commit 94085419d84e7bfb74c950be3debb4f8890dd9b5 Author: Sam Kottler shk@linux.com Date: Wed Apr 30 21:04:19 2014 -0400

Add patch for CVE-2014-2913 (BZ#1089879)

nrpe-0009-CVE-2014-2913-nasty-metacharacters.patch | 13 +++++++++++++ nrpe.spec | 12 +++++++++++- 2 files changed, 24 insertions(+), 1 deletions(-) --- diff --git a/nrpe-0009-CVE-2014-2913-nasty-metacharacters.patch b/nrpe-0009-CVE-2014-2913-nasty-metacharacters.patch new file mode 100644 index 0000000..556f449 --- /dev/null +++ b/nrpe-0009-CVE-2014-2913-nasty-metacharacters.patch @@ -0,0 +1,13 @@ +diff --git b/src/nrpe.c a/src/nrpe.c +index 381f0ac..ad1e05d 100644 +--- b/src/nrpe.c ++++ a/src/nrpe.c +@@ -53,7 +53,7 @@ int use_ssl=FALSE; + + #define DEFAULT_COMMAND_TIMEOUT 60 /* default timeout for execution of plugins */ + #define MAXFD 64 +-#define NASTY_METACHARS "|`&><'"\[]{};" ++#define NASTY_METACHARS "|`&><'"\[]{};\n" + #define howmany(x,y) (((x)+((y)-1))/(y)) + #define MAX_LISTEN_SOCKS 16 + diff --git a/nrpe.spec b/nrpe.spec index 4db58d1..a0f82f0 100644 --- a/nrpe.spec +++ b/nrpe.spec @@ -5,7 +5,7 @@

Name: nrpe Version: 2.15 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Host/service/network monitoring agent for Nagios

Group: Applications/System @@ -23,6 +23,11 @@ Patch5: nrpe-0005-Do-not-start-by-default.patch Patch6: nrpe-0006-Relocate-pid-file.patch Patch7: nrpe-0007-Add-condrestart-try-restart-target-to-initscript.patch Patch8: nrpe-0008-Allow-user-to-override-all-defaults-even-command-def.patch +# This should get removed whenever 2.16 is released, assuming it has the fix +# included. http://seclists.org/oss-sec/2014/q2/129. There's not upstream +# concensus that quoting arguments in a mode which is widely agreed upon to be +# risky so track upstream discussions here, too. +Patch9: nrpe-0009-CVE-2014-2913-nasty-metacharacters.patch

BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

@@ -94,6 +99,8 @@ This package provides the nrpe plugin for Nagios-related applications. %patch6 -p1 -b .relocate_pid %patch7 -p1 -b .condrestart %patch8 -p1 -b .allow_override +%patch9 -p1 + # Allow building for aarch64 # https://bugzilla.redhat.com/926244 %if 0%{?fedora} > 17 || 0%{?rhel} > 6 @@ -192,6 +199,9 @@ fi %doc Changelog LEGAL README

%changelog +* Thu May 1 2014 Sam Kottler skottler@fedoraproject.org - 2.15.2 +- Add patch to mitigate CVE-2014-2913 + * Mon Jan 27 2014 Sam Kottler skottler@fedoraproject.org - 2.15.1 - Update to 2.15