2 files changed, 25 insertions, 0 deletions
diff --git a/meta-oe/recipes-devtools/uw-imap/uw-imap/CVE-2018-19518.patch b/meta-oe/recipes-devtools/uw-imap/uw-imap/CVE-2018-19518.patch
new file mode 100644
index 0000000000..d942a752b3
--- /dev/null
+++ b/meta-oe/recipes-devtools/uw-imap/uw-imap/CVE-2018-19518.patch
@@ -0,0 +1,24 @@
+uw-imap (8:2007f~dfsg-6) unstable; urgency=medium
+  * [CVE-2018-19518] 2013_disable_rsh.patch (new): Disable access to IMAP
+    mailboxes through running imapd over rsh, and therefore ssh (Closes:
+    #914632). Code using the library can enable it with tcp_parameters()
+    after making sure that the IMAP server name is sanitized.
+ -- Magnus Holmgren <holmgren@debian.org>  Tue, 26 Feb 2019 23:35:43 +0100
+CVE: CVE-2018-19518
+Upstream-Status: Inactive-Upstream [lastrelease: 2007]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+--- a/src/osdep/unix/Makefile
+++ b/src/osdep/unix/Makefile
+@@ -988,7 +988,7 @@ onceenv:
+         -DMD5ENABLE=\"$(MD5PWD)\" -DMAILSPOOL=\"$(MAILSPOOL)\" \
+         -DANONYMOUSHOME=\"$(MAILSPOOL)/anonymous\" \
+         -DACTIVEFILE=\"$(ACTIVEFILE)\" -DNEWSSPOOL=\"$(NEWSSPOOL)\" \
+-        -DRSHPATH=\"$(RSHPATH)\" -DLOCKPGM=\"$(LOCKPGM)\" \
+        -DLOCKPGM=\"$(LOCKPGM)\" \
+         -DLOCKPGM1=\"$(LOCKPGM1)\" -DLOCKPGM2=\"$(LOCKPGM2)\" \
+         -DLOCKPGM3=\"$(LOCKPGM3)\" > OSCFLAGS
+        echo $(BASELDFLAGS) $(EXTRALDFLAGS) > LDFLAGS
diff --git a/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb b/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb
index 6df54ee185..54d33379da 100644
--- a/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb
+++ b/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb
@@ -17,6 +17,7 @@ SRC_URI = "https://fossies.org/linux/misc/old/imap-${PV}.tar.gz \
           file://0001-Fix-Wincompatible-function-pointer-types.patch \
           file://uw-imap-newer-tls.patch \
           file://uw-imap-fix-incompatible-pointer-types.patch \
+           file://CVE-2018-19518.patch \
           "
 SRC_URI[sha256sum] = "53e15a2b5c1bc80161d42e9f69792a3fa18332b7b771910131004eb520004a28"

diff --git a/meta-oe/recipes-devtools/uw-imap/uw-imap/CVE-2018-19518.patch b/meta-oe/recipes-devtools/uw-imap/uw-imap/CVE-2018-19518.patch new file mode 100644 index 0000000000..d942a752b3 --- /dev/null +++ b/meta-oe/recipes-devtools/uw-imap/uw-imap/CVE-2018-19518.patch
@@ -0,0 +1,24 @@
		1	uw-imap (8:2007f~dfsg-6) unstable; urgency=medium
		2
		3	* [CVE-2018-19518] 2013_disable_rsh.patch (new): Disable access to IMAP
		4	mailboxes through running imapd over rsh, and therefore ssh (Closes:
		5	#914632). Code using the library can enable it with tcp_parameters()
		6	after making sure that the IMAP server name is sanitized.
		7
		8	-- Magnus Holmgren <holmgren@debian.org> Tue, 26 Feb 2019 23:35:43 +0100
		9
		10	CVE: CVE-2018-19518
		11	Upstream-Status: Inactive-Upstream [lastrelease: 2007]
		12	Signed-off-by: Peter Marko <peter.marko@siemens.com>
		13
		14	--- a/src/osdep/unix/Makefile
		15	+++ b/src/osdep/unix/Makefile
		16	@@ -988,7 +988,7 @@ onceenv:
		17	-DMD5ENABLE=\"$(MD5PWD)\" -DMAILSPOOL=\"$(MAILSPOOL)\" \
		18	-DANONYMOUSHOME=\"$(MAILSPOOL)/anonymous\" \
		19	-DACTIVEFILE=\"$(ACTIVEFILE)\" -DNEWSSPOOL=\"$(NEWSSPOOL)\" \
		20	- -DRSHPATH=\"$(RSHPATH)\" -DLOCKPGM=\"$(LOCKPGM)\" \
		21	+ -DLOCKPGM=\"$(LOCKPGM)\" \
		22	-DLOCKPGM1=\"$(LOCKPGM1)\" -DLOCKPGM2=\"$(LOCKPGM2)\" \
		23	-DLOCKPGM3=\"$(LOCKPGM3)\" > OSCFLAGS
		24	echo $(BASELDFLAGS) $(EXTRALDFLAGS) > LDFLAGS


diff --git a/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb b/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb index 6df54ee185..54d33379da 100644 --- a/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb +++ b/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb
@@ -17,6 +17,7 @@ SRC_URI = "https://fossies.org/linux/misc/old/imap-${PV}.tar.gz \
17	file://0001-Fix-Wincompatible-function-pointer-types.patch \	17	file://0001-Fix-Wincompatible-function-pointer-types.patch \
18	file://uw-imap-newer-tls.patch \	18	file://uw-imap-newer-tls.patch \
19	file://uw-imap-fix-incompatible-pointer-types.patch \	19	file://uw-imap-fix-incompatible-pointer-types.patch \
		20	file://CVE-2018-19518.patch \
20	"	21	"
21		22
22	SRC_URI[sha256sum] = "53e15a2b5c1bc80161d42e9f69792a3fa18332b7b771910131004eb520004a28"	23	SRC_URI[sha256sum] = "53e15a2b5c1bc80161d42e9f69792a3fa18332b7b771910131004eb520004a28"