Update to 3.6.5 and add patches for CVEs
Resolves: RHEL-84737 Resolves: RHEL-87032 Resolves: RHEL-87036 Resolves: RHEL-87078 Resolves: RHEL-87104 Resolves: RHEL-88331 Resolves: RHEL-88347
This commit is contained in:
Michael Catanzaro
parent
e385e19efe
commit
51d6712b77
1
.gitignore
vendored
1
.gitignore
vendored
@ -18,3 +18,4 @@
|
||||
/libsoup-3.4.4.tar.xz
|
||||
/libsoup-3.6.1.tar.xz
|
||||
/libsoup-3.6.3.tar.xz
|
||||
/libsoup-3.6.5.tar.xz
|
||||
|
||||
83
CVE-2025-32908.patch
Normal file
83
CVE-2025-32908.patch
Normal file
@ -0,0 +1,83 @@
|
||||
From a792b23ab87cacbf4dd9462bf7b675fa678efbae Mon Sep 17 00:00:00 2001
|
||||
From: Milan Crha <mcrha@redhat.com>
|
||||
Date: Tue, 15 Apr 2025 09:59:05 +0200
|
||||
Subject: [PATCH] soup-server-http2: Check validity of the constructed
|
||||
connection URI
|
||||
|
||||
The HTTP/2 pseudo-headers can contain invalid values, which the GUri rejects
|
||||
and returns NULL, but the soup-server did not check the validity and could
|
||||
abort the server itself later in the code.
|
||||
|
||||
Closes #429
|
||||
---
|
||||
.../http2/soup-server-message-io-http2.c | 4 +++
|
||||
tests/http2-test.c | 28 +++++++++++++++++++
|
||||
2 files changed, 32 insertions(+)
|
||||
|
||||
diff --git a/libsoup/server/http2/soup-server-message-io-http2.c b/libsoup/server/http2/soup-server-message-io-http2.c
|
||||
index 943ecfd3..f1fe2d5c 100644
|
||||
--- a/libsoup/server/http2/soup-server-message-io-http2.c
|
||||
+++ b/libsoup/server/http2/soup-server-message-io-http2.c
|
||||
@@ -771,9 +771,13 @@ on_frame_recv_callback (nghttp2_session *session,
|
||||
char *uri_string;
|
||||
GUri *uri;
|
||||
|
||||
+ if (msg_io->scheme == NULL || msg_io->authority == NULL || msg_io->path == NULL)
|
||||
+ return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
|
||||
uri_string = g_strdup_printf ("%s://%s%s", msg_io->scheme, msg_io->authority, msg_io->path);
|
||||
uri = g_uri_parse (uri_string, SOUP_HTTP_URI_FLAGS, NULL);
|
||||
g_free (uri_string);
|
||||
+ if (uri == NULL)
|
||||
+ return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
|
||||
soup_server_message_set_uri (msg_io->msg, uri);
|
||||
g_uri_unref (uri);
|
||||
|
||||
diff --git a/tests/http2-test.c b/tests/http2-test.c
|
||||
index 5b6da5e4..ec7972fe 100644
|
||||
--- a/tests/http2-test.c
|
||||
+++ b/tests/http2-test.c
|
||||
@@ -1341,6 +1341,30 @@ do_connection_closed_test (Test *test, gconstpointer data)
|
||||
g_uri_unref (uri);
|
||||
}
|
||||
|
||||
+static void
|
||||
+do_broken_pseudo_header_test (Test *test, gconstpointer data)
|
||||
+{
|
||||
+ char *path;
|
||||
+ SoupMessage *msg;
|
||||
+ GUri *uri;
|
||||
+ GBytes *body = NULL;
|
||||
+ GError *error = NULL;
|
||||
+
|
||||
+ uri = g_uri_parse_relative (base_uri, "/ag", SOUP_HTTP_URI_FLAGS, NULL);
|
||||
+
|
||||
+ /* an ugly cheat to construct a broken URI, which can be sent from other libs */
|
||||
+ path = (char *) g_uri_get_path (uri);
