From 347502f5dba186c8d6356fb0dfbab4f7209f4ae0 Mon Sep 17 00:00:00 2001 From: Vitezslav Crhonek Date: Thu, 21 Dec 2023 10:51:20 +0100 Subject: [PATCH] Fix CVE-2019-19204 Resolves: RHEL-9509 --- oniguruma-6.8.2-CVE-2019-19204-fix.patch | 12 ++++++++++++ oniguruma.spec | 4 ++++ 2 files changed, 16 insertions(+) create mode 100644 oniguruma-6.8.2-CVE-2019-19204-fix.patch diff --git a/oniguruma-6.8.2-CVE-2019-19204-fix.patch b/oniguruma-6.8.2-CVE-2019-19204-fix.patch new file mode 100644 index 0000000..907cf00 --- /dev/null +++ b/oniguruma-6.8.2-CVE-2019-19204-fix.patch @@ -0,0 +1,12 @@ +diff -up onig-6.8.2/src/regparse.c.orig onig-6.8.2/src/regparse.c +--- onig-6.8.2/src/regparse.c.orig 2023-10-13 10:22:48.882495157 +0200 ++++ onig-6.8.2/src/regparse.c 2023-10-13 10:23:11.096529668 +0200 +@@ -4132,7 +4132,7 @@ fetch_range_quantifier(UChar** src, UCha + if (PEND) goto invalid; + PFETCH(c); + if (IS_SYNTAX_OP(env->syntax, ONIG_SYN_OP_ESC_BRACE_INTERVAL)) { +- if (c != MC_ESC(env->syntax)) goto invalid; ++ if (c != MC_ESC(env->syntax) || PEND) goto invalid; + PFETCH(c); + } + if (c != '}') goto invalid; diff --git a/oniguruma.spec b/oniguruma.spec index 0148848..7c671ce 100644 --- a/oniguruma.spec +++ b/oniguruma.spec @@ -14,6 +14,7 @@ Patch101: oniguruma-6.8.2-CVE-2019-13224-fix.patch Patch102: oniguruma-6.8.2-CVE-2019-16163-fix.patch Patch103: oniguruma-6.8.2-CVE-2019-19012-fix.patch Patch104: oniguruma-6.8.2-CVE-2019-19203-fix.patch +Patch105: oniguruma-6.8.2-CVE-2019-19204-fix.patch %description Oniguruma is a regular expressions library. @@ -54,6 +55,7 @@ done %patch102 -p1 -b .CVE-2019-16163 %patch103 -p1 -b .CVE-2019-19012 %patch104 -p1 -b .CVE-2019-19203 +%patch105 -p1 -b .CVE-2019-19204 %build %configure \ @@ -119,6 +121,8 @@ find $RPM_BUILD_ROOT -name '*.la' \ Resolves: RHEL-9511 - Fix CVE-2019-19203 Resolves: RHEL-9510 +- Fix CVE-2019-19204 + Resolves: RHEL-9509 * Fri Jun 26 2020 Jiri Kucera - 6.8.2-2 - Fix CVE-2019-13225