diff --git a/gpsd-cve-2026-58459.patch b/gpsd-cve-2026-58459.patch new file mode 100644 index 0000000..8e10713 --- /dev/null +++ b/gpsd-cve-2026-58459.patch @@ -0,0 +1,130 @@ +commit 5581ba196d826a984fbfaf792b7d58535f9911ce +Author: Gary E. Miller +Date: Wed Jul 1 17:55:57 2026 -0700 + + clients/gpsprof.py.in: Quote double quotes in title. + + Someone could use the double quote to break out of the + string and add gnuplot commnds. + + For issue 404. + Reported by: CuB3y0nd, and Wade Sparks + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 5c18f50ff..261e72665 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,6 +198,10 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + ++ # escape ", and \n, for gnuplot, to not break strings ++ desc = desc.replace('"', '\\042') ++ desc = desc.replace('\n', '') ++ + return desc + + def collect(self, verb, log_fp=None): +@@ -1262,10 +1266,10 @@ if __name__ == '__main__': + # Ship the plot to standard output + if not options.title: + options.title = plot.whatami() +- # escape " for gnuplot +- options.title = options.title.replace('"', '\\"') + if options.subtitle: + options.title += '\\n' + options.subtitle ++ # escape " for gnuplot, to not break strings ++ options.title = options.title.replace('"', '\\042') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: + +commit 1a6bb7bcbdf58aa940132e630870af061dc88537 +Author: Gary E. Miller +Date: Tue Jul 7 13:41:54 2026 -0700 + + clients/gpsprof.py.in: Quote back ticks in title. + + Someone could use the back tick to break out of the string and add + gnuplot commnds. + + For issue 404. + Reported by: CuB3y0nd, and Wade Sparks + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 261e72665..202214769 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,8 +198,9 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + +- # escape ", and \n, for gnuplot, to not break strings ++ # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') ++ desc = desc.replace('`', '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1268,8 +1269,9 @@ if __name__ == '__main__': + options.title = plot.whatami() + if options.subtitle: + options.title += '\\n' + options.subtitle +- # escape " for gnuplot, to not break strings ++ # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') ++ options.title = options.title.replace('"', '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: + +commit 4c06658e988f4ced1a7a574ce082a22ef625df56 +Author: Gary E. Miller +Date: Tue Jul 7 14:23:56 2026 -0700 + + clients/gpsprof.py.in: Quote back ticks in title. + + Second try. Also quote "terminal". + + Someone could use the back tick to break out of the string and add + gnuplot commnds. + + For issue 404. + Reported by: CuB3y0nd, and Wade Sparks + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 202214769..e91367ee3 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -200,7 +200,7 @@ class plotter(object): + + # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') +- desc = desc.replace('`', '\\140') ++ desc = desc.replace("\x60", '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1271,13 +1271,19 @@ if __name__ == '__main__': + options.title += '\\n' + options.subtitle + # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') +- options.title = options.title.replace('"', '\\140') ++ options.title = options.title.replace("\x60", '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: + term_opts = 'truecolor' +- sys.stdout.write("set terminal %s size 800,950 %s\n" +- "set termoption enhanced\n" ++ ++ # escape ", `, and \n, for gnuplot, to not break strings ++ options.terminal = options.terminal.replace('"', '\\042') ++ options.terminal = options.terminal.replace("\x60", '\\140') ++ options.terminal = options.terminal.replace('\n', '') ++ ++ sys.stdout.write('set terminal "%s" size 800,950 %s\n' ++ 'set termoption enhanced\n' + % (options.terminal, term_opts)) + # double