|
||||
+ path[1] = '%';
|
||||
+
|
||||
+ msg = soup_message_new_from_uri (SOUP_METHOD_GET, uri);
|
||||
+ body = soup_test_session_async_send (test->session, msg, NULL, &error);
|
||||
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_PARTIAL_INPUT);
|
||||
+ g_assert_null (body);
|
||||
+ g_clear_error (&error);
|
||||
+ g_object_unref (msg);
|
||||
+ g_uri_unref (uri);
|
||||
+}
|
||||
+
|
||||
static gboolean
|
||||
unpause_message (SoupServerMessage *msg)
|
||||
{
|
||||
@@ -1662,6 +1686,10 @@ main (int argc, char **argv)
|
||||
setup_session,
|
||||
do_connection_closed_test,
|
||||
teardown_session);
|
||||
+ g_test_add ("/http2/broken-pseudo-header", Test, NULL,
|
||||
+ setup_session,
|
||||
+ do_broken_pseudo_header_test,
|
||||
+ teardown_session);
|
||||
|
||||
ret = g_test_run ();
|
||||
|
||||
--
|
||||
GitLab
|
||||
|
||||
107
CVE-2025-32914.patch
Normal file
107
CVE-2025-32914.patch
Normal file
@ -0,0 +1,107 @@
|
||||
From 5bfcf8157597f2d327050114fb37ff600004dbcf Mon Sep 17 00:00:00 2001
|
||||
From: Milan Crha <mcrha@redhat.com>
|
||||
Date: Tue, 15 Apr 2025 09:03:00 +0200
|
||||
Subject: [PATCH] multipart: Fix read out of buffer bounds under
|
||||
soup_multipart_new_from_message()
|
||||
|
||||
This is CVE-2025-32914, special crafted input can cause read out of buffer bounds
|
||||
of the body argument.
|
||||
|
||||
Closes #436
|
||||
---
|
||||
libsoup/soup-multipart.c | 2 +-
|
||||
tests/multipart-test.c | 58 ++++++++++++++++++++++++++++++++++++++++
|
||||
2 files changed, 59 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/libsoup/soup-multipart.c b/libsoup/soup-multipart.c
|
||||
index 2421c91f8..102ce3722 100644
|
||||
--- a/libsoup/soup-multipart.c
|
||||
+++ b/libsoup/soup-multipart.c
|
||||
@@ -173,7 +173,7 @@ soup_multipart_new_from_message (SoupMessageHeaders *headers,
|
||||
return NULL;
|
||||
}
|
||||
|
||||
- split = strstr (start, "\r\n\r\n");
|
||||
+ split = g_strstr_len (start, body_end - start, "\r\n\r\n");
|
||||
if (!split || split > end) {
|
||||
soup_multipart_free (multipart);
|
||||
return NULL;
|
||||
diff --git a/tests/multipart-test.c b/tests/multipart-test.c
|
||||
index 2c0e7e969..f5b986889 100644
|
||||
--- a/tests/multipart-test.c
|
||||
+++ b/tests/multipart-test.c
|
||||
@@ -471,6 +471,62 @@ test_multipart (gconstpointer data)
|
||||
loop = NULL;
|
||||
}
|
||||
|
||||
+static void
|
||||
+test_multipart_bounds_good (void)
|
||||
+{
|
||||
+ #define TEXT "line1\r\nline2"
|
||||
+ SoupMultipart *multipart;
|
||||
+ SoupMessageHeaders *headers, *set_headers = NULL;
|
||||
+ GBytes *bytes, *set_bytes = NULL;
|
||||
+ const char *raw_data = "--123\r\nContent-Type: text/plain;\r\n\r\n" TEXT "\r\n--123--\r\n";
|
||||
+ gboolean success;
|
||||
+
|
||||
+ headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_MULTIPART);
|
||||
+ soup_message_headers_append (headers, "Content-Type", "multipart/mixed; boundary=\"123\"");
|
||||
