rpms/libsoup3
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI libsoup3-3.6.5-3.el10_0.7

Browse Source
This commit is contained in:
eabdullin 2025-10-15 23:58:23 +00:00
parent 739d76f6ce
commit 4f30665218
2 changed files with 60 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
RHEL-117630.patch Normal file
View File

@ -0,0 +1,53 @@
From 093a544bfbedcda96d619b49973e574933f2ed28 Mon Sep 17 00:00:00 2001
From: Alynx Zhou <alynx.zhou@gmail.com>
Date: Sat, 11 Oct 2025 15:52:47 +0800
Subject: [PATCH] cookies: Avoid expires attribute if date is invalid
According to CVE-2025-11021, we may get invalid on processing date
string with timezone offset, this commit will ignore it.
Closes #459
---
libsoup/cookies/soup-cookie.c | 9 +++++----
libsoup/soup-date-utils.c | 3 +++
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/libsoup/cookies/soup-cookie.c b/libsoup/cookies/soup-cookie.c
index b6d7716..1213402 100644
--- a/libsoup/cookies/soup-cookie.c
+++ b/libsoup/cookies/soup-cookie.c
@@ -774,12 +774,13 @@ serialize_cookie (SoupCookie *cookie, GString *header, gboolean set_cookie)
if (cookie->expires) {
char *timestamp;
-
- g_string_append (header, "; expires=");
timestamp = soup_date_time_to_string (cookie->expires,
SOUP_DATE_COOKIE);
- g_string_append (header, timestamp);
- g_free (timestamp);
+ if (timestamp) {
+ g_string_append (header, "; expires=");
+ g_string_append (header, timestamp);
+ g_free (timestamp);
+ }
}
if (cookie->path) {
g_string_append (header, "; path=");
diff --git a/libsoup/soup-date-utils.c b/libsoup/soup-date-utils.c
index fd785f5..e5aa805 100644
--- a/libsoup/soup-date-utils.c
+++ b/libsoup/soup-date-utils.c
@@ -95,6 +95,9 @@ soup_date_time_to_string (GDateTime *date,
char *date_format;
char *formatted_date;
+ if (!utcdate)
+ return NULL;
+
// We insert days/months ourselves to avoid locale specific formatting
if (format == SOUP_DATE_HTTP) {
/* "Sun, 06 Nov 1994 08:49:37 GMT" */
--
2.47.3

8
libsoup3.spec
View File

@ -2,7 +2,7 @@
## (rpmautospec version 0.6.5)
## RPMAUTOSPEC: autorelease, autochangelog
%define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
release_number = 6;
release_number = 7;
base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
print(release_number + base_release_number - 1);
}%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@ -39,6 +39,8 @@ Patch: CVE-2025-4948.patch
Patch: CVE-2025-32049.patch
# https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452
Patch: CVE-2025-32907.patch
# CVE-2025-11021
Patch: RHEL-117630.patch
BuildRequires: ca-certificates
BuildRequires: gcc
@ -133,6 +135,10 @@ install -m 644 -D tests/libsoup.supp %{buildroot}%{_datadir}/libsoup-3.0/libsoup
%changelog
## START: Generated by rpmautospec
* Wed Oct 15 2025 RHEL Packaging Agent <jotnar@redhat.com> - 3.6.5-7
- Fix handling of invalid dates in cookie expires attribute
(CVE-2025-11021)
* Wed May 21 2025 Michael Catanzaro <mcatanzaro@redhat.com> - 3.6.5-6
- Add patch for CVE-2025-32907