rpms/glibc
6
0
Fork 2
Code Issues Pull Requests Releases Activity

nscd: Fix an unlikely TTL issue in the netgroup cache (RHEL-35280)

Browse Source 
Resolves: RHEL-35280
This commit is contained in:
Arjun Shankar 2025-03-28 00:20:52 +01:00
parent d36a5743ff
commit 7f444a972b
2 changed files with 35 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
glibc-RHEL-35280.patch Normal file
View File

@ -0,0 +1,30 @@
commit 4bbca1a44691a6e9adcee5c6798a707b626bc331
Author: Florian Weimer <fweimer@redhat.com>
Date: Thu May 2 17:06:19 2024 +0200
nscd: Use time_t for return type of addgetnetgrentX
Using int may give false results for future dates (timeouts after the
year 2028).
Fixes commit 04a21e050d64a1193a6daab872bca2528bda44b ("CVE-2024-33601,
CVE-2024-33602: nscd: netgroup: Use two buffers in addgetnetgrentX
(bug 31680)").
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c
index dd180f8083e7c9f9..b118b55af2d7c9a0 100644
--- a/nscd/netgroupcache.c
+++ b/nscd/netgroupcache.c
@@ -681,8 +681,8 @@ readdinnetgr (struct database_dyn *db, struct hashentry *he,
.key_len = he->len
};
- int timeout = addinnetgrX (db, -1, &req, db->data + he->key, he->owner,
- he, dh);
+ time_t timeout = addinnetgrX (db, -1, &req, db->data + he->key, he->owner,
+ he, dh);
if (timeout < 0)
timeout = 0;
return timeout;

6
glibc.spec
View File

@ -115,7 +115,7 @@ end \
Summary: The GNU libc libraries
Name: glibc
Version: %{glibcversion}
Release: %{glibcrelease}.15
Release: %{glibcrelease}.16
# In general, GPLv2+ is used by programs, LGPLv2+ is used for
# libraries.
@ -1261,6 +1261,7 @@ Patch1026: glibc-RHEL-8381-10.patch
Patch1027: glibc-RHEL-78390.patch
Patch1028: glibc-RHEL-83306-1.patch
Patch1029: glibc-RHEL-83306-2.patch
Patch1030: glibc-RHEL-35280.patch
##############################################################################
# Continued list of core "glibc" package information:
@ -2922,6 +2923,9 @@ fi
%{_libdir}/libpthread_nonshared.a
%changelog
* Thu Mar 27 2025 Arjun Shankar <arjun@redhat.com> - 2.28-251.16
- nscd: Fix an unlikely TTL issue in the netgroup cache (RHEL-35280)
* Thu Mar 20 2025 Arjun Shankar <arjun@redhat.com> - 2.28-251.15
- CVE-2025-0395: Fix a buffer overflow in assert (RHEL-83306)