diff options
author | Chen Qi <Qi.Chen@windriver.com> | 2021-04-25 13:32:52 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2021-05-04 22:57:51 +0100 |
commit | 2d5f42e6fa4a45d1c9e430c126d947c630b17b2d (patch) | |
tree | 58e2d968a54a9e3583fb3607ec83c3493a8bbb3b /meta/recipes-devtools/rsync | |
parent | 70fb6c0d86ce1d1a1715904056bdd0d95225b6b3 (diff) | |
download | poky-2d5f42e6fa4a45d1c9e430c126d947c630b17b2d.tar.gz |
rsync: fix CVE-2020-14387
Backport patch to fix CVE-2020-14387.
(From OE-Core rev: 940111cefa459bc7a5fd9de1cf70b2040ffb5229)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5e7a536d07856630e4eb421614c8d823c67e0294)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/rsync')
-rw-r--r-- | meta/recipes-devtools/rsync/files/0001-rsync-ssl-Verify-the-hostname-in-the-certificate-whe.patch | 31 | ||||
-rw-r--r-- | meta/recipes-devtools/rsync/rsync_3.2.3.bb | 1 |
2 files changed, 32 insertions, 0 deletions
diff --git a/meta/recipes-devtools/rsync/files/0001-rsync-ssl-Verify-the-hostname-in-the-certificate-whe.patch b/meta/recipes-devtools/rsync/files/0001-rsync-ssl-Verify-the-hostname-in-the-certificate-whe.patch new file mode 100644 index 0000000000..2d51ddf965 --- /dev/null +++ b/meta/recipes-devtools/rsync/files/0001-rsync-ssl-Verify-the-hostname-in-the-certificate-whe.patch | |||
@@ -0,0 +1,31 @@ | |||
1 | From fbe85634d88e82fbb439ae2a5d1aca8b8c309bea Mon Sep 17 00:00:00 2001 | ||
2 | From: Matt McCutchen <matt@mattmccutchen.net> | ||
3 | Date: Wed, 26 Aug 2020 12:16:08 -0400 | ||
4 | Subject: [PATCH] rsync-ssl: Verify the hostname in the certificate when using | ||
5 | openssl. | ||
6 | |||
7 | CVE: CVE-2020-14387 | ||
8 | |||
9 | Upstream-Status: Backport [https://git.samba.org/?p=rsync.git;a=commit;h=c3f7414] | ||
10 | |||
11 | Signed-off-by: Chen Qi <Qi.Chen@windriver.com> | ||
12 | --- | ||
13 | rsync-ssl | 2 +- | ||
14 | 1 file changed, 1 insertion(+), 1 deletion(-) | ||
15 | |||
16 | diff --git a/rsync-ssl b/rsync-ssl | ||
17 | index 8101975..46701af 100755 | ||
18 | --- a/rsync-ssl | ||
19 | +++ b/rsync-ssl | ||
20 | @@ -129,7 +129,7 @@ function rsync_ssl_helper { | ||
21 | fi | ||
22 | |||
23 | if [[ $RSYNC_SSL_TYPE == openssl ]]; then | ||
24 | - exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt -quiet -verify_quiet -servername $hostname -connect $hostname:$port | ||
25 | + exec $RSYNC_SSL_OPENSSL s_client $caopt $certopt -quiet -verify_quiet -servername $hostname -verify_hostname $hostname -connect $hostname:$port | ||
26 | elif [[ $RSYNC_SSL_TYPE == gnutls ]]; then | ||
27 | exec $RSYNC_SSL_GNUTLS --logfile=/dev/null $gnutls_cert_opt $gnutls_opts $hostname:$port | ||
28 | else | ||
29 | -- | ||
30 | 2.17.1 | ||
31 | |||
diff --git a/meta/recipes-devtools/rsync/rsync_3.2.3.bb b/meta/recipes-devtools/rsync/rsync_3.2.3.bb index 8b36a8ebde..cb18667755 100644 --- a/meta/recipes-devtools/rsync/rsync_3.2.3.bb +++ b/meta/recipes-devtools/rsync/rsync_3.2.3.bb | |||
@@ -14,6 +14,7 @@ SRC_URI = "https://download.samba.org/pub/${BPN}/src/${BP}.tar.gz \ | |||
14 | file://rsyncd.conf \ | 14 | file://rsyncd.conf \ |
15 | file://makefile-no-rebuild.patch \ | 15 | file://makefile-no-rebuild.patch \ |
16 | file://determism.patch \ | 16 | file://determism.patch \ |
17 | file://0001-rsync-ssl-Verify-the-hostname-in-the-certificate-whe.patch \ | ||
17 | " | 18 | " |
18 | 19 | ||
19 | SRC_URI[sha256sum] = "becc3c504ceea499f4167a260040ccf4d9f2ef9499ad5683c179a697146ce50e" | 20 | SRC_URI[sha256sum] = "becc3c504ceea499f4167a260040ccf4d9f2ef9499ad5683c179a697146ce50e" |