diff --git a/RHEL-117630.patch b/RHEL-117630.patch deleted file mode 100644 index 5230d49..0000000 --- a/RHEL-117630.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 093a544bfbedcda96d619b49973e574933f2ed28 Mon Sep 17 00:00:00 2001 -From: Alynx Zhou -Date: Sat, 11 Oct 2025 15:52:47 +0800 -Subject: [PATCH] cookies: Avoid expires attribute if date is invalid - -According to CVE-2025-11021, we may get invalid on processing date -string with timezone offset, this commit will ignore it. - -Closes #459 ---- - libsoup/cookies/soup-cookie.c | 9 +++++---- - libsoup/soup-date-utils.c | 3 +++ - 2 files changed, 8 insertions(+), 4 deletions(-) - -diff --git a/libsoup/cookies/soup-cookie.c b/libsoup/cookies/soup-cookie.c -index b6d7716..1213402 100644 ---- a/libsoup/cookies/soup-cookie.c -+++ b/libsoup/cookies/soup-cookie.c -@@ -774,12 +774,13 @@ serialize_cookie (SoupCookie *cookie, GString *header, gboolean set_cookie) - - if (cookie->expires) { - char *timestamp; -- -- g_string_append (header, "; expires="); - timestamp = soup_date_time_to_string (cookie->expires, - SOUP_DATE_COOKIE); -- g_string_append (header, timestamp); -- g_free (timestamp); -+ if (timestamp) { -+ g_string_append (header, "; expires="); -+ g_string_append (header, timestamp); -+ g_free (timestamp); -+ } - } - if (cookie->path) { - g_string_append (header, "; path="); -diff --git a/libsoup/soup-date-utils.c b/libsoup/soup-date-utils.c -index fd785f5..e5aa805 100644 ---- a/libsoup/soup-date-utils.c -+++ b/libsoup/soup-date-utils.c -@@ -95,6 +95,9 @@ soup_date_time_to_string (GDateTime *date, - char *date_format; - char *formatted_date; - -+ if (!utcdate) -+ return NULL; -+ - // We insert days/months ourselves to avoid locale specific formatting - if (format == SOUP_DATE_HTTP) { - /* "Sun, 06 Nov 1994 08:49:37 GMT" */ --- -2.47.3 - diff --git a/RHEL-123214.patch b/RHEL-123214.patch new file mode 100644 index 0000000..29b5680 --- /dev/null +++ b/RHEL-123214.patch @@ -0,0 +1,245 @@ +From 8988379984e33dcc7d3aa58551db13e48755959f Mon Sep 17 00:00:00 2001 +From: Milan Crha +Date: Thu, 15 May 2025 07:59:14 +0200 +Subject: [PATCH 1/2] soup-date-utils: Add value checks for date/time parsing + +Reject date/time when it does not represent a valid value. + +Closes https://gitlab.gnome.org/GNOME/libsoup/-/issues/448 +--- + libsoup/soup-date-utils.c | 23 +++++++++++++++-------- + tests/cookies-test.c | 10 ++++++++++ + 2 files changed, 25 insertions(+), 8 deletions(-) + +diff --git a/libsoup/soup-date-utils.c b/libsoup/soup-date-utils.c +index fd785f509..34ca99503 100644 +--- a/libsoup/soup-date-utils.c ++++ b/libsoup/soup-date-utils.c +@@ -129,7 +129,7 @@ parse_day (int *day, const char **date_string) + while (*end == ' ' || *end == '-') + end++; + *date_string = end; +- return TRUE; ++ return *day >= 1 && *day <= 31; + } + + static inline gboolean +@@ -169,7 +169,7 @@ parse_year (int *year, const char **date_string) + while (*end == ' ' || *end == '-') + end++; + *date_string = end; +- return TRUE; ++ return *year > 0 && *year < 9999; + } + + static inline gboolean +@@ -193,7 +193,7 @@ parse_time (int *hour, int *minute, int *second, const char **date_string) + while (*p == ' ') + p++; + *date_string = p; +- return TRUE; ++ return *hour >= 0 && *hour < 24 && *minute >= 0 && *minute < 60 && *second >= 0 && *second < 60; + } + + static inline gboolean +@@ -209,9 +209,14 @@ parse_timezone (GTimeZone **timezone, const char **date_string) + gulong val; + int sign = (**date_string == '+') ? 