import Oracle_OSS gpsd-3.26.1-3.0.1.el10_2.1
This commit is contained in:
AlmaLinux RelEng Bot
parent
a2d7bd853c
commit
4b8fe92a67
130
gpsd-cve-2026-58459.patch
Normal file
130
gpsd-cve-2026-58459.patch
Normal file
@ -0,0 +1,130 @@
|
||||
commit 5581ba196d826a984fbfaf792b7d58535f9911ce
|
||||
Author: Gary E. Miller <gem@rellim.com>
|
||||
Date: Wed Jul 1 17:55:57 2026 -0700
|
||||
|
||||
clients/gpsprof.py.in: Quote double quotes in title.
|
||||
|
||||
Someone could use the double quote to break out of the
|
||||
string and add gnuplot commnds.
|
||||
|
||||
For issue 404.
|
||||
Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
|
||||
|
||||
diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
|
||||
index 5c18f50ff..261e72665 100644
|
||||
--- a/clients/gpsprof.py.in
|
||||
+++ b/clients/gpsprof.py.in
|
||||
@@ -198,6 +198,10 @@ class plotter(object):
|
||||
if 'subtype' in self.device:
|
||||
desc += "\\n%s" % self.device['subtype']
|
||||
|
||||
+ # escape ", and \n, for gnuplot, to not break strings
|
||||
+ desc = desc.replace('"', '\\042')
|
||||
+ desc = desc.replace('\n', '')
|
||||
+
|
||||
return desc
|
||||
|
||||
def collect(self, verb, log_fp=None):
|
||||
@@ -1262,10 +1266,10 @@ if __name__ == '__main__':
|
||||
# Ship the plot to standard output
|
||||
if not options.title:
|
||||
options.title = plot.whatami()
|
||||
- # escape " for gnuplot
|
||||
- options.title = options.title.replace('"', '\\"')
|
||||
if options.subtitle:
|
||||
options.title += '\\n' + options.subtitle
|
||||
+ # escape " for gnuplot, to not break strings
|
||||
+ options.title = options.title.replace('"', '\\042')
|
||||
term_opts = ""
|
||||
truecolor_terms = ['png', 'sixelgd', 'wxt']
|
||||
if options.terminal in truecolor_terms:
|
||||
|
||||
commit 1a6bb7bcbdf58aa940132e630870af061dc88537
|
||||
Author: Gary E. Miller <gem@rellim.com>
|
||||
Date: Tue Jul 7 13:41:54 2026 -0700
|
||||
|
||||
clients/gpsprof.py.in: Quote back ticks in title.
|
||||
|
||||
Someone could use the back tick to break out of the string and add
|
||||
gnuplot commnds.
|
||||
|
||||
For issue 404.
|
||||
Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
|
||||
|
||||
diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
|
||||
index 261e72665..202214769 100644
|
||||
--- a/clients/gpsprof.py.in
|
||||
+++ b/clients/gpsprof.py.in
|
||||
@@ -198,8 +198,9 @@ class plotter(object):
|
||||
if 'subtype' in self.device:
|
||||
desc += "\\n%s" % self.device['subtype']
|
||||
|
||||
- # escape ", and \n, for gnuplot, to not break strings
|
||||
+ # escape ", `, and \n, for gnuplot, to not break strings
|
||||
desc = desc.replace('"', '\\042')
|
||||
+ desc = desc.replace('`', '\\140')
|
||||
desc = desc.replace('\n', '')
|
||||
|
||||
return desc
|
||||
@@ -1268,8 +1269,9 @@ if __name__ == '__main__':
|
||||
options.title = plot.whatami()
|
||||
if options.subtitle:
|
||||
options.title += '\\n' + options.subtitle
|
||||
- # escape " for gnuplot, to not break strings
|
||||
+ # escape ", and`, for gnuplot, to not break strings
|
||||
options.title = options.title.replace('"', '\\042')
|
||||
+ options.title = options.title.replace('"', '\\140')
|
||||
term_opts = ""
|
||||
truecolor_terms = ['png', 'sixelgd', 'wxt']
|
||||
if options.terminal in truecolor_terms:
|
||||
|
||||
commit 4c06658e988f4ced1a7a574ce082a22ef625df56
|
||||
Author: Gary E. Miller <gem@rellim.com>
|
||||
Date: Tue Jul 7 14:23:56 2026 -0700
|
||||
|
||||
clients/gpsprof.py.in: Quote back ticks in title.
