summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChen Qi <Qi.Chen@windriver.com>2021-04-25 13:32:52 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2021-05-05 17:43:23 +0100
commit1c8bded8ed7139ddac2e05c06f4eec65fb840191 (patch)
treea950b10e35dd55438404c1413b41a8b04c39a094
parentb492191d87b080304a9d4f2efe0f7c377f6f9438 (diff)
downloadpoky-1c8bded8ed7139ddac2e05c06f4eec65fb840191.tar.gz
rsync: fix CVE-2020-14387
Backport patch to fix CVE-2020-14387. (From OE-Core rev: fd18be85b77488cfac72e9703940764615e37e98) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 13f331436747ebb8e9211feee3aa774f1acd0fee) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-devtools/rsync/files/0001-rsync-ssl-Verify-the-hostname-in-the-certificate-whe.patch31
-rw-r--r--meta/recipes-devtools/rsync/rsync_3.2.3.bb1
2 files changed, 32 insertions, 0 deletions
diff --git a/meta/recipes-devtools/rsync/files/0001-rsync-ssl-Verify-the-hostname-in-the-certificate-whe.patch b/meta/recipes-devtools/rsync/files/0001-rsync-ssl-Verify-the-hostname-in-the-certificate-whe.patch
new file mode 100644
index 0000000000..2d51ddf965
--- /dev/null
+++ b/meta/recipes-devtools/rsync/files/0001-rsync-ssl-Verify-the-hostname-in-the-certificate-whe.patch
@@ -0,0 +1,31 @@
1From fbe85634d88e82fbb439ae2a5d1aca8b8c309bea Mon Sep 17 00:00:00 2001
2From: Matt McCutchen <matt@mattmccutchen.net>
3Date: Wed, 26 Aug 2020 12:16:08 -0400
4Subject: [PATCH] rsync-ssl: Verify the hostname in the certificate when using
5 openssl.
6
7CVE: CVE-2020-14387
8
9Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=c3f7414]
10
11Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
12---
13 rsync-ssl | 2 +-
14 1 file changed, 1 insertion(+), 1 deletion(-)
15
16diff --git a/rsync-ssl b/rsync-ssl
17index 8101975..46701af 100755
18--- a/rsync-ssl
19+++ b/rsync-ssl
20@@ -129,7 +129,7 @@ function rsync_ssl_helper {
21 fi
22
23 if [[ $RSYNC_SSL_TYPE == openssl ]]; then
24- exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt -quiet -verify_quiet -servername $hostname -connect $hostname:$port
25+ exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt -quiet -verify_quiet -servername $hostname -verify_hostname $hostname -connect $hostname:$port
26 elif [[ $RSYNC_SSL_TYPE == gnutls ]]; then
27 exec $RSYNC_SSL_GNUTLS --logfile=/dev/null $gnutls_cert_opt $gnutls_opts $hostname:$port
28 else
29--
302.17.1
31
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.3.bb b/meta/recipes-devtools/rsync/rsync_3.2.3.bb
index e6a3a67881..df4fbbd0d2 100644
--- a/meta/recipes-devtools/rsync/rsync_3.2.3.bb
+++ b/meta/recipes-devtools/rsync/rsync_3.2.3.bb
@@ -13,6 +13,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \
13 file://rsyncd.conf \ 13 file://rsyncd.conf \
14 file://makefile-no-rebuild.patch \ 14 file://makefile-no-rebuild.patch \
15 file://determism.patch \ 15 file://determism.patch \
16 file://0001-rsync-ssl-Verify-the-hostname-in-the-certificate-whe.patch \
16 " 17 "
17 18
18SRC_URI[sha256sum] = "becc3c504ceea499f4167a260040ccf4d9f2ef9499ad5683c179a697146ce50e" 19SRC_URI[sha256sum] = "becc3c504ceea499f4167a260040ccf4d9f2ef9499ad5683c179a697146ce50e"