+
|
||||
+ bytes = g_bytes_new (raw_data, strlen (raw_data));
|
||||
+
|
||||
+ multipart = soup_multipart_new_from_message (headers, bytes);
|
||||
+
|
||||
+ g_assert_nonnull (multipart);
|
||||
+ g_assert_cmpint (soup_multipart_get_length (multipart), ==, 1);
|
||||
+ success = soup_multipart_get_part (multipart, 0, &set_headers, &set_bytes);
|
||||
+ g_assert_true (success);
|
||||
+ g_assert_nonnull (set_headers);
|
||||
+ g_assert_nonnull (set_bytes);
|
||||
+ g_assert_cmpint (strlen (TEXT), ==, g_bytes_get_size (set_bytes));
|
||||
+ g_assert_cmpstr ("text/plain", ==, soup_message_headers_get_content_type (set_headers, NULL));
|
||||
+ g_assert_cmpmem (TEXT, strlen (TEXT), g_bytes_get_data (set_bytes, NULL), g_bytes_get_size (set_bytes));
|
||||
+
|
||||
+ soup_message_headers_unref (headers);
|
||||
+ g_bytes_unref (bytes);
|
||||
+
|
||||
+ soup_multipart_free (multipart);
|
||||
+
|
||||
+ #undef TEXT
|
||||
+}
|
||||
+
|
||||
+static void
|
||||
+test_multipart_bounds_bad (void)
|
||||
+{
|
||||
+ SoupMultipart *multipart;
|
||||
+ SoupMessageHeaders *headers;
|
||||
+ GBytes *bytes;
|
||||
+ const char *raw_data = "--123\r\nContent-Type: text/plain;\r\nline1\r\nline2\r\n--123--\r\n";
|
||||
+
|
||||
+ headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_MULTIPART);
|
||||
+ soup_message_headers_append (headers, "Content-Type", "multipart/mixed; boundary=\"123\"");
|
||||
+
|
||||
+ bytes = g_bytes_new (raw_data, strlen (raw_data));
|
||||
+
|
||||
+ /* it did read out of raw_data/bytes bounds */
|
||||
+ multipart = soup_multipart_new_from_message (headers, bytes);
|
||||
+ g_assert_null (multipart);
|
||||
+
|
||||
+ soup_message_headers_unref (headers);
|
||||
+ g_bytes_unref (bytes);
|
||||
+}
|
||||
+
|
||||
int
|
||||
main (int argc, char **argv)
|
||||
{
|
||||
@@ -498,6 +554,8 @@ main (int argc, char **argv)
|
||||
g_test_add_data_func ("/multipart/sync", GINT_TO_POINTER (SYNC_MULTIPART), test_multipart);
|
||||
g_test_add_data_func ("/multipart/async", GINT_TO_POINTER (ASYNC_MULTIPART), test_multipart);
|
||||
g_test_add_data_func ("/multipart/async-small-reads", GINT_TO_POINTER (ASYNC_MULTIPART_SMALL_READS), test_multipart);
|
||||
+ g_test_add_func ("/multipart/bounds-good", test_multipart_bounds_good);
|
||||
+ g_test_add_func ("/multipart/bounds-bad", test_multipart_bounds_bad);
|
||||
|
||||
ret = g_test_run ();
|
||||
|
||||
--
|
||||
GitLab
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
%global glib2_version 2.69.1
|
||||
|
||||
Name: libsoup3
|
||||
Version: 3.6.3
|
||||
Version: 3.6.5
|
||||
Release: %autorelease
|
||||
Summary: Soup, an HTTP library implementation
|
||||
|
||||
@ -12,6 +12,11 @@ Source0: https://download.gnome.org/sources/libsoup/3.6/libsoup-%{version}.tar.x
|
||||
# https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/426
|
||||
Patch: test-timeouts.patch
|
||||
|
||||
# https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/450
|
