From 5cb1f83ea7d7bb9085e7703b1760021caa755557 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 19 Aug 2026 16:31:12 +0000 Subject: [PATCH] Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context Add patch for CVE-2026-58015 which validates the cookie context in the GDBus SHA-1 authentication mechanism. Without validation, a malicious D-Bus server could send a crafted context containing path traversal characters, allowing exfiltration of SHA-1 hashed copies of arbitrary data from the client's file system. The patch also includes an added `#include ` needed for the `uint8_t` type used in the validation function on the older glib2 2.68.4 codebase. CVE: CVE-2026-58015 Upstream patches: - https://gitlab.gnome.org/GNOME/glib/-/commit/8b72ad09c874ddff122b3e67b3470c5e2eab7690.patch Resolves: RHEL-212262 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- CVE-2026-58015.patch | 87 ++++++++++++++++++++++++++++++++++++++++++++ glib2.spec | 9 ++++- 2 files changed, 95 insertions(+), 1 deletion(-) create mode 100644 CVE-2026-58015.patch diff --git a/CVE-2026-58015.patch b/CVE-2026-58015.patch new file mode 100644 index 0000000..272140c --- /dev/null +++ b/CVE-2026-58015.patch @@ -0,0 +1,87 @@ +From c681e6087c2dfe7788319672ca54c11f59ee8542 Mon Sep 17 00:00:00 2001 +From: Philip Withnall +Date: Tue, 28 Apr 2026 15:47:30 +0100 +Subject: [PATCH] gdbusauthmechanismsha1: Validate cookie context +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Without validation, the server could send a malicious context which +contains path traversal characters, allowing it to exfiltrate a SHA-1 +hashed copy of arbitrary data from the client’s file system. + +To exploit this successfully would require the client to choose to +connect peer-to-peer to a malicious D-Bus server and to choose the SHA-1 +authentication mechanism in preference to all the other mechanisms. This +is vanishingly unlikely. + +Signed-off-by: Philip Withnall + +Fixes: #3931 +--- + gio/gdbusauthmechanismsha1.c | 38 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 38 insertions(+) + +diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c +index 095a6663e..4103d950e 100644 +--- a/gio/gdbusauthmechanismsha1.c ++++ b/gio/gdbusauthmechanismsha1.c +@@ -44,6 +44,8 @@ + + #include "glibintl.h" + ++#include ++ + /* + * Arbitrary timeouts for keys in the keyring. + * For interoperability, these match the reference implementation, libdbus. +@@ -1160,6 +1162,34 @@ mechanism_client_initiate (GDBusAuthMechanism *mechanism, + return initial_response; + } + ++/* Context names must be valid ASCII, nonzero length, and may not contain the ++ * characters slash ("/"), backslash ("\"), space (" "), newline ("\n"), ++ * carriage return ("\r"), tab ("\t"), or period ("."). ++ * ++ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-mechanisms-sha */ ++static gboolean ++validate_cookie_context (const char *cookie_context) ++{ ++ size_t i = 0; ++ ++ g_return_val_if_fail (cookie_context != NULL, FALSE); ++ ++ for (i = 0; cookie_context[i] != '\0'; i++) ++ { ++ if ((uint8_t) cookie_context[i] >= 128 || ++ cookie_context[i] == '/' || ++ cookie_context[i] == '\\' || ++ cookie_context[i] == ' ' || ++ cookie_context[i] == '\n' || ++ cookie_context[i] == '\r' || ++ cookie_context[i] == '\t' || ++ cookie_context[i] == '.') ++ return FALSE; ++ } ++ ++ return (i > 0); ++} ++ + static void + mechanism_client_data_receive (GDBusAuthMechanism *mechanism, + const gchar *data, +@@ -1194,6 +1224,14 @@ mechanism_client_data_receive (GDBusAuthMechanism *mechanism, + } + + cookie_context = tokens[0]; ++ if (!validate_cookie_context (tokens[0])) ++ { ++ g_free (m->priv->reject_reason); ++ m->priv->reject_reason = g_strdup_printf ("Malformed cookie_context '%s'", tokens[0]); ++ m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_REJECTED; ++ goto out; ++ } ++ + cookie_id = g_ascii_strtoll (tokens[1], &endp, 10); + if (*endp != '\0') + { diff --git a/glib2.spec b/glib2.spec index d3b36d9..a6299b9 100644 --- a/glib2.spec +++ b/glib2.spec @@ -1,6 +1,6 @@ Name: glib2 Version: 2.68.4 -Release: 27%{?dist} +Release: 28%{?dist} Summary: A library of handy utility functions License: LGPLv2+ @@ -113,6 +113,9 @@ Patch: CVE-2026-58011.patch # https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5240 Patch: CVE-2026-15588.patch +# https://gitlab.gnome.org/GNOME/glib/-/commit/8b72ad09c874ddff122b3e67b3470c5e2eab7690 +Patch: CVE-2026-58015.patch + BuildRequires: chrpath BuildRequires: gcc BuildRequires: gcc-c++ @@ -334,6 +337,10 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || : %{_datadir}/installed-tests %changelog +* Wed Aug 19 2026 RHEL Packaging Agent - 2.68.4-28 +- Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context + Resolves: RHEL-212262 + * Wed Aug 19 2026 RHEL Packaging Agent - 2.68.4-27 - Fix CVE-2026-15588: limit D-Bus auth line read length Resolves: RHEL-219128