import php-7.3.5-5.module+el8.1.0+4560+e0eee7d6
This commit is contained in:
parent
51c108c95e
commit
946120a00a
133
SOURCES/php-7.3.5-CVE-2019-11043.patch
Normal file
133
SOURCES/php-7.3.5-CVE-2019-11043.patch
Normal file
@ -0,0 +1,133 @@
|
|||||||
|
From 19e17d3807e6cc0b1ba9443ec5facbd33a61f8fe Mon Sep 17 00:00:00 2001
|
||||||
|
From: Jakub Zelenka <bukka@php.net>
|
||||||
|
Date: Sat, 12 Oct 2019 15:56:16 +0100
|
||||||
|
Subject: [PATCH] Fix bug #78599 (env_path_info underflow can lead to RCE)
|
||||||
|
(CVE-2019-11043)
|
||||||
|
|
||||||
|
(cherry picked from commit ab061f95ca966731b1c84cf5b7b20155c0a1c06a)
|
||||||
|
---
|
||||||
|
NEWS | 2 +
|
||||||
|
sapi/fpm/fpm/fpm_main.c | 4 +-
|
||||||
|
.../tests/bug78599-path-info-underflow.phpt | 61 +++++++++++++++++++
|
||||||
|
sapi/fpm/tests/tester.inc | 11 +++-
|
||||||
|
4 files changed, 74 insertions(+), 4 deletions(-)
|
||||||
|
create mode 100644 sapi/fpm/tests/bug78599-path-info-underflow.phpt
|
||||||
|
|
||||||
|
diff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c
|
||||||
|
index 483fabe9d850..dfc0d8f7413c 100644
|
||||||
|
--- a/sapi/fpm/fpm/fpm_main.c
|
||||||
|
+++ b/sapi/fpm/fpm/fpm_main.c
|
||||||
|
@@ -1148,8 +1148,8 @@ static void init_request_info(void)
|
||||||
|
path_info = script_path_translated + ptlen;
|
||||||
|
tflag = (slen != 0 && (!orig_path_info || strcmp(orig_path_info, path_info) != 0));
|
||||||
|
} else {
|
||||||
|
- path_info = env_path_info ? env_path_info + pilen - slen : NULL;
|
||||||
|
- tflag = (orig_path_info != path_info);
|
||||||
|
+ path_info = (env_path_info && pilen > slen) ? env_path_info + pilen - slen : NULL;
|
||||||
|
+ tflag = path_info && (orig_path_info != path_info);
|
||||||
|
}
|
||||||
|
|
||||||
|
if (tflag) {
|
||||||
|
diff --git a/sapi/fpm/tests/bug78599-path-info-underflow.phpt b/sapi/fpm/tests/bug78599-path-info-underflow.phpt
|
||||||
|
new file mode 100644
|
||||||
|
index 000000000000..edd4e0d49699
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/sapi/fpm/tests/bug78599-path-info-underflow.phpt
|
||||||
|
@@ -0,0 +1,61 @@
|
||||||
|
+--TEST--
|
||||||
|
+FPM: bug78599 - env_path_info underflow - CVE-2019-11043
|
||||||
|
+--SKIPIF--
|
||||||
|
+<?php include "skipif.inc"; ?>
|
||||||
|
+--FILE--
|
||||||
|
+<?php
|
||||||
|
+
|
||||||
|
+require_once "tester.inc";
|
||||||
|
+
|
||||||
|
+$cfg = <<<EOT
|
||||||
|
+[global]
|
||||||
|
+error_log = {{FILE:LOG}}
|
||||||
|
+[unconfined]
|
||||||
|
+listen = {{ADDR}}
|
||||||
|
+pm = dynamic
|
||||||
|
+pm.max_children = 5
|
||||||
|
+pm.start_servers = 1
|
||||||
|
+pm.min_spare_servers = 1
|
||||||
|
+pm.max_spare_servers = 3
|
||||||
|
+EOT;
|
||||||
|
+
|
||||||
|
+$code = <<<EOT
|
||||||
|
+<?php
|
||||||
|
+echo "Test Start\n";
|
||||||
|
+var_dump(\$_SERVER["PATH_INFO"]);
|
||||||
|
+echo "Test End\n";
|
||||||
|
+EOT;
|
||||||
|
+
|
||||||
|
+$tester = new FPM\Tester($cfg, $code);
|
||||||
|
+$tester->start();
|
||||||
|
+$tester->expectLogStartNotices();
|
||||||
|
+$uri = $tester->makeSourceFile();
|
||||||
|
+$tester
|
||||||
|
+ ->request(
|
||||||
|
+ '',
|
||||||
|
+ [
|
||||||
|
+ 'SCRIPT_FILENAME' => $uri . "/" . str_repeat('A', 35),
|
||||||
|
+ 'PATH_INFO' => '',
|
||||||
|
+ 'HTTP_HUI' => str_repeat('PTEST', 1000),
|
||||||
|
+ ],
|
||||||
|
+ $uri
|
||||||
|
+ )
|
||||||
|
+ ->expectBody(
|
||||||
|
+ [
|
||||||
|
+ 'Test Start',
|
||||||
|
