Repository navigation
fix(tesseract): upgrade to 5.5.4 to address CVEs - #19993
Kanishk Bansal (Kanishk-Bansal) wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
There are no active review issues requiring changes.
No open issues 🎉
What changed in this PR
Updates Azure Linux’s Tesseract package from 5.5.3 to 5.5.4 using a pinned Fedora 43 import to address the reported security vulnerabilities.
Changes:
- Moves Tesseract into a dedicated component definition with an explicit upstream pin.
- Refreshes the lock, source checksum, rendered spec, and CMake patch.
- Removes eight CVE backports superseded by the upstream upgrade.
| File | Description |
|---|---|
specs/t/tesseract/tesseract.spec |
Updates version and changelog; removes backport references. |
specs/t/tesseract/tesseract_cmake.patch |
Rebases existing packaging changes onto 5.5.4. |
specs/t/tesseract/sources |
Updates the source archive name and checksum. |
specs/t/tesseract/c94a5532ee04db5a4919542832fd94caee5ea58f.patch |
Removes the superseded CVE-2026-88050 backport. |
specs/t/tesseract/b494ac18925f9d9aff9ef5815475de9943ab19bf.patch |
Removes the superseded CVE-2026-88049 backport. |
specs/t/tesseract/8b0574680f3b22f246ade6a4c8e3029104255c63.patch |
Removes the superseded CVE-2026-88053 backport. |
specs/t/tesseract/56e09ca12e751623fe796ce1554ce704bffd2ef0.patch |
Removes the superseded CVE-2026-88051 backport. |
specs/t/tesseract/552771236b0d80cbdb0c7dd856120fa21a4672e5.patch |
Removes the superseded CVE-2026-88054 backport. |
specs/t/tesseract/2d04d640db2e8c7e3bab2369d599343b5a8b8443.patch |
Removes the superseded CVE-2026-88052 backport. |
specs/t/tesseract/1bda5079b1c8a7e25f523486837426903d29ce84.patch |
Removes the superseded CVE-2026-88047 backport. |
specs/t/tesseract/103dc134eb36411ddc6833ec20aa2c76795bd0ff.patch |
Removes the superseded CVE-2026-88048 backport. |
locks/tesseract.lock |
Refreshes the upstream commit and input hashes. |
base/comps/tesseract/tesseract.comp.toml |
Adds the documented Fedora 43 commit pin. |
base/comps/components.toml |
Removes the inline entry in favor of the dedicated definition. |
Review effort: Balanced
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Kanishk Bansal (Kanishk-Bansal)
added
security
CVE-fixed-by-upgrade
Bump the Fedora f43 dist-git pin to tesseract-5.5.4: https://src.fedoraproject.org/rpms/tesseract/c/5aa55c2e1bff6a48704b98b04b2741a91bd9f188 Addresses 11 CVE(s): CVE-2026-119338, CVE-2026-119339, CVE-2026-119340, CVE-2026-88047, CVE-2026-88048, CVE-2026-88049, CVE-2026-88050, CVE-2026-88051, CVE-2026-88052, CVE-2026-88053, CVE-2026-88054 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
624e35f to
430a8da
Compare
Elaheh Dehghani (ellie-di)
left a comment
Elaheh Dehghani (ellie-di)
left a comment
There was a problem hiding this comment.
LGTM.
| # Pin to Fedora f43 tesseract-5.5.4 to pick up upstream CVE fixes. | ||
| # https://src.fedoraproject.org/rpms/tesseract/c/5aa55c2e1bff6a48704b98b04b2741a91bd9f188 | ||
| [components.tesseract] | ||
| spec = { type = "upstream", upstream-commit = "5aa55c2e1bff6a48704b98b04b2741a91bd9f188" } |
There was a problem hiding this comment.
issue (blocking): please use the full format for specifying which fedora release this is pulled from.
There was a problem hiding this comment.
I was asked to do so in #19970 (comment)
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Christopher Co (christopherco)
left a comment
Christopher Co (christopherco)
left a comment
There was a problem hiding this comment.
Please evaluate backporting the upstream fix for a known OCR crash
|
|
||
| Name: tesseract | ||
| Version: 5.5.3 | ||
| Version: 5.5.4 |
There was a problem hiding this comment.
issue (blocking): Please evaluate backporting the upstream fix for an OCR crash
Raw copilot review feedback
=====
issue (blocking): Include the upstream fix for the runtime-buffer regression in 5.5.4
The new version includes 048e92378f1a34dcdaf94bc515c7552ac01f08ef, which adds a 100,000,000-element limit to GENERIC_2D_ARRAY::ResizeNoInit. This helper also allocates inference and training buffers, not just matrices read from untrusted model files. Requests above the limit silently return without updating the allocation or dimensions, while callers proceed using the requested layout.
