summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorYue Tao <Yue.Tao@windriver.com>2014-10-22 03:37:29 -0400
committerRichard Purdie <richard.purdie@linuxfoundation.org>2014-11-04 10:27:08 +0000
commita64e37ac0e3eeb5af9c20273e9ff4cc25e873a4c (patch)
treede859bbb0b5fc44d2b19547751a7c5019fd6e72f /meta
parent514a91df49b0d358c26818c40e9e281a98fba8db (diff)
downloadpoky-a64e37ac0e3eeb5af9c20273e9ff4cc25e873a4c.tar.gz
subversion: Security Advisory - subversion - CVE-2014-3528
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3528 (From OE-Core rev: e0dc0432b13f38d16f642bdadf8ebc78b7a74806) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-devtools/subversion/subversion/subversion-CVE-2014-3528.patch29
-rw-r--r--meta/recipes-devtools/subversion/subversion_1.6.15.bb1
-rw-r--r--meta/recipes-devtools/subversion/subversion_1.8.9.bb1
3 files changed, 31 insertions, 0 deletions
diff --git a/meta/recipes-devtools/subversion/subversion/subversion-CVE-2014-3528.patch b/meta/recipes-devtools/subversion/subversion/subversion-CVE-2014-3528.patch
new file mode 100644
index 0000000000..23e738e985
--- /dev/null
+++ b/meta/recipes-devtools/subversion/subversion/subversion-CVE-2014-3528.patch
@@ -0,0 +1,29 @@
1Upstream-Status: Backport
2
3Signed-off-by: Yue Tao <yue.tao@windriver.com>
4
5diff --git a/subversion/libsvn_subr/config_auth.c.old b/subversion/libsvn_subr/config_auth.c
6index ff50270..c511d04 100644
7--- a/subversion/libsvn_subr/config_auth.c.old
8+++ b/subversion/libsvn_subr/config_auth.c
9@@ -85,6 +85,7 @@ svn_config_read_auth_data(apr_hash_t **hash,
10 if (kind == svn_node_file)
11 {
12 svn_stream_t *stream;
13+ svn_string_t *stored_realm;
14
15 SVN_ERR_W(svn_stream_open_readonly(&stream, auth_path, pool, pool),
16 _("Unable to open auth file for reading"));
17@@ -95,6 +96,12 @@ svn_config_read_auth_data(apr_hash_t **hash,
18 apr_psprintf(pool, _("Error parsing '%s'"),
19 svn_path_local_style(auth_path, pool)));
20
21+ stored_realm = apr_hash_get(*hash, SVN_CONFIG_REALMSTRING_KEY,
22+ APR_HASH_KEY_STRING);
23+
24+ if (!stored_realm || strcmp(stored_realm->data, realmstring) != 0)
25+ *hash = NULL; /* Hash collision, or somebody tampering with storage */
26+
27 SVN_ERR(svn_stream_close(stream));
28 }
29
diff --git a/meta/recipes-devtools/subversion/subversion_1.6.15.bb b/meta/recipes-devtools/subversion/subversion_1.6.15.bb
index 6680ab6d34..b135bb7a3f 100644
--- a/meta/recipes-devtools/subversion/subversion_1.6.15.bb
+++ b/meta/recipes-devtools/subversion/subversion_1.6.15.bb
@@ -19,6 +19,7 @@ SRC_URI = "http://subversion.tigris.org/downloads/${BPN}-${PV}.tar.bz2 \
19 file://subversion-CVE-2013-1847-CVE-2013-1846.patch \ 19 file://subversion-CVE-2013-1847-CVE-2013-1846.patch \
20 file://subversion-CVE-2013-4277.patch \ 20 file://subversion-CVE-2013-4277.patch \
21 file://subversion-CVE-2014-3522.patch \ 21 file://subversion-CVE-2014-3522.patch \
22 file://subversion-CVE-2014-3528.patch \
22" 23"
23 24
24SRC_URI[md5sum] = "113fca1d9e4aa389d7dc2b210010fa69" 25SRC_URI[md5sum] = "113fca1d9e4aa389d7dc2b210010fa69"
diff --git a/meta/recipes-devtools/subversion/subversion_1.8.9.bb b/meta/recipes-devtools/subversion/subversion_1.8.9.bb
index e1ab945896..1ef59a0c00 100644
--- a/meta/recipes-devtools/subversion/subversion_1.8.9.bb
+++ b/meta/recipes-devtools/subversion/subversion_1.8.9.bb
@@ -13,6 +13,7 @@ SRC_URI = "${APACHE_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \
13 file://libtool2.patch \ 13 file://libtool2.patch \
14 file://disable_macos.patch \ 14 file://disable_macos.patch \
15 file://subversion-CVE-2014-3522.patch;striplevel=0 \ 15 file://subversion-CVE-2014-3522.patch;striplevel=0 \
16 file://subversion-CVE-2014-3528.patch \
16" 17"
17SRC_URI[md5sum] = "bd495517a760ddd764ce449a891971db" 18SRC_URI[md5sum] = "bd495517a760ddd764ce449a891971db"
18SRC_URI[sha256sum] = "45d708a5c3ffbef4b2a1044c4716a053e680763743d1f7ba99d0369f6da49e33" 19SRC_URI[sha256sum] = "45d708a5c3ffbef4b2a1044c4716a053e680763743d1f7ba99d0369f6da49e33"