pwouters pushed to rpms/strongswan (f38). "- Resolves:
CVE-2023-26463 authorization bypass in TLS-based EAP methods"
by notifications@fedoraproject.org
Notification time stamped 2023-03-01 00:26:10 UTC
From 33fb3b13a38c25dcf57c3837539693d779d7012d Mon Sep 17 00:00:00 2001
From: Paul Wouters <paul.wouters(a)aiven.io>
Date: Feb 28 2023 22:38:50 +0000
Subject: - Resolves: CVE-2023-26463 authorization bypass in TLS-based EAP methods
---
diff --git a/strongswan-5.9.8-5.9.9_tls_auth_bypass_exp_pointer.patch b/strongswan-5.9.8-5.9.9_tls_auth_bypass_exp_pointer.patch
new file mode 100644
index 0000000..b63e6c5
--- /dev/null
+++ b/strongswan-5.9.8-5.9.9_tls_auth_bypass_exp_pointer.patch
@@ -0,0 +1,48 @@
+From 980750bde07136255784d6ef6cdb5c085d30e2f9 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias(a)strongswan.org>
+Date: Fri, 17 Feb 2023 15:07:20 +0100
+Subject: [PATCH] libtls: Fix authentication bypass and expired pointer
+ dereference
+
+`public` is returned, but previously only if a trusted key was found.
+We obviously don't want to return untrusted keys. However, since the
+reference is released after determining the key type, the returned
+object also doesn't have the correct refcount.
+
+So when the returned reference is released after verifying the TLS
+signature, the public key object is actually destroyed. The certificate
+object then points to an expired pointer, which is dereferenced once it
+itself is destroyed after the authentication is complete. Depending on
+whether the pointer is valid (i.e. points to memory allocated to the
+process) and what was allocated there after the public key was freed,
+this could result in a segmentation fault or even code execution.
+
+Fixes: 63fd718915b5 ("libtls: call create_public_enumerator() with key_type")
+Fixes: CVE-2023-26463
+---
+ src/libtls/tls_server.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c
+index c9c300917dd6..573893f2efb5 100644
+--- a/src/libtls/tls_server.c
++++ b/src/libtls/tls_server.c
+@@ -183,11 +183,11 @@ public_key_t *tls_find_public_key(auth_cfg_t *peer_auth, identification_t *id)
+ cert = peer_auth->get(peer_auth, AUTH_HELPER_SUBJECT_CERT);
+ if (cert)
+ {
+- public = cert->get_public_key(cert);
+- if (public)
++ current = cert->get_public_key(cert);
++ if (current)
+ {
+- key_type = public->get_type(public);
+- public->destroy(public);
++ key_type = current->get_type(current);
++ current->destroy(current);
+ }
+ enumerator = lib->credmgr->create_public_enumerator(lib->credmgr,
+ key_type, id, peer_auth, TRUE);
+--
+2.25.1
+
diff --git a/strongswan.spec b/strongswan.spec
index 4a17976..9704c91 100644
--- a/strongswan.spec
+++ b/strongswan.spec
@@ -16,7 +16,7 @@
Name: strongswan
Version: 5.9.9
-Release: 2%{?dist}
+Release: 3%{?dist}
Summary: An OpenSource IPsec-based VPN and TNC solution
License: GPLv2+
URL: https://www.strongswan.org/
@@ -31,6 +31,7 @@ Patch1: strongswan-5.9.7-error-no-format.patch
# https://github.com/strongswan/strongswan/pull/1511
# https://github.com/strongswan/strongswan/commit/e99de2aee9f26e3ab97d88902...
Patch2: strongswan-5.9.9-man-paths.patch
+Patch3: strongswan-5.9.8-5.9.9_tls_auth_bypass_exp_pointer.patch
BuildRequires: autoconf
BuildRequires: automake
@@ -419,6 +420,9 @@ install -D -m 0644 %{SOURCE3} %{buildroot}/%{_tmpfilesdir}/strongswan-starter.co
%endif
%changelog
+* Tue Feb 28 2023 Paul Wouters <paul.wouters(a)aiven.io - 5.9.9-3
+- Resolves: CVE-2023-26463 authorization bypass in TLS-based EAP methods
+
* Mon Jan 16 2023 Petr Menšík <pemensik(a)redhat.com> - 5.9.9-2
- Use configure paths in manual pages (#2106120)
https://src.fedoraproject.org/rpms/strongswan/c/33fb3b13a38c25dcf57c38375...
