Compare commits
6 Commits
| Author | SHA256 | Date | |
|---|---|---|---|
| 8b3f1bf104 | |||
| 97287cf8ed | |||
| b09866b593 | |||
| 098931cefc | |||
| babcb9e418 | |||
| 5d2cda5420 |
97
libsoup-CVE-2025-4945.patch
Normal file
97
libsoup-CVE-2025-4945.patch
Normal file
@@ -0,0 +1,97 @@
|
||||
Backport of https://gitlab.gnome.org/GNOME/libsoup/-/commit/8988379984e33dcc7d3aa58551db13e48755959f
|
||||
|
||||
diff -urp libsoup-2.74.3.orig/libsoup/soup-date.c libsoup-2.74.3/libsoup/soup-date.c
|
||||
--- libsoup-2.74.3.orig/libsoup/soup-date.c 2022-10-11 13:27:22.000000000 -0500
|
||||
+++ libsoup-2.74.3/libsoup/soup-date.c 2025-06-18 11:56:02.916383979 -0500
|
||||
@@ -284,7 +284,7 @@ parse_day (SoupDate *date, const char **
|
||||
while (*end == ' ' || *end == '-')
|
||||
end++;
|
||||
*date_string = end;
|
||||
- return TRUE;
|
||||
+ return date->day >= 1 && date->day <= 31;
|
||||
}
|
||||
|
||||
static inline gboolean
|
||||
@@ -324,7 +324,7 @@ parse_year (SoupDate *date, const char *
|
||||
while (*end == ' ' || *end == '-')
|
||||
end++;
|
||||
*date_string = end;
|
||||
- return TRUE;
|
||||
+ return date->year > 0 && date->year < 9999;
|
||||
}
|
||||
|
||||
static inline gboolean
|
||||
@@ -348,7 +348,7 @@ parse_time (SoupDate *date, const char *
|
||||
while (*p == ' ')
|
||||
p++;
|
||||
*date_string = p;
|
||||
- return TRUE;
|
||||
+ return date->hour >= 0 && date->hour < 24 && date->minute >= 0 && date->minute < 60 && date->second >= 0 && date->second < 60;
|
||||
}
|
||||
|
||||
static inline gboolean
|
||||
@@ -361,9 +361,14 @@ parse_timezone (SoupDate *date, const ch
|
||||
gulong val;
|
||||
int sign = (**date_string == '+') ? -1 : 1;
|
||||
val = strtoul (*date_string + 1, (char **)date_string, 10);
|
||||
- if (**date_string == ':')
|
||||
- val = 60 * val + strtoul (*date_string + 1, (char **)date_string, 10);
|
||||
- else
|
||||
+ if (val > 9999)
|
||||
+ return FALSE;
|
||||
+ if (**date_string == ':') {
|
||||
+ gulong val2 = strtoul (*date_string + 1, (char **)date_string, 10);
|
||||
+ if (val > 99 || val2 > 99)
|
||||
+ return FALSE;
|
||||
+ val = 60 * val + val2;
|
||||
+ } else
|
||||
val = 60 * (val / 100) + (val % 100);
|
||||
date->offset = sign * val;
|
||||
date->utc = (sign == -1) && !val;
|
||||
@@ -407,7 +412,8 @@ parse_textual_date (SoupDate *date, cons
|
||||
if (!parse_month (date, &date_string) ||
|
||||
!parse_day (date, &date_string) ||
|
||||
!parse_time (date, &date_string) ||
|
||||
- !parse_year (date, &date_string))
|
||||
+ !parse_year (date, &date_string) ||
|
||||
+ !g_date_valid_dmy (date->day, date->month, date->year))
|
||||
return FALSE;
|
||||
|
||||
/* There shouldn't be a timezone, but check anyway */
|
||||
@@ -419,7 +425,8 @@ parse_textual_date (SoupDate *date, cons
|
||||
if (!parse_day (date, &date_string) ||
|
||||
!parse_month (date, &date_string) ||
|
||||
!parse_year (date, &date_string) ||
|
||||
- !parse_time (date, &date_string))
|
||||
+ !parse_time (date, &date_string) ||
|
||||
+ !g_date_valid_dmy (date->day, date->month, date->year))
|
||||
return FALSE;
|
||||
|
||||
/* This time there *should* be a timezone, but we
|
||||
diff -urp libsoup-2.74.3.orig/tests/cookies-test.c libsoup-2.74.3/tests/cookies-test.c
|
||||
--- libsoup-2.74.3.orig/tests/cookies-test.c 2022-10-11 13:27:22.000000000 -0500
|
||||