||||
Patch: CVE-2025-32914.patch
|
||||
# https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/451
|
||||
Patch: CVE-2025-32908.patch
|
||||
|
||||
BuildRequires: ca-certificates
|
||||
BuildRequires: gcc
|
||||
BuildRequires: gettext
|
||||
|
||||
2
sources
2
sources
@ -1 +1 @@
|
||||
SHA512 (libsoup-3.6.3.tar.xz) = a2b2fec1b440d44f151abfaed6d007ae7a56a303f84ee04674649fb8770121915842e233c82754f3ea0fe44e934bcd292f6d2c8be61cfccadbc50e600ac2e98b
|
||||
SHA512 (libsoup-3.6.5.tar.xz) = cb44d93b16048d31ae04a8c2416bbe233e0e9bdaf2d9bfe2879260fd3da27e90a0bb05cddbd82cdf81a4a778bd451ad172a14dd31e2fd113c3bbbe13c0029b03
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
From b9c73d4eb71a26824f8d5795822d37b0a5487808 Mon Sep 17 00:00:00 2001
|
||||
From e308ed1a277c6b9c35c3f5c0e8e9deb06b2bcf89 Mon Sep 17 00:00:00 2001
|
||||
From: Michael Catanzaro <mcatanzaro@redhat.com>
|
||||
Date: Mon, 13 Jan 2025 11:50:35 -0600
|
||||
Subject: [PATCH] Mark several tests as slow
|
||||
@ -47,14 +47,15 @@ I'm not marking hsts-test as slow because it is fast with the exception
|
||||
of some hardcoded 2-3 second timeouts that should never cause the total
|
||||
time to exceed 30s.
|
||||
---
|
||||
tests/meson.build | 16 ++++++++--------
|
||||
1 file changed, 8 insertions(+), 8 deletions(-)
|
||||
.gitlab-ci.yml | 4 ++--
|
||||
tests/meson.build | 14 +++++++-------
|
||||
2 files changed, 9 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/tests/meson.build b/tests/meson.build
|
||||
index 01a0c63fd..da2e5f1eb 100644
|
||||
index ee118a01..b4dc8064 100644
|
||||
--- a/tests/meson.build
|
||||
+++ b/tests/meson.build
|
||||
@@ -78,8 +78,8 @@ tests = [
|
||||
@@ -87,8 +87,8 @@ tests = [
|
||||
{'name': 'date'},
|
||||
{'name': 'forms'},
|
||||
{'name': 'header-parsing'},
|
||||
@ -65,17 +66,8 @@ index 01a0c63fd..da2e5f1eb 100644
|
||||
{'name': 'hsts'},
|
||||
{'name': 'hsts-db'},
|
||||
{'name': 'logger'},
|
||||
@@ -93,7 +93,7 @@ tests = [
|
||||
{'name': 'samesite'},
|
||||
{'name': 'session'},
|
||||
{'name': 'server-auth'},
|
||||
- {'name': 'server'},
|
||||
+ {'name': 'server', 'slow': true},
|
||||
{'name': 'sniffing'},
|
||||
{'name': 'ssl',
|
||||
'dependencies': [gnutls_dep],
|
||||
@@ -101,11 +101,12 @@ tests = [
|
||||
'c_args': '-DHAVE_GNUTLS=@0@'.format(gnutls_dep.found() ? 1 : 0),
|
||||
@@ -115,11 +115,12 @@ tests = [
|
||||
]
|
||||
},
|
||||
{'name': 'streaming'},
|
||||
- {'name': 'timeout'},
|
||||
@ -89,7 +81,7 @@ index 01a0c63fd..da2e5f1eb 100644
|
||||
]
|
||||
|
||||
if brotlidec_dep.found()
|
||||
@@ -205,14 +206,13 @@ foreach test: tests
|
||||
@@ -219,14 +220,13 @@ foreach test: tests
|
||||
install_dir : installed_tests_execdir,
|
||||
install_rpath : abs_installed_tests_execdir,
|
||||
)
|
||||
@ -107,5 +99,5 @@ index 01a0c63fd..da2e5f1eb 100644
|
||||
)
|
||||
endforeach
|
||||
--
|
||||
GitLab
|
||||
2.49.0
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user