import UBI rest-0.9.1-11.el10_2.1

0003-CVE-2026-16615-weak-random-number-generation.patch

@@ -0,0 +1,156 @@
+diff -up rest-0.9.1/meson.build.3 rest-0.9.1/meson.build
+--- rest-0.9.1/meson.build.3	2022-06-19 12:28:19.000000000 +0200
++++ rest-0.9.1/meson.build	2026-07-27 09:32:48.052296505 +0200
+@@ -60,6 +60,8 @@ libsoup_dep = dependency(libsoup_name, v
+ libjson_glib_dep = dependency('json-glib-1.0')
+ libxml_dep = dependency('libxml-2.0')
+ 
++cc = meson.get_compiler('c')
++
+ # config.h
+ conf = configuration_data()
+ conf.set_quoted('PACKAGE_NAME', meson.project_name())
+@@ -68,6 +70,33 @@ conf.set_quoted('PACKAGE_VERSION', meson
+ if get_option('ca_certificates')
+   conf.set_quoted('REST_SYSTEM_CA_FILE', ca_certificates_path)
+ endif
++
++# CSPRNG detection for secure random string generation (required)
++have_csprng = false
++if cc.has_function('arc4random_buf', prefix: '#include <stdlib.h>')
++  conf.set('HAVE_ARC4RANDOM_BUF', 1)
++  have_csprng = true
++endif
++if cc.has_function('getrandom', prefix: '#include <sys/random.h>')
++  conf.set('HAVE_GETRANDOM', 1)
++  have_csprng = true
++endif
++
++csprng_deps = []
++if host_machine.system() == 'windows'
++  bcrypt_lib = cc.find_library('bcrypt', required: false)
++  if bcrypt_lib.found()
++    csprng_deps += bcrypt_lib
++    conf.set('HAVE_BCRYPTGENRANDOM', 1)
++    have_csprng = true
++  endif
++endif
++
++if not have_csprng
++  error('No cryptographically secure random source found. ' +
++        'librest requires arc4random_buf(), getrandom(), or BCryptGenRandom().')
++endif
++
+ configure_file(output: 'config.h', configuration: conf)
+ config_h_inc = include_directories('.')
+ 
+diff -up rest-0.9.1/rest/meson.build.3 rest-0.9.1/rest/meson.build
+--- rest-0.9.1/rest/meson.build.3	2022-06-19 12:28:19.000000000 +0200
++++ rest-0.9.1/rest/meson.build	2026-07-27 09:33:20.660145787 +0200
+@@ -49,7 +49,7 @@ librest_deps = [
+   libsoup_dep,
+   libjson_glib_dep,
+   libxml_dep,
+-]
++] + csprng_deps
+ 
+ librest_c_args = [
+   '-DG_LOG_DOMAIN="Rest"',
+diff -up rest-0.9.1/rest/rest-utils.c.3 rest-0.9.1/rest/rest-utils.c
+--- rest-0.9.1/rest/rest-utils.c.3	2022-06-19 12:28:19.000000000 +0200
++++ rest-0.9.1/rest/rest-utils.c	2026-07-27 09:30:30.420281138 +0200
+@@ -16,29 +16,89 @@
+  * Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
+  */
+ 
++#include "config.h"
+ #include "rest-utils.h"
+ 
++#ifdef HAVE_ARC4RANDOM_BUF
++#include <stdlib.h>
++#endif
++
++#ifdef HAVE_GETRANDOM
++#include <errno.h>
++#include <sys/random.h>
++#endif
++
++#ifdef HAVE_BCRYPTGENRANDOM
++#define WIN32_LEAN_AND_MEAN
++#include <windows.h>
++#include <bcrypt.h>
++#endif
++
++#if defined(HAVE_ARC4RANDOM_BUF)
++
++static void
++crypto_random_bytes (guchar *buffer,
++                     gsize   length)
++{
++  arc4random_buf (buffer, length);
++}
++
++#elif defined(HAVE_BCRYPTGENRANDOM)
++
++static void
++crypto_random_bytes (guchar *buffer,
++                     gsize   length)
++{
++  BCryptGenRandom (NULL, buffer, (ULONG) length,
++                   BCRYPT_USE_SYSTEM_PREFERRED_RNG);
++}
++
++#elif defined(HAVE_GETRANDOM)
++
++static void
++crypto_random_bytes (guchar *buffer,
++                     gsize   length)
++{
++  gsize pos = 0;
++
++  while (pos < length)
++    {
++      gssize ret = getrandom (buffer + pos, length - pos, 0);
++      if (ret < 0)
++        {
++          if (errno == EINTR)
++            continue;
++          g_error ("getrandom() failed: %s", g_strerror (errno));
++        }
++      pos += (gsize) ret;
++    }
++}
++
++#endif /* platform selection */
++
+ /**
+  * random_string:
+  * @length: the length of the random string
+  *
+- * Creates a random string from a given alphabeth with length @length
++ * Creates a random string from a given alphabet with length @length.
+  *
+  * Returns: (transfer full): a random string
+  */
+ gchar *
+ random_string (guint length)
+ {
+-  g_autoptr(GRand) rand = g_rand_new ();
+   gchar *buffer = g_malloc0 (sizeof (gchar) * length + 1);
+-  gchar alphabeth[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~";
++  gchar alphabet[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~";
++  guint alphabet_len = sizeof (alphabet) - 1;
++  g_autofree guchar *rand_bytes = g_malloc (length);
++
++  crypto_random_bytes (rand_bytes, length);
+ 
+   for (guint i = 0; i < length; i++)
+     {
+-      buffer[i] = alphabeth[g_rand_int (rand) % (sizeof (alphabeth) - 1)];
++      buffer[i] = alphabet[rand_bytes[i] % alphabet_len];
+     }
+   buffer[length] = '\0';
+ 
+   return buffer;
+ }
+-

rest.spec

@@ -1,6 +1,6 @@
 Name:          rest
 Version:       0.9.1
-Release:       11%{?dist}
+Release:       11%{?dist}.1
 Summary:       A library for access to RESTful web services
 
 License:       LGPL-2.1-only
@@ -12,6 +12,8 @@ Source0:       https://download.gnome.org/sources/%{name}/0.9/%{name}-%{version}
 # https://gitlab.gnome.org/GNOME/librest/-/merge_requests/30
 Patch0:        0001-rest_proxy_call_sync-bail-out-if-no-payload.patch
 Patch1:        0002-Handle-some-potential-problems-in-parsing-oauth2-acc.patch
+# https://gitlab.gnome.org/GNOME/librest/-/issues/25
+Patch2:        0003-CVE-2026-16615-weak-random-number-generation.patch
 
 BuildRequires: meson
 BuildRequires: pkgconfig(glib-2.0)
@@ -80,6 +82,10 @@ Demo application for %{name}.
 %{_datadir}/applications/org.gnome.RestDemo.desktop
 
 %changelog
+* Mon Jul 27 2026 Milan Crha <mcrha@redhat.com> - 0.9.1-11.1
+- Add patch for CVE-2026-16615 (Weak random number generation in PKCE implementation)
+  Resolves: RHEL-213749
+
 * Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 0.9.1-11
 - Bump release for October 2024 mass rebuild:
   Resolves: RHEL-64018