+++ libsoup-2.74.3/tests/cookies-test.c 2025-06-18 11:13:49.363862484 -0500
|
||||
@@ -389,6 +389,15 @@ send_callback (GObject *source_object,
|
||||
}
|
||||
|
||||
static void
|
||||
+do_cookies_parsing_int32_overflow (void)
|
||||
+{
|
||||
+ SoupCookie *cookie = soup_cookie_parse ("Age=1;expires=3Mar9 999:9:9+ 999999999-age=main=gne=", NULL);
|
||||
+ g_assert_nonnull (cookie);
|
||||
+ g_assert_null (soup_cookie_get_expires (cookie));
|
||||
+ soup_cookie_free (cookie);
|
||||
+}
|
||||
+
|
||||
+static void
|
||||
do_remove_feature_test (void)
|
||||
{
|
||||
SoupSession *session;
|
||||
@@ -434,6 +443,7 @@ main (int argc, char **argv)
|
||||
g_test_add_func ("/cookies/accept-policy-subdomains", do_cookies_subdomain_policy_test);
|
||||
g_test_add_func ("/cookies/parsing", do_cookies_parsing_test);
|
||||
g_test_add_func ("/cookies/parsing/no-path-null-origin", do_cookies_parsing_nopath_nullorigin);
|
||||
+ g_test_add_func ("/cookies/parsing/int32-overflow", do_cookies_parsing_int32_overflow);
|
||||
g_test_add_func ("/cookies/get-cookies/empty-host", do_get_cookies_empty_host_test);
|
||||
g_test_add_func ("/cookies/remove-feature", do_remove_feature_test);
|
||||
g_test_add_func ("/cookies/secure-cookies", do_cookies_strict_secure_test);
|
||||
125
libsoup2-CVE-2025-14523.patch
Normal file
125
libsoup2-CVE-2025-14523.patch
Normal file
@@ -0,0 +1,125 @@
|
||||
From ff8829d85b5903d16c4b284ccc75977af20da9ba Mon Sep 17 00:00:00 2001
|
||||
From: Alynx Zhou <alynx.zhou@gmail.com>
|
||||
Date: Thu, 8 Jan 2026 13:05:33 +0800
|
||||
Subject: [PATCH] Reject duplicate Host headers
|
||||
|
||||
---
|
||||
libsoup/soup-headers.c | 4 +++-
|
||||
libsoup/soup-message-headers-private.h | 10 ++++++++++
|
||||
libsoup/soup-message-headers.c | 27 ++++++++++++++++++++------
|
||||
3 files changed, 34 insertions(+), 7 deletions(-)
|
||||
create mode 100644 libsoup/soup-message-headers-private.h
|
||||
|
||||
diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
|
||||
index cc481cfa..b58f3855 100644
|
||||
--- a/libsoup/soup-headers.c
|
||||
+++ b/libsoup/soup-headers.c
|
||||
@@ -14,6 +14,7 @@
|
||||
|
||||
#include "soup-headers.h"
|
||||
#include "soup.h"
|
||||
+#include "soup-message-headers-private.h"
|
||||
|
||||
/**
|
||||
* soup_headers_parse:
|
||||
@@ -138,7 +139,8 @@ soup_headers_parse (const char *str, int len, SoupMessageHeaders *dest)
|
||||
for (p = strchr (value, '\r'); p; p = strchr (p, '\r'))
|
||||
*p = ' ';
|
||||
|
||||
- soup_message_headers_append (dest, name, value);
|
||||
+ if (!soup_message_headers_append_internal (dest, name, value))
|
||||
+ goto done;
|
||||
}
|
||||
success = TRUE;
|
||||
|
||||
diff --git a/libsoup/soup-message-headers-private.h b/libsoup/soup-message-headers-private.h
|
||||
new file mode 100644
|
||||
index 00000000..62a4e511
|
||||
--- /dev/null
|
||||
+++ b/libsoup/soup-message-headers-private.h
|
||||
@@ -0,0 +1,10 @@
|
||||
+#ifndef __SOUP_MESSAGE_HEADERS_PRIVATE_H__
|
||||
+#define __SOUP_MESSAGE_HEADERS_PRIVATE_H__ 1
|
||||
+
|
||||
+#include "soup-message-headers.h"
|
||||
+
|
||||
+gboolean
|
||||
+soup_message_headers_append_internal (SoupMessageHeaders *hdrs,
|
||||
+ const char *name, const char *value);
|
||||
+
|
||||
+#endif
|
||||
diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
|
||||
index 39ad14a0..160a52dc 100644
|
||||
--- a/libsoup/soup-message-headers.c
|
||||
