rpms/yelp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-13601 (RHEL-190226)

Browse Source 
Resolves: RHEL-190226
This commit is contained in:
David King 2026-07-07 10:09:50 +01:00
parent 9335af0523
commit c6dede7e12
2 changed files with 35 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
yelp-3.28.1-fix-CVE-2026-13601.patch Normal file
View File

@ -0,0 +1,28 @@
From 4d2857ae2cfc1393fb617f6fa7be1c66de84d520 Mon Sep 17 00:00:00 2001
From: Shaun McCance <shaunm@redhat.com>
Date: Wed, 6 May 2026 12:12:57 -0400
Subject: [PATCH] Don't allow loading external resources from web pages
This is an attack vector for sending data places.
---
libyelp/web-extension/yelp-web-extension.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libyelp/web-extension/yelp-web-extension.c b/libyelp/web-extension/yelp-web-extension.c
index c835021d..731e006b 100644
--- a/libyelp/web-extension/yelp-web-extension.c
+++ b/libyelp/web-extension/yelp-web-extension.c
@@ -74,6 +74,10 @@ web_page_send_request (WebKitWebPage *web_page,
const gchar *resource_uri = webkit_uri_request_get_uri (request);
gchar *yelp_uri, *file_path;
+ /* Don't allow loading external resources at all, for security */
+ if (g_str_has_prefix (resource_uri, "http://") || g_str_has_prefix (resource_uri, "https://"))
+ return TRUE;
+
if (!current_uri)
return FALSE;
--
2.55.0

8
yelp.spec
View File

@ -3,7 +3,7 @@
Name: yelp
Epoch: 2
Version: 3.28.1
Release: 3%{?dist}.1
Release: 3%{?dist}.2
Summary: Help browser for the GNOME desktop
Group: Applications/System
@ -37,6 +37,9 @@ Patch19: 0017-Remove-the-unused-encoding-and-language-code-from-Ye.patch
Patch20: yelp-quit.patch
# https://issues.redhat.com/browse/RHEL-85922
Patch21: yelp-CVE-2025-3155.patch
# https://redhat.atlassian.net/browse/RHEL-190226
# https://gitlab.gnome.org/GNOME/yelp/-/work_items/238
Patch22: yelp-3.28.1-fix-CVE-2026-13601.patch
BuildRequires: pkgconfig(gtk+-3.0)
BuildRequires: pkgconfig(liblzma)
@ -126,6 +129,9 @@ desktop-file-validate $RPM_BUILD_ROOT%{_datadir}/applications/yelp.desktop
%changelog
* Tue Jul 07 2026 David King <dking@redhat.com> - 2:3.28.1-3.2
- Fix CVE-2026-13601 (RHEL-190226)
* Wed Apr 23 2025 David King <dking@redhat.com> - 2:3.28.1-3.1
- Fix CVE-2025-3155 (RHEL-85922)