|
||||
|
||||
Second try. Also quote "terminal".
|
||||
|
||||
Someone could use the back tick to break out of the string and add
|
||||
gnuplot commnds.
|
||||
|
||||
For issue 404.
|
||||
Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
|
||||
|
||||
diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
|
||||
index 202214769..e91367ee3 100644
|
||||
--- a/clients/gpsprof.py.in
|
||||
+++ b/clients/gpsprof.py.in
|
||||
@@ -200,7 +200,7 @@ class plotter(object):
|
||||
|
||||
# escape ", `, and \n, for gnuplot, to not break strings
|
||||
desc = desc.replace('"', '\\042')
|
||||
- desc = desc.replace('`', '\\140')
|
||||
+ desc = desc.replace("\x60", '\\140')
|
||||
desc = desc.replace('\n', '')
|
||||
|
||||
return desc
|
||||
@@ -1271,13 +1271,19 @@ if __name__ == '__main__':
|
||||
options.title += '\\n' + options.subtitle
|
||||
# escape ", and`, for gnuplot, to not break strings
|
||||
options.title = options.title.replace('"', '\\042')
|
||||
- options.title = options.title.replace('"', '\\140')
|
||||
+ options.title = options.title.replace("\x60", '\\140')
|
||||
term_opts = ""
|
||||
truecolor_terms = ['png', 'sixelgd', 'wxt']
|
||||
if options.terminal in truecolor_terms:
|
||||
term_opts = 'truecolor'
|
||||
- sys.stdout.write("set terminal %s size 800,950 %s\n"
|
||||
- "set termoption enhanced\n"
|
||||
+
|
||||
+ # escape ", `, and \n, for gnuplot, to not break strings
|
||||
+ options.terminal = options.terminal.replace('"', '\\042')
|
||||
+ options.terminal = options.terminal.replace("\x60", '\\140')
|
||||
+ options.terminal = options.terminal.replace('\n', '')
|
||||
+
|
||||
+ sys.stdout.write('set terminal "%s" size 800,950 %s\n'
|
||||
+ 'set termoption enhanced\n'
|
||||
% (options.terminal, term_opts))
|
||||
# double quotes on title so \n is parsed by gnuplot
|
||||
sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title)
|
||||
43
gpsd.spec
43
gpsd.spec
@ -9,12 +9,12 @@
|
||||
|
||||
%global scons_ver 4.6.0
|
||||
%global scons python3 scons-%{scons_ver}/scripts/scons.py
|
||||
%global note1 The Red Hat support for this package is limited. See
|
||||
%global note2 https://access.redhat.com/support/policy/gpsd-support for more details.
|
||||
%global note1 This package is released as a Technology Preview.
|
||||
%global note2 Please see Oracle Linux 10 release notes for more details.
|
||||
|
||||
Name: gpsd
|
||||
Version: 3.26.1
|
||||
Release: 1%{?dist}.1
|
||||
Release: 3.0.1%{?dist}.1
|
||||
Epoch: 1
|
||||
Summary: Service daemon for mediating access to a GPS
|
||||
|
||||
@ -29,6 +29,8 @@ Source11: gpsd.sysconfig
|
||||
Patch1: gpsd-cve-2025-67268.patch
|
||||
# fix integer underflow in handling of Navcom packets
|
||||
Patch2: gpsd-cve-2025-67269.patch
|
||||
# fix command injection in gpsprof
|
||||
Patch3: gpsd-cve-2026-58459.patch
|
||||
|
||||
BuildRequires: gcc
|
||||
BuildRequires: dbus-devel
|
||||
@ -69,6 +71,9 @@ can share access to a GPS without contention or loss of data. Also,
|
||||
gpsd responds to queries with a format that is substantially easier to
|
||||
parse than NMEA 0183.
