maxCompressedSize < 250000 {
-+		maxCompressedSize = 250000
-+	}
-+
-+	limit := maxCompressedSize + 1
-+	n, err := io.CopyN(output, reader, limit)
-+	if err != nil && err != io.EOF {
- 		return nil, err
- 	}
-+	if n == limit {
-+		return nil, fmt.Errorf("uncompressed data would be too large (>%d bytes)", maxCompressedSize)
-+	}
- 
- 	err = reader.Close()
- 	return output.Bytes(), err
--- 
-2.20.1
-

cri-o.spec

@@ -21,7 +21,7 @@
 Name:           cri-o
 Version:        1.23.2
 Epoch:          0
-Release:        12
+Release:        7
 Summary:        Open Container Initiative-based implementation of Kubernetes Container Runtime Interface
 License:        ASL 2.0
 URL:            https://github.com/cri-o/cri-o
@@ -34,15 +34,11 @@ Patch0002:      0002-fix-CVE-2022-4318.patch
 Patch0003:      0003-fix-CVE-2022-0811.patch
 Patch0004:      0004-fix-CVE-2022-1708.patch
 Patch0005:      0005-fix-CVE-2023-39325.patch
-Patch0006:      0006-fix-CVE-2022-41723.patch
-Patch0007:      0007-fix-CVE-2024-24786.patch
-Patch0008:      0008-fix-CVE-2023-48795.patch
-Patch0009:      0009-fix-CVE-2024-28180.patch
 
 ExclusiveArch:  %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}}
 BuildRequires:  golang >= 1.17, git-core, glib2-devel, glibc-static, openEuler-rpm-config
 BuildRequires:  gpgme-devel, libassuan-devel, libseccomp-devel, systemd-devel, make 
-Requires:       container-selinux, containers-common >= 1:0.1.31-14, runc >= 1.0.0-16  
+Requires:       container-selinux, containers-common >= 1:0.1.31-14, docker-runc >= 1.0.0-16  
 Requires:       containernetworking-plugins >= 0.7.5-1, conmon >= 2.0.2-1, socat       
 Obsoletes:      ocid <= 0.3
 Provides:       ocid = %{epoch}:%{version}-%{release}
@@ -168,33 +164,6 @@ install -dp %{buildroot}%{_sharedstatedir}/containers
 %{_datadir}/zsh/site-functions/_%{service_name}*
 
 %changelog
-* Mon Jun 17 2024 duyiwei <duyiwei@kylinos.cn> - 0:1.23.2-12
-- change docker-runc to runc in Requires
-
-* Tue Apr 2 2024 zhangbowei <zhangbowei@kylinos.cn> - 0:1.23.2-11
-- Type:bugfix
-- CVE:NA
-- SUG:NA
-- DESC: CVE-2024-28180
-
-* Mon Apr 1 2024 zhangbowei <zhangbowei@kylinos.cn> - 0:1.23.2-10
-- Type:bugfix
-- CVE:NA
-- SUG:NA
-- DESC: fix CVE-2023-48795
-
-* Mon Apr 1 2024 zhangbowei <zhangbowei@kylinos.cn> - 0:1.23.2-9
-- Type:bugfix
-- CVE:NA
-- SUG:NA
-- DESC: fix CVE-2024-24786
-
-* Mon Apr 1 2024 zhangbowei <zhangbowei@kylinos.cn> - 0:1.23.2-8
-- Type:bugfix
-- CVE:NA
-- SUG:NA
-- DESC: fix CVE-2022-41723
-
 * Mon Apr 1 2024 zhangbowei <zhangbowei@kylinos.cn> - 0:1.23.2-7
 - Type:bugfix
 - CVE:NA