+ 'string(0) ""',
|
||||||
|
+ 'Test End'
|
||||||
|
+ ]
|
||||||
|
+ );
|
||||||
|
+$tester->terminate();
|
||||||
|
+$tester->close();
|
||||||
|
+
|
||||||
|
+?>
|
||||||
|
+Done
|
||||||
|
+--EXPECT--
|
||||||
|
+Done
|
||||||
|
+--CLEAN--
|
||||||
|
+<?php
|
||||||
|
+require_once "tester.inc";
|
||||||
|
+FPM\Tester::clean();
|
||||||
|
+?>
|
||||||
|
diff --git a/sapi/fpm/tests/tester.inc b/sapi/fpm/tests/tester.inc
|
||||||
|
index 001b7d6a54ea..188fd4885943 100644
|
||||||
|
--- a/sapi/fpm/tests/tester.inc
|
||||||
|
+++ b/sapi/fpm/tests/tester.inc
|
||||||
|
@@ -513,7 +513,7 @@ class Tester
|
||||||
|
return new Response(null, true);
|
||||||
|
}
|
||||||
|
if (is_null($uri)) {
|
||||||
|
- $uri = $this->makeFile('src.php', $this->code);
|
||||||
|
+ $uri = $this->makeSourceFile();
|
||||||
|
}
|
||||||
|
|
||||||
|
$params = array_merge(
|
||||||
|
@@ -538,7 +538,6 @@ class Tester
|
||||||
|
],
|
||||||
|
$headers
|
||||||
|
);
|
||||||
|
-
|
||||||
|
try {
|
||||||
|
$this->response = new Response(
|
||||||
|
$this->getClient($address, $connKeepAlive)->request_data($params, false)
|
||||||
|
@@ -944,6 +943,14 @@ class Tester
|
||||||
|
return $filePath;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ /**
|
||||||
|
+ * @return string
|
||||||
|
+ */
|
||||||
|
+ public function makeSourceFile()
|
||||||
|
+ {
|
||||||
|
+ return $this->makeFile('src.php', $this->code);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/**
|
||||||
|
* @param string|null $msg
|
||||||
|
*/
|
@ -67,7 +67,7 @@
|
|||||||
Summary: PHP scripting language for creating dynamic web sites
|
Summary: PHP scripting language for creating dynamic web sites
|
||||||
Name: php
|
Name: php
|
||||||
Version: %{upver}%{?rcver:~%{rcver}}
|
Version: %{upver}%{?rcver:~%{rcver}}
|
||||||
Release: 3%{?dist}
|
Release: 5%{?dist}
|
||||||
# All files licensed under PHP version 3.01, except
|
# All files licensed under PHP version 3.01, except
|
||||||
# Zend is licensed under Zend
|
# Zend is licensed under Zend
|
||||||
# TSRM is licensed under BSD
|
# TSRM is licensed under BSD
|
||||||
@ -116,6 +116,7 @@ Patch47: php-5.6.3-phpinfo.patch
|
|||||||
# Upstream fixes (100+)
|
# Upstream fixes (100+)
|
||||||
|
|
||||||
# Security fixes (200+)
|
# Security fixes (200+)
|
||||||
|
Patch200: php-7.3.5-CVE-2019-11043.patch
|
||||||
|
|
||||||
# Fixes for tests (300+)
|
# Fixes for tests (300+)
|
||||||
# Factory is droped from system tzdata
|
# Factory is droped from system tzdata
|
||||||
@ -721,6 +722,7 @@ low-level PHP extension for the libsodium cryptographic library.
|
|||||||
# upstream patches
|
# upstream patches
|
||||||
|
|
||||||
# security patches
|
# security patches
|
||||||
|
%patch200 -p1 -b .cve11043
|
||||||
|
|
||||||
# Fixes for tests
|
# Fixes for tests
|
||||||
%patch300 -p1 -b .datetests
|
%patch300 -p1 -b .datetests
|
||||||
@ -1567,6 +1569,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Oct 29 2019 Remi Collet <rcollet@redhat.com> - 7.3.5-5
|
||||||
|
- fix underflow in env_path_info in fpm_main.c CVE-2019-11043
|
||||||
|
|
||||||
* Mon Jul 1 2019 Remi Collet <rcollet@redhat.com> - 7.3.5-3
|
* Mon Jul 1 2019 Remi Collet <rcollet@redhat.com> - 7.3.5-3
|
||||||
- fix AVC denied httpd_execmem when php-opcache is installed #1725104
|
- fix AVC denied httpd_execmem when php-opcache is installed #1725104
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user