1 year, 1 month
sergiomb pushed to rpms/libcomps (rawhide). "Update libcomps to 0.1.19"
by notifications@fedoraproject.org
Notification time stamped 2023-02-28 23:56:21 UTC
From c63d0c6f06e37c3f00b0f482b533d4e426ad762f Mon Sep 17 00:00:00 2001
From: Sérgio M. Basto <sergio(a)serjux.com>
Date: Feb 28 2023 23:52:58 +0000
Subject: Update libcomps to 0.1.19
---
diff --git a/libcomps.spec b/libcomps.spec
index 6c07e92..5d41877 100644
--- a/libcomps.spec
+++ b/libcomps.spec
@@ -1,11 +1,11 @@
%define __cmake_in_source_build 1
Name: libcomps
-Version: 0.1.18
-Release: 6%{?dist}
+Version: 0.1.19
+Release: 1%{?dist}
Summary: Comps XML file manipulation library
-License: GPLv2+
+License: GPL-2.0-or-later
URL: https://github.com/rpm-software-management/libcomps
Source0: %{url}/archive/%{version}/%{name}-%{version}.tar.gz
@@ -116,6 +116,10 @@ popd
%{python3_sitearch}/%{name}-%{version}-py%{python3_version}.egg-info
%changelog
+* Tue Feb 28 2023 Sérgio Basto <sergio(a)serjux.com> - 0.1.19-1
+- Update libcomps to 0.1.19
+- Migrated to SPDX license
+
* Tue Feb 28 2023 Miro Hrončok <mhroncok(a)redhat.com> - 0.1.18-6
- BuildRequire python3-setuptools explicitly, don't assume they are pulled transitively
diff --git a/sources b/sources
index bd554d4..581859e 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (libcomps-0.1.18.tar.gz) = 9aa150a8bbfea85f57f043c928c050062d3a04adedfbfd635dd5eed396feed82a46dee8eaa52342a3afe95f5f816807556636ebe5aa691148988690d11c45ac8
+SHA512 (libcomps-0.1.19.tar.gz) = a85a0d0e3ea4f944464908a7a95da52f7d28978e0894af2e113d7929cf7bc96685e4b54e4ddff184af6ce1cfa08391fe94a1f6ec97992b3640d693d0ef07ee2e
https://src.fedoraproject.org/rpms/libcomps/c/c63d0c6f06e37c3f00b0f482b53...
1 year, 1 month
tstellar pushed to rpms/clang (upstream-snapshot). "Add workaround
for build failure on i386/f36 (..more)"
by notifications@fedoraproject.org
Notification time stamped 2023-02-28 23:53:34 UTC
From 6717a1e18a77ad13c70b59198915fa330880434b Mon Sep 17 00:00:00 2001
From: Tom Stellard <tstellar(a)redhat.com>
Date: Feb 28 2023 23:31:48 +0000
Subject: Add workaround for build failure on i386/f36
https://github.com/llvm/llvm-project/issues/45130
---
diff --git a/.copr/Makefile b/.copr/Makefile
index be16732..274ce72 100644
--- a/.copr/Makefile
+++ b/.copr/Makefile
@@ -7,6 +7,7 @@ srpm:
dnf copr enable -y --setopt=reposdir=/tmp/yum.repos.d @fedora-llvm-team/llvm-snapshot-builder
dnf install -y --setopt=reposdir=/tmp/yum.repos.d llvm-snapshot-builder
rpmbuild \
+ --define "yyyymmdd 20230228" \
--define "_srcrpmdir $(outdir)" \
--define "_sourcedir $(shell pwd)" \
--define "_disable_source_fetch 0" \
diff --git a/0001-clangd-Link-with-latomic.patch b/0001-clangd-Link-with-latomic.patch
new file mode 100644
index 0000000..10393d9
--- /dev/null
+++ b/0001-clangd-Link-with-latomic.patch
@@ -0,0 +1,30 @@
+From 57127e50bf3cca9f6b9222aea734bc1d232bbb0d Mon Sep 17 00:00:00 2001
+From: Tom Stellard <tstellar(a)redhat.com>
+Date: Tue, 28 Feb 2023 19:46:50 +0000
+Subject: [PATCH] clangd: Link with -latomic
+
+This fixes the build with clang-14.
+
+https://github.com/llvm/llvm-project/issues/45130
+---
+ clang-tools-extra/clangd/support/CMakeLists.txt | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/clang-tools-extra/clangd/support/CMakeLists.txt b/clang-tools-extra/clangd/support/CMakeLists.txt
+index 0c8c199dd4a4..099f3aa89ef4 100644
+--- a/clang-tools-extra/clangd/support/CMakeLists.txt
++++ b/clang-tools-extra/clangd/support/CMakeLists.txt
+@@ -11,9 +11,7 @@ if(CLANG_BUILT_STANDALONE)
+ endif()
+
+ set(CLANGD_ATOMIC_LIB "")
+-if(NOT HAVE_CXX_ATOMICS_WITHOUT_LIB OR NOT HAVE_CXX_ATOMICS64_WITHOUT_LIB)
+- list(APPEND CLANGD_ATOMIC_LIB "atomic")
+-endif()
++list(APPEND CLANGD_ATOMIC_LIB "atomic")
+
+ add_clang_library(clangdSupport
+ Cancellation.cpp
+--
+2.35.1
+
diff --git a/clang.spec b/clang.spec
index 4b5196d..ba36150 100644
--- a/clang.spec
+++ b/clang.spec
@@ -94,6 +94,8 @@ Patch8: D138472.diff
# Patches for clang-tools-extra
# See https://reviews.llvm.org/D120301
Patch201: 0001-clang-tools-extra-Make-test-dependency-on-LLVMHello-.patch
+# Work-around for https://github.com/llvm/llvm-project/issues/45130
+Patch301: 0001-clangd-Link-with-latomic.patch
%endif
BuildRequires: clang
@@ -291,7 +293,10 @@ mv %{cmake_srcdir} cmake
%endif
%setup -T -q -b 1 -n %{clang_tools_srcdir}
-%autopatch -m200 -p2
+%autopatch -m200 -M300 -p2
+%if 0%{?fedora} == 36
+%autopatch 301 -p2
+%endif
# failing test case
https://src.fedoraproject.org/rpms/clang/c/6717a1e18a77ad13c70b59198915fa...
1 year, 1 month