quotes on title so \n is parsed by gnuplot + sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title) diff --git a/gpsd.spec b/gpsd.spec index 155aa23..9a66c5d 100644 --- a/gpsd.spec +++ b/gpsd.spec @@ -9,12 +9,12 @@ %global scons_ver 4.6.0 %global scons python3 scons-%{scons_ver}/scripts/scons.py -%global note1 The Red Hat support for this package is limited. See -%global note2 https://access.redhat.com/support/policy/gpsd-support for more details. +%global note1 This package is released as a Technology Preview. +%global note2 Please see Oracle Linux 10 release notes for more details. Name: gpsd Version: 3.26.1 -Release: 1%{?dist}.1 +Release: 3.0.1%{?dist}.1 Epoch: 1 Summary: Service daemon for mediating access to a GPS @@ -29,6 +29,8 @@ Source11: gpsd.sysconfig Patch1: gpsd-cve-2025-67268.patch # fix integer underflow in handling of Navcom packets Patch2: gpsd-cve-2025-67269.patch +# fix command injection in gpsprof +Patch3: gpsd-cve-2026-58459.patch BuildRequires: gcc BuildRequires: dbus-devel @@ -69,6 +71,9 @@ can share access to a GPS without contention or loss of data. Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183. +%{note1} +%{note2} + %if %{with_libs} %package libs Summary: Client libraries in C for talking to a running gpsd or GPS @@ -77,6 +82,9 @@ Summary: Client libraries in C for talking to a running gpsd or GPS This package contains the gpsd libraries that manage access to a GPS for applications. +%{note1} +%{note2} + %package devel Summary: Development files for the gpsd library Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -84,6 +92,9 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} %description devel This package provides C header files for the gpsd shared libraries that manage access to a GPS for applications + +%{note1} +%{note2} %endif %if %{with_qt} @@ -97,6 +108,9 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} This package provide C++ and Qt bindings for use with the libgps library from gpsd. +%{note1} +%{note2} + %package qt-devel Summary: Development files for the C++/Qt5 bindings for the gpsd library Requires: %{name}-qt%{?_isa} = %{epoch}:%{version}-%{release} @@ -104,6 +118,9 @@ Requires: %{name}-qt%{?_isa} = %{epoch}:%{version}-%{release} %description qt-devel This package provides the development files for the C++ and Qt bindings for use with the libgps library from gpsd. + +%{note1} +%{note2} %endif %package -n python3-%{name} @@ -118,6 +135,9 @@ Requires: python3-pyserial This package contains the python3 modules that manage access to a GPS for applications. +%{note1} +%{note2} + %package clients Summary: Clients for gpsd Requires: python3-%{name} = %{epoch}:%{version}-%{release} @@ -129,6 +149,9 @@ Obsoletes: gpsd-minimal-clients %description clients This package contains various clients using gpsd. +%{note1} +%{note2} + %package xclients Summary: Graphical clients for gpsd Requires: python3-%{name} = %{epoch}:%{version}-%{release} @@ -141,6 +164,9 @@ Conflicts: gpsd-clients < 1:3.25-6 %description xclients This package contains X clients using gpsd. +%{note1} +%{note2} + %prep %setup -q -a 1 %autopatch -p1 @@ -358,10 +384,19 @@ rm -rf %{buildroot}%{_docdir}/gpsd %{_mandir}/man1/xgpsspeed.1* %changelog -* Mon Jan 05 2026 Miroslav Lichvar - 1:3.26.1-1.el10_1.1 +* Thu Aug 06 2026 EL Errata - 3.26.1-3.0.1.el10_2.1 +- Replace upstream reference [Orabug: 37033219] + +* Mon Jul 13 2026 Miroslav Lichvar - 1:3.26.1-3.el10_2.1 +- fix command injection in gpsprof (CVE-2026-58459) + +* Mon Jan 19 2026 Miroslav Lichvar - 1:3.26.1-3 - fix buffer overflow in NMEA2000 driver (CVE-2025-67268) - fix integer underflow in handling of Navcom packets (CVE-2025-67269) +* Wed Oct 01 2025 Miroslav Lichvar - 1:3.26.1-2 +- add support note to package descriptions (RHEL-113507) + * Thu May 29 2025 Miroslav Lichvar - 1:3.26.1-1 - update to 3.26.1 (RHEL-94234)