1 : -1; + val = strtoul (*date_string + 1, (char **)date_string, 10); +- if (**date_string == ':') +- val = 60 * val + strtoul (*date_string + 1, (char **)date_string, 10); +- else ++ if (val > 9999) ++ return FALSE; ++ if (**date_string == ':') { ++ gulong val2 = strtoul (*date_string + 1, (char **)date_string, 10); ++ if (val > 99 || val2 > 99) ++ return FALSE; ++ val = 60 * val + val2; ++ } else + val = 60 * (val / 100) + (val % 100); + offset_minutes = sign * val; + utc = (sign == -1) && !val; +@@ -264,7 +269,8 @@ parse_textual_date (const char *date_string) + if (!parse_month (&month, &date_string) || + !parse_day (&day, &date_string) || + !parse_time (&hour, &minute, &second, &date_string) || +- !parse_year (&year, &date_string)) ++ !parse_year (&year, &date_string) || ++ !g_date_valid_dmy (day, month, year)) + return NULL; + + /* There shouldn't be a timezone, but check anyway */ +@@ -276,7 +282,8 @@ parse_textual_date (const char *date_string) + if (!parse_day (&day, &date_string) || + !parse_month (&month, &date_string) || + !parse_year (&year, &date_string) || +- !parse_time (&hour, &minute, &second, &date_string)) ++ !parse_time (&hour, &minute, &second, &date_string) || ++ !g_date_valid_dmy (day, month, year)) + return NULL; + + /* This time there *should* be a timezone, but we +diff --git a/tests/cookies-test.c b/tests/cookies-test.c +index 1d2d45630..ff809a400 100644 +--- a/tests/cookies-test.c ++++ b/tests/cookies-test.c +@@ -460,6 +460,15 @@ do_cookies_parsing_max_age_long_overflow (void) + soup_cookie_free (cookie); + } + ++static void ++do_cookies_parsing_int32_overflow (void) ++{ ++ SoupCookie *cookie = soup_cookie_parse ("Age=1;expires=3Mar9 999:9:9+ 999999999-age=main=gne=", NULL); ++ g_assert_nonnull (cookie); ++ g_assert_null (soup_cookie_get_expires (cookie)); ++ soup_cookie_free (cookie); ++} ++ + static void + do_cookies_equal_nullpath (void) + { +@@ -718,6 +727,7 @@ main (int argc, char **argv) + g_test_add_func ("/cookies/parsing/no-path-null-origin", do_cookies_parsing_nopath_nullorigin); + g_test_add_func ("/cookies/parsing/max-age-int32-overflow", do_cookies_parsing_max_age_int32_overflow); + g_test_add_func ("/cookies/parsing/max-age-long-overflow", do_cookies_parsing_max_age_long_overflow); ++ g_test_add_func ("/cookies/parsing/int32-overflow", do_cookies_parsing_int32_overflow); + g_test_add_func ("/cookies/parsing/equal-nullpath", do_cookies_equal_nullpath); + g_test_add_func ("/cookies/parsing/control-characters", do_cookies_parsing_control_characters); + g_test_add_func ("/cookies/parsing/name-value-max-size", do_cookies_parsing_name_value_max_size); +-- +GitLab + + +From 0d6bfa52da7313de848fb13fcfdbc561c04afef8 Mon Sep 17 00:00:00 