rpms/glib2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context

Browse Source 
Add patch for CVE-2026-58015 which validates the cookie context
in the GDBus SHA-1 authentication mechanism. Without validation,
a malicious D-Bus server could send a crafted context containing
path traversal characters, allowing exfiltration of SHA-1 hashed
copies of arbitrary data from the client's file system. The patch
also includes an added `#include <stdint.h>` needed for the
`uint8_t` type used in the validation function on the older
glib2 2.68.4 codebase.

CVE: CVE-2026-58015
Upstream patches:
 - 8b72ad09c8.patch
Resolves: RHEL-212262

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-19 16:31:12 +00:00
parent a06b1ba6d5
commit 5cb1f83ea7
2 changed files with 95 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
CVE-2026-58015.patch Normal file
View File

@ -0,0 +1,87 @@
From c681e6087c2dfe7788319672ca54c11f59ee8542 Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Tue, 28 Apr 2026 15:47:30 +0100
Subject: [PATCH] gdbusauthmechanismsha1: Validate cookie context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Without validation, the server could send a malicious context which
contains path traversal characters, allowing it to exfiltrate a SHA-1
hashed copy of arbitrary data from the client’s file system.
To exploit this successfully would require the client to choose to
connect peer-to-peer to a malicious D-Bus server and to choose the SHA-1
authentication mechanism in preference to all the other mechanisms. This
is vanishingly unlikely.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3931
---
gio/gdbusauthmechanismsha1.c | 38 ++++++++++++++++++++++++++++++++++++
1 file changed, 38 insertions(+)
diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
index 095a6663e..4103d950e 100644
--- a/gio/gdbusauthmechanismsha1.c
+++ b/gio/gdbusauthmechanismsha1.c
@@ -44,6 +44,8 @@
#include "glibintl.h"
+#include <stdint.h>
+
/*
* Arbitrary timeouts for keys in the keyring.
* For interoperability, these match the reference implementation, libdbus.
@@ -1160,6 +1162,34 @@ mechanism_client_initiate (GDBusAuthMechanism *mechanism,
return initial_response;
}
+/* Context names must be valid ASCII, nonzero length, and may not contain the
+ * characters slash ("/"), backslash ("\"), space (" "), newline ("\n"),
+ * carriage return ("\r"), tab ("\t"), or period (".").
+ *
+ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-mechanisms-sha */
+static gboolean
+validate_cookie_context (const char *cookie_context)
+{
+ size_t i = 0;
+
+ g_return_val_if_fail (cookie_context != NULL, FALSE);
+
+ for (i = 0; cookie_context[i] != '\0'; i++)
+ {
+ if ((uint8_t) cookie_context[i] >= 128 ||
+ cookie_context[i] == '/' ||
+ cookie_context[i] == '\\' ||
+ cookie_context[i] == ' ' ||
+ cookie_context[i] == '\n' ||
+ cookie_context[i] == '\r' ||
+ cookie_context[i] == '\t' ||
+ cookie_context[i] == '.')
+ return FALSE;
+ }
+
+ return (i > 0);
+}
+
static void
mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
const gchar *data,
@@ -1194,6 +1224,14 @@ mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
}
cookie_context = tokens[0];
+ if (!validate_cookie_context (tokens[0]))
+ {
+ g_free (m->priv->reject_reason);
+ m->priv->reject_reason = g_strdup_printf ("Malformed cookie_context '%s'", tokens[0]);
+ m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_REJECTED;
+ goto out;
+ }
+
cookie_id = g_ascii_strtoll (tokens[1], &endp, 10);
if (*endp != '\0')
{

9
glib2.spec
View File

@ -1,6 +1,6 @@
Name: glib2
Version: 2.68.4
Release: 27%{?dist}
Release: 28%{?dist}
Summary: A library of handy utility functions
License: LGPLv2+
@ -113,6 +113,9 @@ Patch: CVE-2026-58011.patch
# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5240
Patch: CVE-2026-15588.patch
# https://gitlab.gnome.org/GNOME/glib/-/commit/8b72ad09c874ddff122b3e67b3470c5e2eab7690
Patch: CVE-2026-58015.patch
BuildRequires: chrpath
BuildRequires: gcc
BuildRequires: gcc-c++
@ -334,6 +337,10 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
%{_datadir}/installed-tests
%changelog
* Wed Aug 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.68.4-28
- Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context
Resolves: RHEL-212262
* Wed Aug 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.68.4-27
- Fix CVE-2026-15588: limit D-Bus auth line read length
Resolves: RHEL-219128