rpms/glib2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context

Browse Source 
Add a backport of upstream commit 8b72ad09 which fixes
CVE-2026-58015 by validating D-Bus cookie context names
in gdbusauthmechanismsha1. The new validate_cookie_context()
function rejects contexts containing non-ASCII characters or
path traversal characters (/, \, .) before they can be used
for file path construction.

The patch was adapted for the older GLib 2.56.4 codebase:
uint8_t cast replaced with guint8, and reject_reason usage
replaced with g_warning() to avoid pulling in a separate
upstream prerequisite commit.

CVE: CVE-2026-58015
Upstream patches:
 - 8b72ad09c8.patch
Resolves: RHEL-212254

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-20 07:20:19 +00:00
parent b202462ce6
commit a0bcad8847
2 changed files with 82 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
CVE-2026-58015.patch Normal file
View File

@ -0,0 +1,74 @@
From 2f486f021aa46d172c7c7e8eef60dc7e22ad49f2 Mon Sep 17 00:00:00 2001
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
Date: Mon, 20 Jul 2026 07:02:12 +0000
Subject: [PATCH] gdbusauthmechanismsha1: Validate cookie context
Without validation, the server could send a malicious context which
contains path traversal characters, allowing it to exfiltrate a SHA-1
hashed copy of arbitrary data from the client's file system.
To exploit this successfully would require the client to choose to
connect peer-to-peer to a malicious D-Bus server and to choose the SHA-1
authentication mechanism in preference to all the other mechanisms. This
is vanishingly unlikely.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3931
---
gio/gdbusauthmechanismsha1.c | 35 +++++++++++++++++++++++++++++++++++
1 file changed, 35 insertions(+)
diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
index 0cbaf946d..85fb5edc8 100644
--- a/gio/gdbusauthmechanismsha1.c
+++ b/gio/gdbusauthmechanismsha1.c
@@ -1130,6 +1130,34 @@ initial_response = _g_dbus_win32_get_user_sid ();
return initial_response;
}
+/* Context names must be valid ASCII, nonzero length, and may not contain the
+ * characters slash ("/"), backslash ("\"), space (" "), newline ("\n"),
+ * carriage return ("\r"), tab ("\t"), or period (".").
+ *
+ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-mechanisms-sha */
+static gboolean
+validate_cookie_context (const char *cookie_context)
+{
+ size_t i = 0;
+
+ g_return_val_if_fail (cookie_context != NULL, FALSE);
+
+ for (i = 0; cookie_context[i] != '\0'; i++)
+ {
+ if ((guint8) cookie_context[i] >= 128 ||
+ cookie_context[i] == '/' ||
+ cookie_context[i] == '\\' ||
+ cookie_context[i] == ' ' ||
+ cookie_context[i] == '\n' ||
+ cookie_context[i] == '\r' ||
+ cookie_context[i] == '\t' ||
+ cookie_context[i] == '.')
+ return FALSE;
+ }
+
+ return (i > 0);
+}
+
static void
mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
const gchar *data,
@@ -1163,6 +1191,13 @@ mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
}
cookie_context = tokens[0];
+ if (!validate_cookie_context (tokens[0]))
+ {
+ g_warning ("Malformed cookie_context '%s'", tokens[0]);
+ m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_REJECTED;
+ goto out;
+ }
+
cookie_id = g_ascii_strtoll (tokens[1], &endp, 10);
if (*endp != '\0')
{

9
glib2.spec
View File

@ -5,7 +5,7 @@
Name: glib2
Version: 2.56.4
Release: 171%{?dist}
Release: 172%{?dist}
Summary: A library of handy utility functions
License: LGPLv2+
@ -175,6 +175,9 @@ Patch36: CVE-2026-58016.patch
# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5171
Patch37: CVE-2026-58014.patch
# https://gitlab.gnome.org/GNOME/glib/-/commit/8b72ad09c874ddff122b3e67b3470c5e2eab7690
Patch38: CVE-2026-58015.patch
%description
GLib is the low-level core library that forms the basis for projects
such as GTK+ and GNOME. It provides data structure handling for C,
@ -375,6 +378,10 @@ make %{?_smp_mflags} check
%{_datadir}/installed-tests
%changelog
* Mon Jul 20 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.56.4-172
- Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context
- Resolves: RHEL-212254
* Sun Jul 12 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.56.4-171
- Fix one-byte heap under-read in g_key_file_get_locale_string_list()
- Resolves: RHEL-190587