commit 94085419d84e7bfb74c950be3debb4f8890dd9b5
Author: Sam Kottler <shk(a)linux.com>
Date: Wed Apr 30 21:04:19 2014 -0400
Add patch for CVE-2014-2913 (BZ#1089879)
nrpe-0009-CVE-2014-2913-nasty-metacharacters.patch | 13 +++++++++++++
nrpe.spec | 12 +++++++++++-
2 files changed, 24 insertions(+), 1 deletions(-)
---
diff --git a/nrpe-0009-CVE-2014-2913-nasty-metacharacters.patch
b/nrpe-0009-CVE-2014-2913-nasty-metacharacters.patch
new file mode 100644
index 0000000..556f449
--- /dev/null
+++ b/nrpe-0009-CVE-2014-2913-nasty-metacharacters.patch
@@ -0,0 +1,13 @@
+diff --git b/src/nrpe.c a/src/nrpe.c
+index 381f0ac..ad1e05d 100644
+--- b/src/nrpe.c
++++ a/src/nrpe.c
+@@ -53,7 +53,7 @@ int use_ssl=FALSE;
+
+ #define DEFAULT_COMMAND_TIMEOUT 60 /* default timeout for execution of plugins */
+ #define MAXFD 64
+-#define NASTY_METACHARS "|`&><'\"\\[]{};"
++#define NASTY_METACHARS "|`&><'\"\\[]{};\n"
+ #define howmany(x,y) (((x)+((y)-1))/(y))
+ #define MAX_LISTEN_SOCKS 16
+
diff --git a/nrpe.spec b/nrpe.spec
index 4db58d1..a0f82f0 100644
--- a/nrpe.spec
+++ b/nrpe.spec
@@ -5,7 +5,7 @@
Name: nrpe
Version: 2.15
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: Host/service/network monitoring agent for Nagios
Group: Applications/System
@@ -23,6 +23,11 @@ Patch5: nrpe-0005-Do-not-start-by-default.patch
Patch6: nrpe-0006-Relocate-pid-file.patch
Patch7: nrpe-0007-Add-condrestart-try-restart-target-to-initscript.patch
Patch8: nrpe-0008-Allow-user-to-override-all-defaults-even-command-def.patch
+# This should get removed whenever 2.16 is released, assuming it has the fix
+# included.
http://seclists.org/oss-sec/2014/q2/129. There's not upstream
+# concensus that quoting arguments in a mode which is widely agreed upon to be
+# risky so track upstream discussions here, too.
+Patch9: nrpe-0009-CVE-2014-2913-nasty-metacharacters.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -94,6 +99,8 @@ This package provides the nrpe plugin for Nagios-related applications.
%patch6 -p1 -b .relocate_pid
%patch7 -p1 -b .condrestart
%patch8 -p1 -b .allow_override
+%patch9 -p1
+
# Allow building for aarch64
#
https://bugzilla.redhat.com/926244
%if 0%{?fedora} > 17 || 0%{?rhel} > 6
@@ -192,6 +199,9 @@ fi
%doc Changelog LEGAL README
%changelog
+* Thu May 1 2014 Sam Kottler <skottler(a)fedoraproject.org> - 2.15.2
+- Add patch to mitigate CVE-2014-2913
+
* Mon Jan 27 2014 Sam Kottler <skottler(a)fedoraproject.org> - 2.15.1
- Update to 2.15