From 8983067b950539848a58e9a863b1dc60d0b68665 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 28 Jul 2026 12:27:25 -0400 Subject: [PATCH] import UBI rest-0.9.1-11.el10_2.1 --- ...-16615-weak-random-number-generation.patch | 156 ++++++++++++++++++ rest.spec | 8 +- 2 files changed, 163 insertions(+), 1 deletion(-) create mode 100644 0003-CVE-2026-16615-weak-random-number-generation.patch diff --git a/0003-CVE-2026-16615-weak-random-number-generation.patch b/0003-CVE-2026-16615-weak-random-number-generation.patch new file mode 100644 index 0000000..c3d5a4f --- /dev/null +++ b/0003-CVE-2026-16615-weak-random-number-generation.patch @@ -0,0 +1,156 @@ +diff -up rest-0.9.1/meson.build.3 rest-0.9.1/meson.build +--- rest-0.9.1/meson.build.3 2022-06-19 12:28:19.000000000 +0200 ++++ rest-0.9.1/meson.build 2026-07-27 09:32:48.052296505 +0200 +@@ -60,6 +60,8 @@ libsoup_dep = dependency(libsoup_name, v + libjson_glib_dep = dependency('json-glib-1.0') + libxml_dep = dependency('libxml-2.0') + ++cc = meson.get_compiler('c') ++ + # config.h + conf = configuration_data() + conf.set_quoted('PACKAGE_NAME', meson.project_name()) +@@ -68,6 +70,33 @@ conf.set_quoted('PACKAGE_VERSION', meson + if get_option('ca_certificates') + conf.set_quoted('REST_SYSTEM_CA_FILE', ca_certificates_path) + endif ++ ++# CSPRNG detection for secure random string generation (required) ++have_csprng = false ++if cc.has_function('arc4random_buf', prefix: '#include ') ++ conf.set('HAVE_ARC4RANDOM_BUF', 1) ++ have_csprng = true ++endif ++if cc.has_function('getrandom', prefix: '#include ') ++ conf.set('HAVE_GETRANDOM', 1) ++ have_csprng = true ++endif ++ ++csprng_deps = [] ++if host_machine.system() == 'windows' ++ bcrypt_lib = cc.find_library('bcrypt', required: false) ++ if bcrypt_lib.found() ++ csprng_deps += bcrypt_lib ++ conf.set('HAVE_BCRYPTGENRANDOM', 1) ++ have_csprng = true ++ endif ++endif ++ ++if not have_csprng ++ error('No cryptographically secure random source found. ' + ++ 'librest requires arc4random_buf(), getrandom(), or BCryptGenRandom().') ++endif ++ + configure_file(output: 'config.h', configuration: conf) + config_h_inc = include_directories('.') + +diff -up rest-0.9.1/rest/meson.build.3 rest-0.9.1/rest/meson.build +--- rest-0.9.1/rest/meson.build.3 2022-06-19 12:28:19.000000000 +0200 ++++ rest-0.9.1/rest/meson.build 2026-07-27 09:33:20.660145787 +0200 +@@ -49,7 +49,7 @@ librest_deps = [ + libsoup_dep, + libjson_glib_dep, + libxml_dep, +-] ++] + csprng_deps + + librest_c_args = [ + '-DG_LOG_DOMAIN="Rest"', +diff -up rest-0.9.1/rest/rest-utils.c.3 rest-0.9.1/rest/rest-utils.c +--- rest-0.9.1/rest/rest-utils.c.3 2022-06-19 12:28:19.000000000 +0200 ++++ rest-0.9.1/rest/rest-utils.c 2026-07-27 09:30:30.420281138 +0200 +@@ -16,29 +16,89 @@ + * Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA. + */ + ++#include "config.h" + #include "rest-utils.h" + ++#ifdef HAVE_ARC4RANDOM_BUF ++#include ++#endif ++ ++#ifdef HAVE_GETRANDOM ++#include ++#include ++#endif ++ ++#ifdef HAVE_BCRYPTGENRANDOM ++#define WIN32_LEAN_AND_MEAN ++#include ++#include ++#endif ++ ++#if defined(HAVE_ARC4RANDOM_BUF) ++ ++static void ++crypto_random_bytes (guchar *buffer, ++ gsize length) ++{ ++ arc4random_buf (buffer, length); ++} ++ ++#elif defined(HAVE_BCRYPTGENRANDOM) ++ ++static void ++crypto_random_bytes (guchar *buffer, ++ gsize length) ++{ ++ BCryptGenRandom (NULL, buffer, (ULONG) length, ++ BCRYPT_USE_SYSTEM_PREFERRED_RNG); ++} ++ ++#elif defined(HAVE_GETRANDOM) ++ ++static void ++crypto_random_bytes (guchar *buffer, ++ gsize length) ++{ ++ gsize pos = 0; ++ ++ while (pos < length) ++ { ++ gssize ret = getrandom (buffer + pos, length - pos, 0); ++ if (ret < 0) ++ { ++ if (errno == EINTR) ++ continue; ++ g_error ("getrandom() failed: %s", g_strerror (errno)); ++ } ++ pos += (gsize) ret; ++ } ++} ++ ++#endif /* platform selection */ ++ + /** + * random_string: + * @length: the length of the random string + * +- * Creates a random string from a given alphabeth with length @length ++ * Creates a random string from a given alphabet with length @length. + * + * Returns: (transfer full): a random string + */ + gchar * + random_string (guint length) + { +- g_autoptr(GRand) rand = g_rand_new (); + gchar *buffer = g_malloc0 (sizeof (gchar) * length + 1); +- gchar alphabeth[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~"; ++ gchar alphabet[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~"; ++ guint alphabet_len = sizeof (alphabet) - 1; ++ g_autofree guchar *rand_bytes = g_malloc (length); ++ ++ crypto_random_bytes (rand_bytes, length); + + for (guint i = 0; i < length; i++) + { +- buffer[i] = alphabeth[g_rand_int (rand) % (sizeof (alphabeth) - 1)]; ++ buffer[i] = alphabet[rand_bytes[i] % alphabet_len]; + } + buffer[length] = '\0'; + + return buffer; + } +- diff --git a/rest.spec b/rest.spec index 486009b..acdb6ba 100644 --- a/rest.spec +++ b/rest.spec @@ -1,6 +1,6 @@ Name: rest Version: 0.9.1 -Release: 11%{?dist} +Release: 11%{?dist}.1 Summary: A library for access to RESTful web services License: LGPL-2.1-only @@ -12,6 +12,8 @@ Source0: https://download.gnome.org/sources/%{name}/0.9/%{name}-%{version} # https://gitlab.gnome.org/GNOME/librest/-/merge_requests/30 Patch0: 0001-rest_proxy_call_sync-bail-out-if-no-payload.patch Patch1: 0002-Handle-some-potential-problems-in-parsing-oauth2-acc.patch +# https://gitlab.gnome.org/GNOME/librest/-/issues/25 +Patch2: 0003-CVE-2026-16615-weak-random-number-generation.patch BuildRequires: meson BuildRequires: pkgconfig(glib-2.0) @@ -80,6 +82,10 @@ Demo application for %{name}. %{_datadir}/applications/org.gnome.RestDemo.desktop %changelog +* Mon Jul 27 2026 Milan Crha - 0.9.1-11.1 +- Add patch for CVE-2026-16615 (Weak random number generation in PKCE implementation) + Resolves: RHEL-213749 + * Tue Oct 29 2024 Troy Dawson - 0.9.1-11 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018