+++ b/libsoup/soup-message-headers.c
|
||||
@@ -13,6 +13,7 @@
|
||||
|
||||
#include "soup-message-headers.h"
|
||||
#include "soup.h"
|
||||
+#include "soup-message-headers-private.h"
|
||||
#include "soup-misc-private.h"
|
||||
|
||||
/**
|
||||
@@ -194,12 +195,20 @@ soup_message_headers_clean_connection_headers (SoupMessageHeaders *hdrs)
|
||||
void
|
||||
soup_message_headers_append (SoupMessageHeaders *hdrs,
|
||||
const char *name, const char *value)
|
||||
+{
|
||||
+ soup_message_headers_append_internal (hdrs, name, value);
|
||||
+}
|
||||
+
|
||||
+gboolean
|
||||
+soup_message_headers_append_internal (SoupMessageHeaders *hdrs,
|
||||
+ const char *name, const char *value)
|
||||
{
|
||||
SoupHeader header;
|
||||
SoupHeaderSetter setter;
|
||||
+ const char *interned_host = intern_header_name ("Host", NULL);
|
||||
|
||||
- g_return_if_fail (name != NULL);
|
||||
- g_return_if_fail (value != NULL);
|
||||
+ g_return_val_if_fail (name != NULL, FALSE);
|
||||
+ g_return_val_if_fail (value != NULL, FALSE);
|
||||
|
||||
/* Setting a syntactically invalid header name or value is
|
||||
* considered to be a programming error. However, it can also
|
||||
@@ -207,26 +216,32 @@ soup_message_headers_append (SoupMessageHeaders *hdrs,
|
||||
* compiled with G_DISABLE_CHECKS.
|
||||
*/
|
||||
#ifndef G_DISABLE_CHECKS
|
||||
- g_return_if_fail (*name && strpbrk (name, " \t\r\n:") == NULL);
|
||||
- g_return_if_fail (strpbrk (value, "\r\n") == NULL);
|
||||
+ g_return_val_if_fail (*name && strpbrk (name, " \t\r\n:") == NULL, FALSE);
|
||||
+ g_return_val_if_fail (strpbrk (value, "\r\n") == NULL, FALSE);
|
||||
#else
|
||||
if (*name && strpbrk (name, " \t\r\n:")) {
|
||||
g_warning ("soup_message_headers_append: Ignoring bad name '%s'", name);
|
||||
- return;
|
||||
+ return FALSE;
|
||||
}
|
||||
if (strpbrk (value, "\r\n")) {
|
||||
g_warning ("soup_message_headers_append: Ignoring bad value '%s'", value);
|
||||
- return;
|
||||
+ return FALSE;
|
||||
}
|
||||
#endif
|
||||
|
||||
header.name = intern_header_name (name, &setter);
|
||||
+ if (header.name == interned_host && soup_message_headers_get_one(hdrs, "Host")) {
|
||||
+ g_warning ("Attempted to add duplicate Host header to a SoupMessageHeaders that already contains a Host header");
|
||||
+ return FALSE;
|
||||
+ }
|
||||
header.value = g_strdup (value);
|
||||
g_array_append_val (hdrs->array, header);
|
||||
if (hdrs->concat)
|
||||
g_hash_table_remove (hdrs->concat, header.name);
|
||||
if (setter)
|
||||
setter (hdrs, header.value);
|
||||
+
|
||||
+ return TRUE;
|
||||
}
|
||||
|
||||
/**
|
||||
--
|
||||
2.52.0
|
||||
|
||||
50
libsoup2-CVE-2026-0719.patch
Normal file
50
libsoup2-CVE-2026-0719.patch
Normal file
@@ -0,0 +1,50 @@
|
||||
diff --unified --recursive --text --new-file --color libsoup-2.74.3/libsoup/soup-auth-ntlm.c libsoup-2.74.3.new/libsoup/soup-auth-ntlm.c
|
||||
--- libsoup-2.74.3/libsoup/soup-auth-ntlm.c 2022-10-12 02:27:22.000000000 +0800
|
||||
+++ libsoup-2.74.3.new/libsoup/soup-auth-ntlm.c 2026-01-12 10:26:03.168118541 +0800
|
||||
@@ -594,7 +594,7 @@
|
||||
}
|
||||
|
||||
static void md4sum (const unsigned char *in,
|
||||
- int nbytes,
|
||||
+ size_t nbytes,
|
||||
unsigned char digest[16]);
|
||||
|
||||
typedef guint32 DES_KS[16][2]; /* Single-key DES key schedule */
|
||||
@@ -640,7 +640,7 @@
|
||||
{
|
||||