2001 +From: Brian Yurko <155515-byurko@users.noreply.gitlab.gnome.org> +Date: Wed, 11 Jun 2025 11:00:56 -0400 +Subject: [PATCH 2/2] tests: Add tests for date-time including timezone + validation work + +These tests are built on top of earlier work in a related pull request. + +Closes #448 +--- + libsoup/soup-date-utils.c | 8 ++++---- + tests/cookies-test.c | 1 + + tests/date-test.c | 37 ++++++++++++++++++++++++++++++------- + 3 files changed, 35 insertions(+), 11 deletions(-) + +diff --git a/libsoup/soup-date-utils.c b/libsoup/soup-date-utils.c +index 34ca99503..73f80ab60 100644 +--- a/libsoup/soup-date-utils.c ++++ b/libsoup/soup-date-utils.c +@@ -40,7 +40,7 @@ soup_date_time_is_past (GDateTime *date) + g_return_val_if_fail (date != NULL, TRUE); + + /* optimization */ +- if (g_date_time_get_year (date) < 2020) ++ if (g_date_time_get_year (date) < 2025) + return TRUE; + + return g_date_time_to_unix (date) < time (NULL); +@@ -219,15 +219,15 @@ parse_timezone (GTimeZone **timezone, const char **date_string) + } else + val = 60 * (val / 100) + (val % 100); + offset_minutes = sign * val; +- utc = (sign == -1) && !val; ++ utc = (sign == -1) && !val; + } else if (**date_string == 'Z') { + offset_minutes = 0; +- utc = TRUE; ++ utc = TRUE; + (*date_string)++; + } else if (!strcmp (*date_string, "GMT") || + !strcmp (*date_string, "UTC")) { + offset_minutes = 0; +- utc = TRUE; ++ utc = TRUE; + (*date_string) += 3; + } else if (strchr ("ECMP", **date_string) && + ((*date_string)[1] == 'D' || (*date_string)[1] == 'S') && +diff --git a/tests/cookies-test.c b/tests/cookies-test.c +index ff809a400..18c9b60d8 100644 +--- a/tests/cookies-test.c ++++ b/tests/cookies-test.c +@@ -464,6 +464,7 @@ static void + do_cookies_parsing_int32_overflow (void) + { + SoupCookie *cookie = soup_cookie_parse ("Age=1;expires=3Mar9 999:9:9+ 999999999-age=main=gne=", NULL); ++ g_test_bug ("https://gitlab.gnome.org/GNOME/libsoup/-/issues/448"); + g_assert_nonnull (cookie); + g_assert_null (soup_cookie_get_expires (cookie)); + soup_cookie_free (cookie); +diff --git a/tests/date-test.c b/tests/date-test.c +index 7eefd7c00..abf89ddd1 100644 +--- a/tests/date-test.c ++++ b/tests/date-test.c +@@ -92,6 +92,11 @@ static const OkDate ok_dates[] = { + { "Sat, 06 Nov 2004 08:09:07", NULL }, + { "06 Nov 2004 08:09:07 GMT", NULL }, + { "SAT, 06 NOV 2004 08:09:07 +1000", "644048" }, ++ { "Sat, 06-Nov-2004 08:09:07 -10000", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, ++ { "Sat, 06-Nov-2004 08:09:07 +01:30", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, ++ { "Sat, 06-Nov-2004 08:09:07 +0:180", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, ++ { "Sat, 06-Nov-2004 08:09:07 +100:100", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, ++ { "Sat, 06-Nov-2004 08:09:07 Z", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, + + /* rfc850-date, and broken variants */ + { "Saturday, 06-Nov-04 08:09:07 GMT", NULL }, +@@ -109,6 +114,8 @@ static const OkDate ok_dates[] = { + { "Sat Nov 06 08:09:07 2004", NULL }, + { "Sat Nov 6 08:09:07 2004", NULL }, + { "Sat Nov 6 08:09:07 2004 GMT", NULL }, ++ { "Sat Nov 6 08:09:07 2004 NoZone", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, ++ { "Sat Nov 6 08:09:07 2004 UTC", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" }, + + /* Netscape cookie spec date, and broken variants */ + { "Sat, 06-Nov-2004 08:09:07 GMT", NULL }, +@@ -182,7 +189,23 @@ static const BadDate bad_dates[] = { + { "Sat Nov 6 08::07 2004", NULL }, + { "Sat Nov 6 08:09: 2004", NULL }, + { "Sat Nov 6 08:09:07", NULL }, +- { "Sat Nov 6 08:09:07 GMT 2004", NULL } ++ { "Sat Nov 6 08:09:07 GMT 2004", NULL }, ++ ++ /* range constraints added "https://gitlab.gnome.org/GNOME/libsoup/-/issues/448" */ ++ { "Sat, 00-Nov-2004 08:09:07 GMT", NULL }, ++ { "Sat, 32-Nov-2004 08:09:07 GMT", NULL }, ++ { "Sat, 06-Nov-0 08:09:07 GMT", NULL }, ++ { "Sat, 06-Nov-9999 08:09:07 GMT", NULL }, ++ { "Sat, 06-Nov-2004 0-1:09:07 GMT", NULL }, ++ { "(Sat), Nov 6 -1:09:07 2004", NULL }, ++ { "Sat, 06-Nov-2004 24:09:07 GMT", NULL }, ++ { "Sat, 06-Nov-2004 08:-1:07 GMT", NULL }, ++ { "Sat, 06-Nov-2004 08:60:07 GMT", NULL }, ++ { "Sat, 06-Nov-2004 08:09:-10 GMT", NULL }, ++ { "Sat, 06-Nov-2004 08:09:60 GMT", NULL }, ++ { "Sat, 06-Nov-71 08:09:99 UTC", NULL }, ++ { "Sat, 31-Feb-2004 08:09:07 UTC", NULL }, ++ { "2004-11-06T08:09:07Z", NULL } + }; + + static void +@@ -198,12 +221,12 @@ check_bad (gconstpointer data) + soup_test_assert (date == NULL, + "date parsing succeeded for '%s': %d %d %d - %d %d %d", + bad->date, +- g_date_time_get_year (date), +- g_date_time_get_month (date), +- g_date_time_get_day_of_month (date), +- g_date_time_get_hour (date), +- g_date_time_get_minute (date), +- g_date_time_get_second (date)); ++ g_date_time_get_year (date), ++ g_date_time_get_month (date), ++ g_date_time_get_day_of_month (date), ++ g_date_time_get_hour (date), ++ g_date_time_get_minute (date), ++ g_date_time_get_second (date)); + g_clear_pointer (&date, g_date_time_unref); + } + +-- +GitLab + diff --git a/libsoup3.spec b/libsoup3.spec index 716a3f5..d1b690d 100644 --- a/libsoup3.spec +++ b/libsoup3.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.6.5) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 7; + release_number = 9; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -39,8 +39,9 @@ Patch: CVE-2025-4948.patch Patch: CVE-2025-32049.patch # https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/452 Patch: CVE-2025-32907.patch -# CVE-2025-11021 -Patch: RHEL-117630.patch +# RHEL-123214 + CVE-2025-11021 +# https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/473 +Patch: RHEL-123214.patch BuildRequires: ca-certificates BuildRequires: gcc @@ -135,6 +136,13 @@ install -m 644 -D tests/libsoup.supp %{buildroot}%{_datadir}/libsoup-3.0/libsoup %changelog ## START: Generated by rpmautospec +* Fri Oct 24 2025 Maja Massarini - 3.6.5-9 +- Revert "Fix handling of invalid dates in cookie expires attribute + (CVE-2025-11021)" + +* Wed Oct 22 2025 RHEL Packaging Agent - 3.6.5-8 +- Fix integer overflow in date/time parsing + * Wed Oct 15 2025 RHEL Packaging Agent - 3.6.5-7 - Fix handling of invalid dates in cookie expires attribute (CVE-2025-11021)