|
||||
|
||||
%{note1}
|
||||
%{note2}
|
||||
|
||||
%if %{with_libs}
|
||||
%package libs
|
||||
Summary: Client libraries in C for talking to a running gpsd or GPS
|
||||
@ -77,6 +82,9 @@ Summary: Client libraries in C for talking to a running gpsd or GPS
|
||||
This package contains the gpsd libraries that manage access
|
||||
to a GPS for applications.
|
||||
|
||||
%{note1}
|
||||
%{note2}
|
||||
|
||||
%package devel
|
||||
Summary: Development files for the gpsd library
|
||||
Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
|
||||
@ -84,6 +92,9 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
|
||||
%description devel
|
||||
This package provides C header files for the gpsd shared libraries that
|
||||
manage access to a GPS for applications
|
||||
|
||||
%{note1}
|
||||
%{note2}
|
||||
%endif
|
||||
|
||||
%if %{with_qt}
|
||||
@ -97,6 +108,9 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
|
||||
This package provide C++ and Qt bindings for use with the libgps library from
|
||||
gpsd.
|
||||
|
||||
%{note1}
|
||||
%{note2}
|
||||
|
||||
%package qt-devel
|
||||
Summary: Development files for the C++/Qt5 bindings for the gpsd library
|
||||
Requires: %{name}-qt%{?_isa} = %{epoch}:%{version}-%{release}
|
||||
@ -104,6 +118,9 @@ Requires: %{name}-qt%{?_isa} = %{epoch}:%{version}-%{release}
|
||||
%description qt-devel
|
||||
This package provides the development files for the C++ and Qt bindings for use
|
||||
with the libgps library from gpsd.
|
||||
|
||||
%{note1}
|
||||
%{note2}
|
||||
%endif
|
||||
|
||||
%package -n python3-%{name}
|
||||
@ -118,6 +135,9 @@ Requires: python3-pyserial
|
||||
This package contains the python3 modules that manage access to a GPS for
|
||||
applications.
|
||||
|
||||
%{note1}
|
||||
%{note2}
|
||||
|
||||
%package clients
|
||||
Summary: Clients for gpsd
|
||||
Requires: python3-%{name} = %{epoch}:%{version}-%{release}
|
||||
@ -129,6 +149,9 @@ Obsoletes: gpsd-minimal-clients
|
||||
%description clients
|
||||
This package contains various clients using gpsd.
|
||||
|
||||
%{note1}
|
||||
%{note2}
|
||||
|
||||
%package xclients
|
||||
Summary: Graphical clients for gpsd
|
||||
Requires: python3-%{name} = %{epoch}:%{version}-%{release}
|
||||
@ -141,6 +164,9 @@ Conflicts: gpsd-clients < 1:3.25-6
|
||||
%description xclients
|
||||
This package contains X clients using gpsd.
|
||||
|
||||
%{note1}
|
||||
%{note2}
|
||||
|
||||
%prep
|
||||
%setup -q -a 1
|
||||
%autopatch -p1
|
||||
@ -358,10 +384,19 @@ rm -rf %{buildroot}%{_docdir}/gpsd
|
||||
%{_mandir}/man1/xgpsspeed.1*
|
||||
|
||||
%changelog
|
||||
* Mon Jan 05 2026 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-1.el10_1.1
|
||||
* Thu Aug 06 2026 EL Errata <el-errata_ww@oracle.com> - 3.26.1-3.0.1.el10_2.1
|
||||
- Replace upstream reference [Orabug: 37033219]
|
||||
|
||||
* Mon Jul 13 2026 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-3.el10_2.1
|
||||
- fix command injection in gpsprof (CVE-2026-58459)
|
||||
|
||||
* Mon Jan 19 2026 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-3
|
||||
- fix buffer overflow in NMEA2000 driver (CVE-2025-67268)
|
||||
- fix integer underflow in handling of Navcom packets (CVE-2025-67269)
|
||||
|
||||
* Wed Oct 01 2025 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-2
|
||||
- add support note to package descriptions (RHEL-113507)
|
||||
|
||||
* Thu May 29 2025 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-1
|
||||
- update to 3.26.1 (RHEL-94234)
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user