unsigned char *buf, *p;
|
||||
|
||||
- p = buf = g_malloc (strlen (password) * 2);
|
||||
+ p = buf = g_malloc_n (strlen (password), 2);
|
||||
|
||||
while (*password) {
|
||||
*p++ = *password++;
|
||||
@@ -1079,15 +1079,16 @@
|
||||
#define ROT(val, n) ( ((val) << (n)) | ((val) >> (32 - (n))) )
|
||||
|
||||
static void
|
||||
-md4sum (const unsigned char *in, int nbytes, unsigned char digest[16])
|
||||
+md4sum (const unsigned char *in, size_t nbytes, unsigned char digest[16])
|
||||
{
|
||||
unsigned char *M;
|
||||
guint32 A, B, C, D, AA, BB, CC, DD, X[16];
|
||||
- int pbytes, nbits = nbytes * 8, i, j;
|
||||
+ size_t pbytes, nbits = nbytes * 8;
|
||||
+ int i, j;
|
||||
|
||||
/* There is *always* padding of at least one bit. */
|
||||
pbytes = ((119 - (nbytes % 64)) % 64) + 1;
|
||||
- M = alloca (nbytes + pbytes + 8);
|
||||
+ M = g_malloc (nbytes + pbytes + 8);
|
||||
memcpy (M, in, nbytes);
|
||||
memset (M + nbytes, 0, pbytes + 8);
|
||||
M[nbytes] = 0x80;
|
||||
@@ -1187,6 +1188,8 @@
|
||||
digest[13] = (D >> 8) & 0xFF;
|
||||
digest[14] = (D >> 16) & 0xFF;
|
||||
digest[15] = (D >> 24) & 0xFF;
|
||||
+
|
||||
+ g_free (M);
|
||||
}
|
||||
|
||||
|
||||
@@ -1,3 +1,21 @@
|
||||
-------------------------------------------------------------------
|
||||
Fri Jan 9 02:52:21 UTC 2026 - Alynx Zhou <alynx.zhou@suse.com>
|
||||
|
||||
- Add libsoup2-CVE-2026-0719.patch: Fix overflow for password
|
||||
md4sum (bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493).
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jan 8 05:11:30 UTC 2026 - Alynx Zhou <alynx.zhou@suse.com>
|
||||
|
||||
- Add libsoup2-CVE-2025-14523.patch: Reject duplicated Host in
|
||||
headers (bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491).
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Jun 18 16:47:42 UTC 2025 - Michael Gorse <mgorse@suse.com>
|
||||
|
||||
- Add libsoup-CVE-2025-4945.patch: add value checks for date/time
|
||||
parsing (boo#1243314 CVE-2025-4945).
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed May 28 21:28:03 UTC 2025 - Michael Gorse <mgorse@suse.com>
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#
|
||||
# spec file for package libsoup2
|
||||
#
|
||||
# Copyright (c) 2025 SUSE LLC
|
||||
# Copyright (c) 2026 SUSE LLC
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
@@ -78,6 +78,12 @@ Patch24: libsoup-CVE-2025-32909.patch
|
||||
Patch25: libsoup-CVE-2025-4948.patch
|
||||
# PATCH-FIX-UPSTREAM libsoup-CVE-2025-4969.patch boo#1243423 mgorse@suse.com -- soup-multipart: Verify array bounds before accessing its members.
|
||||
Patch26: libsoup-CVE-2025-4969.patch
|
||||
# PATCH-FIX-UPSTREAM libsoup-CVE-2025-4945.patch boo#1243314 mgorse@suse.com -- add value checks for date/time parsing.
|
||||
Patch27: libsoup-CVE-2025-4945.patch
|
||||
# PATCH-FIX-UPSTREAM libsoup2-CVE-2025-14523.patch bsc#1254876, CVE-2025-14523, glgo#GNOME/libsoup!491 alynx.zhou@suse.com -- Reject duplicated Host in headers
|
||||
Patch28: libsoup2-CVE-2025-14523.patch
|
||||
# PATCH-FIX-UPSTREAM libsoup2-CVE-2026-0719.patch bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493 alynx.zhou@suse.com -- Fix overflow for password md4sum
|
||||
Patch29: libsoup2-CVE-2026-0719.patch
|
||||
|
||||
BuildRequires: glib-networking
|
||||
BuildRequires: meson >= 0.50
|
||||
|
||||
Reference in New Issue
Block a user