Upstream has already fixed this in 8a2cc748331b18579e763ecb9517f93a1fab803f. Its commit message documents a legitimate OCR line requiring 82,200 timesteps x 1,248 features (102,585,600 elements), leaving stale dimensions and aborting in Convolve::Forward / NetworkIO::Randomize. That fix is not included in the 5.5.4 tag, and this PR does not add it.
Please backport the fix through the component overlay and re-render, or select an upstream revision containing it. The fix moves the allocation cap to deserialization while retaining the overflow and negative-size checks; simply removing the security hardening would not be equivalent.
The source trace and upstream fix are verified, but I have not reproduced the failure on an AZL binary. After backporting, please exercise actual OCR and an inference-buffer case above the former limit; tesseract --version does not cover this path. This comment does not claim that a particular stock-model image reproducer or heap-corruption exploit has been established.
There was a problem hiding this comment.
Thanks for catching this. I've backported 8a2cc748 (tesseract#4674) through a patch-add overlay in a new commit, so the element cap now only applies when deserializing untrusted data, and the negative-size and overflow checks are unchanged.
With the stock English model I couldn't push a real OCR run past the old 100M limit, so I tested the matrix code directly against the 5.5.4 sources. Without the backport, a 82,200 x 1,248 resize keeps stale dims; with it, it resizes correctly, while negative sizes, overflowing sizes and crafted model headers on both the TFile and FILE* paths are still rejected. Normal OCR and wide line images also run fine. Details are in the PR description.
Backport upstream 8a2cc748 ("lstm: don't cap legitimate inference
buffers in ResizeNoInit", tesseract-ocr/tesseract#4674).
5.5.4 added a 100M element cap to GENERIC_2D_ARRAY::ResizeNoInit as
part of the CVE-2026-119340 hardening. That helper also sizes trusted
LSTM inference buffers, so a legitimately wide line can leave stale
dimensions and abort OCR. Upstream moved the cap to deserialization of
untrusted model data and kept the negative and overflow checks. The fix
is not in a tagged release yet.
The 5.5.4 upgrade in the previous commit also addresses CVE-2026-119341,
which was not listed in its message.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
/azp run |
|
Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions. |
Summary
Upgrade
tesseractfrom 5.5.3 → 5.5.4 by bumping the Fedora f43 dist-git pin to5aa55c2e1bff.CVEs addressed (12)
CVEs not addressed by this upgrade (0)
None. All open Astrolabe CVEs for this package are addressed.
Changes
base/comps/tesseract/tesseract.comp.toml: pinupstream-commit = 5aa55c2e1bff…(Fedora f43)base/comps/tesseract/overlays/0001-backport-resizenoinit-cap-fix.overlay.toml+base/comps/tesseract/tesseract-lstm-dont-cap-inference-buffers.patch:patch-addbackport of upstream 8a2cc748 (second commit)locks/tesseract.lock: refreshed viaazldev comp update -p tesseractspecs/t/tesseract/: re-rendered (Version 5.5.3 → 5.5.4, Release 7%{?dist} → 8%{?dist})Testing
azldev comp build -p tesseract(x86_64): success (5 RPMs)tesseract-langpack-engreturns the exact text; wide upscaled single-line images (32000x12/8/6) run to completionGENERIC_2D_ARRAYcheck against the 5.5.4 sources, built with each package'slibtesseract:ResizeNoInit(82200, 1248)(102.6M elements, upstream example)ResizeNoInit(10010, 10000)(just above old cap)DeSerialize(TFile*)with 60000x60000 header and tiny payloadDeSerialize(FILE*)with 32768x65535 header and short fileldd: nonot found)azldev comp render/comp updateidempotent on the committed state; commit message passes commitizenNotes for reviewers
GENERIC_2D_ARRAY::ResizeNoInitas part of the CVE hardening, but that helper also sizes trusted LSTM inference buffers, so a legitimately wide line could leave stale dimensions and abort OCR. Upstream moved the cap to deserialization of untrusted data. The fix is not in a tagged release yet, so this overlay can be dropped once we move to a release that contains it.