From 596f606c69e4b593117de897b00c54ce25fd4c9a955da6270903e46b9f755336 Mon Sep 17 00:00:00 2001 From: Christian Wittmer Date: Mon, 24 Feb 2020 17:18:26 +0000 Subject: [PATCH] Accepting request 778853 from home:computersalat:devel:network update to 1.3.6c, fix for boo#1164572 (CVE-2020-9272, gh#902), fix for boo#1164574 (CVE-2020-9273, gh#903) OBS-URL: https://build.opensuse.org/request/show/778853 OBS-URL: https://build.opensuse.org/package/show/network/proftpd?expand=0&rev=76 --- proftpd-1.3.6b.tar.gz | 3 --- proftpd-1.3.6b.tar.gz.asc | 7 ------ proftpd-1.3.6c.tar.gz | 3 +++ proftpd-1.3.6c.tar.gz.asc | 7 ++++++ proftpd-ftpasswd.patch | 2 +- proftpd-no_BuildDate.patch | 10 ++++---- proftpd-tls-crls-issue859.patch | 35 ---------------------------- proftpd.changes | 18 ++++++++++++++ proftpd.spec | 6 +---- proftpd_env-script-interpreter.patch | 2 +- 10 files changed, 36 insertions(+), 57 deletions(-) delete mode 100644 proftpd-1.3.6b.tar.gz delete mode 100644 proftpd-1.3.6b.tar.gz.asc create mode 100644 proftpd-1.3.6c.tar.gz create mode 100644 proftpd-1.3.6c.tar.gz.asc delete mode 100644 proftpd-tls-crls-issue859.patch diff --git a/proftpd-1.3.6b.tar.gz b/proftpd-1.3.6b.tar.gz deleted file mode 100644 index 5457026..0000000 --- a/proftpd-1.3.6b.tar.gz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:fe5baf6c469a2b0b7f0e2611561b6fd5414300e32a76b96adb2ccfe05b5efb60 -size 20260731 diff --git a/proftpd-1.3.6b.tar.gz.asc b/proftpd-1.3.6b.tar.gz.asc deleted file mode 100644 index 36231a6..0000000 --- a/proftpd-1.3.6b.tar.gz.asc +++ /dev/null @@ -1,7 +0,0 @@ ------BEGIN PGP SIGNATURE----- -Comment: GPGTools - https://gpgtools.org - -iEYEABECAAYFAl2rcwQACgkQt46JP6URl2rJjgCg1nlOJXXWDtriYR1VXN6HFoYg -rNwAn1eUP98+weNzMjbHRgnoypjq02WQ -=p339 ------END PGP SIGNATURE----- diff --git a/proftpd-1.3.6c.tar.gz b/proftpd-1.3.6c.tar.gz new file mode 100644 index 0000000..c2c7608 --- /dev/null +++ b/proftpd-1.3.6c.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:fa3541c4b34136a7b80cb12a2f6f9a0cab5118a5b0a1653d40af49c6479c35ad +size 20271908 diff --git a/proftpd-1.3.6c.tar.gz.asc b/proftpd-1.3.6c.tar.gz.asc new file mode 100644 index 0000000..22ded3f --- /dev/null +++ b/proftpd-1.3.6c.tar.gz.asc @@ -0,0 +1,7 @@ +-----BEGIN PGP SIGNATURE----- +Comment: GPGTools - https://gpgtools.org + +iEYEABECAAYFAl5Mn80ACgkQt46JP6URl2o1eQCg48IT2mAbeQwZmAkbEmxGRS7f +nEwAoNGB9stmrqcSqwyivK/AMu2edn59 +=32CO +-----END PGP SIGNATURE----- diff --git a/proftpd-ftpasswd.patch b/proftpd-ftpasswd.patch index 2049125..ab1f366 100644 --- a/proftpd-ftpasswd.patch +++ b/proftpd-ftpasswd.patch @@ -13,7 +13,7 @@ Index: contrib/ftpasswd my $shell_file = "/etc/shells"; my $default_cracklib_dict = "/usr/lib/cracklib_dict"; my $cracklib_dict; -@@ -1109,6 +1109,46 @@ usage: $program [--help] [--hash|--group +@@ -1128,6 +1128,46 @@ usage: $program [--help] [--hash|--group --version Displays the version of $program. diff --git a/proftpd-no_BuildDate.patch b/proftpd-no_BuildDate.patch index 3eff091..a8fd04d 100644 --- a/proftpd-no_BuildDate.patch +++ b/proftpd-no_BuildDate.patch @@ -65,13 +65,13 @@ Index: include/version.h -#include "buildstamp.h" - /* Application version (in various forms) */ - #define PROFTPD_VERSION_NUMBER 0x0001030607 - #define PROFTPD_VERSION_TEXT "1.3.6b" + #define PROFTPD_VERSION_NUMBER 0x0001030608 + #define PROFTPD_VERSION_TEXT "1.3.6c" Index: src/main.c =================================================================== --- src/main.c.orig +++ src/main.c -@@ -1891,8 +1891,8 @@ static void standalone_main(void) { +@@ -1893,8 +1893,8 @@ static void standalone_main(void) { init_bindings(); @@ -82,7 +82,7 @@ Index: src/main.c if (pr_pidfile_write() < 0) { fprintf(stderr, "error opening PidFile '%s': %s\n", pr_pidfile_get(), -@@ -1952,7 +1952,6 @@ static void show_settings(void) { +@@ -1954,7 +1954,6 @@ static void show_settings(void) { printf("%s", " Platform: " PR_PLATFORM " [unknown]\n"); #endif /* !HAVE_UNAME */ @@ -90,7 +90,7 @@ Index: src/main.c printf("%s", " Built With:\n configure " PR_BUILD_OPTS "\n\n"); printf("%s", " CFLAGS: " PR_BUILD_CFLAGS "\n"); -@@ -2532,7 +2531,6 @@ int main(int argc, char *argv[], char ** +@@ -2534,7 +2533,6 @@ int main(int argc, char *argv[], char ** printf("ProFTPD Version: %s", PROFTPD_VERSION_TEXT " " PR_STATUS "\n"); printf(" Scoreboard Version: %08x\n", PR_SCOREBOARD_VERSION); diff --git a/proftpd-tls-crls-issue859.patch b/proftpd-tls-crls-issue859.patch deleted file mode 100644 index 98ccc98..0000000 --- a/proftpd-tls-crls-issue859.patch +++ /dev/null @@ -1,35 +0,0 @@ -commit 81cc5dce4fc0285629a1b08a07a109af10c208dd -Author: TJ Saunders -Date: Sun Nov 24 14:03:54 2019 -0800 - - Issue #859, #861: Fix handling of CRL lookups by properly using issuer for - lookups, and guarding against null pointers. - (CVE-2019-19269, CVE-2019-19270) - -diff --git a/contrib/mod_tls.c b/contrib/mod_tls.c -index 4b74cf989..0e08b0399 100644 ---- a/contrib/mod_tls.c -+++ b/contrib/mod_tls.c -@@ -9777,10 +9777,10 @@ static int tls_verify_crl(int ok, X509_STORE_CTX *ctx) { - - #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \ - !defined(HAVE_LIBRESSL) -- crls = X509_STORE_CTX_get1_crls(store_ctx, subject); -+ crls = X509_STORE_CTX_get1_crls(store_ctx, issuer); - #elif OPENSSL_VERSION_NUMBER >= 0x10000000L && \ - !defined(HAVE_LIBRESSL) -- crls = X509_STORE_get1_crls(store_ctx, subject); -+ crls = X509_STORE_get1_crls(store_ctx, issuer); - #else - /* Your OpenSSL is before 1.0.0. You really need to upgrade. */ - crls = NULL; -@@ -9799,6 +9799,9 @@ static int tls_verify_crl(int ok, X509_STORE_CTX *ctx) { - ASN1_INTEGER *sn; - - revoked = sk_X509_REVOKED_value(X509_CRL_get_REVOKED(crl), j); -+ if (revoked == NULL) { -+ continue; -+ } - #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \ - !defined(HAVE_LIBRESSL) - sn = X509_REVOKED_get0_serialNumber(revoked); diff --git a/proftpd.changes b/proftpd.changes index 5a75702..f20c8f8 100644 --- a/proftpd.changes +++ b/proftpd.changes @@ -1,3 +1,21 @@ +------------------------------------------------------------------- +Mon Feb 24 17:06:07 UTC 2020 - chris@computersalat.de + +- fix for boo#1164572 (CVE-2020-9272, gh#902) +- fix for boo#1164574 (CVE-2020-9273, gh#903) +- update to 1.3.6c + * Fixed regression in directory listing latency (Issue #863). + * Detect OpenSSH-specific formatted SFTPHostKeys, and log hint for + converting them to supported format. + * Fixed use-after-free vulnerability during data transfers (Issue #903). + * Fixed out-of-bounds read in mod_cap by updating the bundled libcap + (Issue #902). +- remove obsolete proftpd-tls-crls-issue859.patch +- rebase patches + * proftpd-ftpasswd.patch + * proftpd-no_BuildDate.patch + * proftpd_env-script-interpreter.patch + ------------------------------------------------------------------- Sat Feb 1 17:25:05 UTC 2020 - chris@computersalat.de diff --git a/proftpd.spec b/proftpd.spec index c7507f9..b4cc19a 100644 --- a/proftpd.spec +++ b/proftpd.spec @@ -22,7 +22,7 @@ Summary: Configurable GPL-licensed FTP server software # We only accept updates for "STABLE" Versions License: GPL-2.0-or-later Group: Productivity/Networking/Ftp/Servers -Version: 1.3.6b +Version: 1.3.6c Release: 0 URL: http://www.proftpd.org/ Source0: ftp://ftp.proftpd.org/distrib/source/%{name}-%{version}.tar.gz @@ -47,8 +47,6 @@ Patch103: %{name}-strip.patch Patch104: %{name}-no_BuildDate.patch #RPMLINT-FIX-openSUSE: env-script-interpreter Patch105: %{name}_env-script-interpreter.patch -#PATCH-FIX-UPSTREAM: (CVE-2019-19269, CVE-2019-19270) -Patch200: %{name}-tls-crls-issue859.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build #BuildRequires: gpg-offline BuildRequires: fdupes @@ -157,8 +155,6 @@ rm README.AIX %patch104 %patch105 -%patch200 -p1 - %build rm contrib/mod_wrap.c rm contrib/mod_geoip.c diff --git a/proftpd_env-script-interpreter.patch b/proftpd_env-script-interpreter.patch index 432a7b6..1091106 100644 --- a/proftpd_env-script-interpreter.patch +++ b/proftpd_env-script-interpreter.patch @@ -6,7 +6,7 @@ Index: contrib/ftpasswd -#!/usr/bin/env perl +#!/usr/bin/perl # --------------------------------------------------------------------------- - # Copyright (C) 2000-2015 TJ Saunders + # Copyright (C) 2000-2020 TJ Saunders # Index: contrib/ftpmail ===================================================================