rpms/glib2
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context

Browse Source 
Backport upstream commit 8b72ad09c874ddff to fix
CVE-2026-58015, a path traversal vulnerability in D-Bus
SHA-1 authentication. The patch adds validation of the
cookie context sent by the server, preventing exfiltration
of SHA-1 hashed copies of arbitrary files from the client's
filesystem. The upstream patch was adjusted to use guint8
instead of uint8_t for compatibility with the existing
GLib headers.

CVE: CVE-2026-58015
Upstream patches:
 - 8b72ad09c8.patch
Resolves: RHEL-212242

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-08-20 21:14:51 +00:00
parent 86c7bda4b6
commit d37e0dee7b
2 changed files with 81 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
CVE-2026-58015.patch Normal file
View File

@ -0,0 +1,78 @@
From e4c26829c2aff91f4f6998243028e0f29c5fb807 Mon Sep 17 00:00:00 2001
From: Philip Withnall <pwithnall@gnome.org>
Date: Tue, 28 Apr 2026 15:47:30 +0100
Subject: [PATCH] gdbusauthmechanismsha1: Validate cookie context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Without validation, the server could send a malicious context which
contains path traversal characters, allowing it to exfiltrate a SHA-1
hashed copy of arbitrary data from the client’s file system.
To exploit this successfully would require the client to choose to
connect peer-to-peer to a malicious D-Bus server and to choose the SHA-1
authentication mechanism in preference to all the other mechanisms. This
is vanishingly unlikely.
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
Fixes: #3931
---
gio/gdbusauthmechanismsha1.c | 36 ++++++++++++++++++++++++++++++++++++
1 file changed, 36 insertions(+)
diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
index c8aa08977..6e6b2b876 100644
--- a/gio/gdbusauthmechanismsha1.c
+++ b/gio/gdbusauthmechanismsha1.c
@@ -1198,6 +1198,34 @@ mechanism_client_initiate (GDBusAuthMechanism *mechanism,
return initial_response;
}
+/* Context names must be valid ASCII, nonzero length, and may not contain the
+ * characters slash ("/"), backslash ("\"), space (" "), newline ("\n"),
+ * carriage return ("\r"), tab ("\t"), or period (".").
+ *
+ * See https://dbus.freedesktop.org/doc/dbus-specification.html#auth-mechanisms-sha */
+static gboolean
+validate_cookie_context (const char *cookie_context)
+{
+ size_t i = 0;
+
+ g_return_val_if_fail (cookie_context != NULL, FALSE);
+
+ for (i = 0; cookie_context[i] != '\0'; i++)
+ {
+ if ((guint8) cookie_context[i] >= 128 ||
+ cookie_context[i] == '/' ||
+ cookie_context[i] == '\\' ||
+ cookie_context[i] == ' ' ||
+ cookie_context[i] == '\n' ||
+ cookie_context[i] == '\r' ||
+ cookie_context[i] == '\t' ||
+ cookie_context[i] == '.')
+ return FALSE;
+ }
+
+ return (i > 0);
+}
+
static void
mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
const gchar *data,
@@ -1232,6 +1260,14 @@ mechanism_client_data_receive (GDBusAuthMechanism *mechanism,
}
cookie_context = tokens[0];
+ if (!validate_cookie_context (tokens[0]))
+ {
+ g_free (m->priv->reject_reason);
+ m->priv->reject_reason = g_strdup_printf ("Malformed cookie_context '%s'", tokens[0]);
+ m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_REJECTED;
+ goto out;
+ }
+
cookie_id = g_ascii_strtoll (tokens[1], &endp, 10);
if (*endp != '\0')
{

3
glib2.spec
View File

@ -74,6 +74,9 @@ Patch: CVE-2026-58010.patch
# https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5132
Patch: CVE-2026-58012.patch
# https://gitlab.gnome.org/GNOME/glib/-/commit/8b72ad09c874ddff122b3e67b3470c5e2eab7690
Patch: CVE-2026-58015.patch
BuildRequires: gcc
BuildRequires: gcc-c++
BuildRequires: gettext