From b5003e7f944a87269847d768a26a81fc1a6c709c Mon Sep 17 00:00:00 2001 From: Tomas Korbar Date: Mon, 22 Jun 2026 09:26:24 +0200 Subject: [PATCH] Revert fix for CVE-2026-47783 Prelimenary testing showed the package is not affected Related: RHEL-179088 --- memcached-CVE-2026-47783.patch | 59 ---------------------------------- memcached.spec | 9 ++++-- 2 files changed, 6 insertions(+), 62 deletions(-) delete mode 100644 memcached-CVE-2026-47783.patch diff --git a/memcached-CVE-2026-47783.patch b/memcached-CVE-2026-47783.patch deleted file mode 100644 index c5229d8..0000000 --- a/memcached-CVE-2026-47783.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 4df7ac75345b3ea4e0662444621de2ee1959d77c Mon Sep 17 00:00:00 2001 -From: Sarthak Munshi -Date: Sat, 21 Mar 2026 15:20:25 -0700 -Subject: [PATCH] Fix timing side-channel in SASL password database - authentication - -sasl_server_userdb_checkpass() broke out of the password file loop -early when a valid username was found, creating a measurable timing -difference between valid and invalid usernames. Additionally, the -password comparison used memcmp() which returns early on the first -differing byte, potentially leaking password bytes via timing analysis. - -Fix both issues with minimal changes per reviewer feedback: -- Clear buffer to zero before each fgets so comparisons past the - stored password hit known zero bytes -- Use safe_memcmp() for both username and password comparisons - (constant-time, volatile-qualified) -- Remove the early break so the entire file is always scanned ---- - sasl_defs.c | 21 ++++++++++----------- - 1 file changed, 10 insertions(+), 11 deletions(-) - -diff --git a/sasl_defs.c b/sasl_defs.c -index 370f947..2a46ec3 100644 ---- a/sasl_defs.c -+++ b/sasl_defs.c -@@ -71,19 +71,18 @@ static int sasl_server_userdb_checkpass(sasl_conn_t *conn, - char buffer[MAX_ENTRY_LEN]; - bool ok = false; - -- while ((fgets(buffer, sizeof(buffer), pwfile)) != NULL) { -- if (memcmp(user, buffer, unmlen) == 0 && buffer[unmlen] == ':') { -- /* This is the correct user */ -- ++unmlen; -- if (memcmp(pass, buffer + unmlen, passlen) == 0 && -- (buffer[unmlen + passlen] == ':' || /* Additional tokens */ -- buffer[unmlen + passlen] == '\n' || /* end of line */ -- buffer[unmlen + passlen] == '\r'|| /* dos format? */ -- buffer[unmlen + passlen] == '\0')) { /* line truncated */ -+ while (1) { -+ memset(buffer, 0, sizeof(buffer)); -+ if (fgets(buffer, sizeof(buffer), pwfile) == NULL) -+ break; -+ if (safe_memcmp(user, buffer, unmlen) && buffer[unmlen] == ':') { -+ if (safe_memcmp(pass, buffer + unmlen + 1, passlen) && -+ (buffer[unmlen + 1 + passlen] == ':' || -+ buffer[unmlen + 1 + passlen] == '\n' || -+ buffer[unmlen + 1 + passlen] == '\r' || -+ buffer[unmlen + 1 + passlen] == '\0')) { - ok = true; - } -- -- break; - } - } - (void)fclose(pwfile); --- -2.52.0 - diff --git a/memcached.spec b/memcached.spec index 1b77a97..ba13c51 100644 --- a/memcached.spec +++ b/memcached.spec @@ -7,7 +7,7 @@ Name: memcached Version: 1.5.22 -Release: 3%{?dist} +Release: 4%{?dist} Epoch: 0 Summary: High Performance, Distributed Memory Object Cache @@ -33,8 +33,6 @@ Patch12: memcached-restart-del-items-fail.patch Patch13: memcached-restart-double-free.patch Patch14: memcached-issue685.patch Patch15: memcached-test-cache-dump.patch -# https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed -Patch16: memcached-CVE-2026-47783.patch BuildRequires: gcc libevent-devel systemd BuildRequires: perl-generators @@ -141,6 +139,11 @@ exit 0 %{_includedir}/memcached/* %changelog +* Mon Jun 22 2026 Tomas Korbar - 0:1.5.22-4 +- Revert fix for CVE-2026-47783 +- Prelimenary testing showed the package is not affected +- Related: RHEL-179088 + * Fri Jun 12 2026 RHEL Packaging Agent - 0:1.5.22-3 - Fix timing side-channel in SASL password database authentication - CVE-2026-47783