diff options
author | vkumbhar <vkumbhar@mvista.com> | 2023-12-04 19:36:48 +0530 |
---|---|---|
committer | Armin Kuster <akuster808@gmail.com> | 2023-12-17 15:36:42 -0500 |
commit | 3bcc5bb4deee32f04b4c6ba0a3b342c864f1c03d (patch) | |
tree | 2154b23192c862949b510d0b9c3f8eb5f9224bf9 | |
parent | ed41cf1357f13acb0311b5c768558df55bc37128 (diff) | |
download | meta-openembedded-3bcc5bb4deee32f04b4c6ba0a3b342c864f1c03d.tar.gz |
squid: fix CVE-2023-46847 Denial of Service in HTTP Digest Authentication
Upstream-Status: Backport from https://github.com/squid-cache/squid/commit/052cf082b0faaef4eaaa4e94119d7a1437aac4a3
Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
-rw-r--r-- | meta-networking/recipes-daemons/squid/files/CVE-2023-46847.patch | 47 | ||||
-rw-r--r-- | meta-networking/recipes-daemons/squid/squid_4.9.bb | 1 |
2 files changed, 48 insertions, 0 deletions
diff --git a/meta-networking/recipes-daemons/squid/files/CVE-2023-46847.patch b/meta-networking/recipes-daemons/squid/files/CVE-2023-46847.patch new file mode 100644 index 000000000..d9f29569d --- /dev/null +++ b/meta-networking/recipes-daemons/squid/files/CVE-2023-46847.patch | |||
@@ -0,0 +1,47 @@ | |||
1 | From 052cf082b0faaef4eaaa4e94119d7a1437aac4a3 Mon Sep 17 00:00:00 2001 | ||
2 | From: squidadm <squidadm@users.noreply.github.com> | ||
3 | Date: Wed, 18 Oct 2023 04:50:56 +1300 | ||
4 | Subject: [PATCH] Fix stack buffer overflow when parsing Digest Authorization | ||
5 | (#1517) | ||
6 | |||
7 | The bug was discovered and detailed by Joshua Rogers at | ||
8 | https://megamansec.github.io/Squid-Security-Audit/digest-overflow.html | ||
9 | where it was filed as "Stack Buffer Overflow in Digest Authentication". | ||
10 | |||
11 | --------- | ||
12 | |||
13 | Co-authored-by: Alex Bason <nonsleepr@gmail.com> | ||
14 | Co-authored-by: Amos Jeffries <yadij@users.noreply.github.com> | ||
15 | |||
16 | Upstream-Status: Backport [https://github.com/squid-cache/squid/commit/052cf082b0faaef4eaaa4e94119d7a1437aac4a3] | ||
17 | CVE: CVE-2023-46847 | ||
18 | Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> | ||
19 | --- | ||
20 | src/auth/digest/Config.cc | 10 +++++++--- | ||
21 | 1 file changed, 7 insertions(+), 3 deletions(-) | ||
22 | |||
23 | diff --git a/src/auth/digest/Config.cc b/src/auth/digest/Config.cc | ||
24 | index 2d25fee..4c206e1 100644 | ||
25 | --- a/src/auth/digest/Config.cc | ||
26 | +++ b/src/auth/digest/Config.cc | ||
27 | @@ -862,11 +862,15 @@ Auth::Digest::Config::decode(char const *proxy_auth, const char *aRequestRealm) | ||
28 | break; | ||
29 | |||
30 | case DIGEST_NC: | ||
31 | - if (value.size() != 8) { | ||
32 | + if (value.size() == 8) { | ||
33 | + // for historical reasons, the nc value MUST be exactly 8 bytes | ||
34 | + static_assert(sizeof(digest_request->nc) == 8 + 1, "bad nc buffer size"); | ||
35 | + xstrncpy(digest_request->nc, value.rawBuf(), value.size() + 1); | ||
36 | + debugs(29, 9, "Found noncecount '" << digest_request->nc << "'"); | ||
37 | + } else { | ||
38 | debugs(29, 9, "Invalid nc '" << value << "' in '" << temp << "'"); | ||
39 | + digest_request->nc[0] = 0; | ||
40 | } | ||
41 | - xstrncpy(digest_request->nc, value.rawBuf(), value.size() + 1); | ||
42 | - debugs(29, 9, "Found noncecount '" << digest_request->nc << "'"); | ||
43 | break; | ||
44 | |||
45 | case DIGEST_CNONCE: | ||
46 | -- | ||
47 | 2.40.1 | ||
diff --git a/meta-networking/recipes-daemons/squid/squid_4.9.bb b/meta-networking/recipes-daemons/squid/squid_4.9.bb index 19949acd8..c9a92772d 100644 --- a/meta-networking/recipes-daemons/squid/squid_4.9.bb +++ b/meta-networking/recipes-daemons/squid/squid_4.9.bb | |||
@@ -24,6 +24,7 @@ SRC_URI = "http://www.squid-cache.org/Versions/v${MAJ_VER}/${BPN}-${PV}.tar.bz2 | |||
24 | file://0001-configure-Check-for-Wno-error-format-truncation-comp.patch \ | 24 | file://0001-configure-Check-for-Wno-error-format-truncation-comp.patch \ |
25 | file://0001-tools.cc-fixed-unused-result-warning.patch \ | 25 | file://0001-tools.cc-fixed-unused-result-warning.patch \ |
26 | file://0001-splay.cc-fix-bind-is-not-a-member-of-std.patch \ | 26 | file://0001-splay.cc-fix-bind-is-not-a-member-of-std.patch \ |
27 | file://CVE-2023-46847.patch \ | ||
27 | " | 28 | " |
28 | 29 | ||
29 | SRC_URI_remove_toolchain-clang = "file://0001-configure-Check-for-Wno-error-format-truncation-comp.patch" | 30 | SRC_URI_remove_toolchain-clang = "file://0001-configure-Check-for-Wno-error-format-truncation-comp.patch" |