!98 fix CVE-2025-46420 CVE-2025-46421
From: @zppzhangpan Reviewed-by: @t_feng Signed-off-by: @t_feng
This commit is contained in:
openeuler-ci-bot
Gitee
commit
911f2e6878
60
backport-CVE-2025-46420.patch
Normal file
60
backport-CVE-2025-46420.patch
Normal file
@ -0,0 +1,60 @@
|
||||
From c9083869ec2a3037e6df4bd86b45c419ba295f8e Mon Sep 17 00:00:00 2001
|
||||
From: Patrick Griffis <pgriffis@igalia.com>
|
||||
Date: Thu, 26 Dec 2024 18:31:42 -0600
|
||||
Subject: [PATCH] soup_header_parse_quality_list: Fix leak
|
||||
|
||||
When iterating over the parsed list we now steal the allocated strings that we want and then free_full the list which may contain remaining strings.
|
||||
|
||||
Conflict: NA
|
||||
Reference: https://gitlab.gnome.org/GNOME/libsoup/-/commit/c9083869ec2a3037e6df4bd86b45c419ba295f8e
|
||||
|
||||
---
|
||||
libsoup/soup-headers.c | 11 +++++------
|
||||
1 file changed, 5 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
|
||||
index a5f7a7f6..85385cea 100644
|
||||
--- a/libsoup/soup-headers.c
|
||||
+++ b/libsoup/soup-headers.c
|
||||
@@ -530,7 +530,7 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
|
||||
GSList *unsorted;
|
||||
QualityItem *array;
|
||||
GSList *sorted, *iter;
|
||||
- char *item, *semi;
|
||||
+ char *semi;
|
||||
const char *param, *equal, *value;
|
||||
double qval;
|
||||
int n;
|
||||
@@ -543,9 +543,8 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
|
||||
unsorted = soup_header_parse_list (header);
|
||||
array = g_new0 (QualityItem, g_slist_length (unsorted));
|
||||
for (iter = unsorted, n = 0; iter; iter = iter->next) {
|
||||
- item = iter->data;
|
||||
qval = 1.0;
|
||||
- for (semi = strchr (item, ';'); semi; semi = strchr (semi + 1, ';')) {
|
||||
+ for (semi = strchr (iter->data, ';'); semi; semi = strchr (semi + 1, ';')) {
|
||||
param = skip_lws (semi + 1);
|
||||
if (*param != 'q')
|
||||
continue;
|
||||
@@ -577,15 +576,15 @@ soup_header_parse_quality_list (const char *header, GSList **unacceptable)
|
||||
if (qval == 0.0) {
|
||||
if (unacceptable) {
|
||||
*unacceptable = g_slist_prepend (*unacceptable,
|
||||
- item);
|
||||
+ g_steal_pointer (&iter->data));
|
||||
}
|
||||
} else {
|
||||
- array[n].item = item;
|
||||
+ array[n].item = g_steal_pointer (&iter->data);
|
||||
array[n].qval = qval;
|
||||
n++;
|
||||
}
|
||||
}
|
||||
- g_slist_free (unsorted);
|
||||
+ g_slist_free_full (unsorted, g_free);
|
||||
|
||||
qsort (array, n, sizeof (QualityItem), sort_by_qval);
|
||||
sorted = NULL;
|
||||
--
|
||||
GitLab
|
||||
|
||||
138
backport-CVE-2025-46421.patch
Normal file
138
backport-CVE-2025-46421.patch
Normal file
@ -0,0 +1,138 @@
|
||||
From 3e5c26415811f19e7737238bb23305ffaf96f66b Mon Sep 17 00:00:00 2001
|
||||
From: Patrick Griffis <pgriffis@igalia.com>
|
||||
Date: Wed, 5 Feb 2025 16:18:10 -0600
|
||||
Subject: [PATCH] session: Strip authentication credentails on cross-origin
|
||||
redirect
|
||||
|
||||
This should match the behavior of Firefox and Safari but not of Chromium.
|
||||
|
||||
Conflict: Context Adaptation and Test Case Adaptation and soup_message_headers_remove_common->soup_message_headers_remove,soup_message_get_request_headers (msg)->msg->request_headers,SOUP_HEADER_AUTHORIZATION->"Authorization"
|
||||
Reference: https://gitlab.gnome.org/GNOME/libsoup/-/commit/3e5c26415811f19e7737238bb23305ffaf96f66b
|
||||
|
||||
---
|
||||
libsoup/soup-session.c | 6 ++++
|
||||
tests/auth-test.c | 77 ++++++++++++++++++++++++++++++++++++++++++
|
||||
2 files changed, 83 insertions(+)
|
||||
|
||||
diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
|
||||
index 83421ef..7ff53ab 100644
|
||||
--- a/libsoup/soup-session.c
|
||||
+++ b/libsoup/soup-session.c
|
||||
@@ -1189,6 +1189,12 @@ soup_session_redirect_message (SoupSession *session, SoupMessage *msg)
|
||||
SOUP_ENCODING_NONE);
|
||||
}
|
||||
|
||||
+ /* Strip all credentials on cross-origin redirect. */
|
||||
+ if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) {
|
||||
+ soup_message_headers_remove (msg->request_headers, "Authorization");
|
||||
+ soup_message_set_auth (msg, NULL);
|
||||
+ }
|
||||
+
|
||||
soup_message_set_uri (msg, new_uri);
|
||||
soup_uri_free (new_uri);
|
||||
|
||||
diff --git a/tests/auth-test.c b/tests/auth-test.c
|
||||
index 548ac94..e71f986 100644
|
||||
--- a/tests/auth-test.c
|
||||
+++ b/tests/auth-test.c
|
||||
@@ -1,6 +1,7 @@
|
||||
/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
|
||||
|
||||
#include "test-utils.h"
|
||||
+#include "soup-uri-utils-private.h"
|
||||
|
||||
static const char *base_uri;
|
||||
static GMainLoop *loop;
|
||||
@@ -1599,6 +1600,81 @@ do_missing_params_test (gconstpointer auth_header)
|
||||
soup_test_server_quit_unref (server);
|
||||
}
|
||||
|
||||
+static void
|
||||
+redirect_server_callback (SoupServer *server,
|
||||
+ SoupServerMessage *msg,
|
||||
+ const char *path,
|
||||
+ GHashTable *query,
|
||||
+ gpointer user_data)
|
||||
+{
|
||||
+ static gboolean redirected = FALSE;
|
||||
+
|
||||
+ if (!redirected) {
|
||||
+ char *redirect_uri = g_uri_to_string (user_data);
|
||||
+ soup_server_message_set_redirect (msg, SOUP_STATUS_MOVED_PERMANENTLY, redirect_uri);
|
||||
+ g_free (redirect_uri);
|
||||
+ redirected = TRUE;
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ g_assert_not_reached ();
|
||||
+}
|
||||
+
|
||||
+static gboolean
|
||||
+auth_for_redirect_callback (SoupMessage *msg, SoupAuth *auth, gboolean retrying, gpointer user_data)
|
||||
+{
|
||||
+ GUri *known_server_uri = user_data;
|
||||
+
|
||||
+ if (!soup_uri_host_equal (known_server_uri, soup_message_get_uri (msg)))
|
||||
+ return FALSE;
|
||||
+
|
||||
+ soup_auth_authenticate (auth, "user", "good-basic");
|
||||
+
|
||||
+ return TRUE;
|
||||
+}
|
||||
+
|
||||
+static void
|
||||
+do_strip_on_crossorigin_redirect (void)
|
||||
+{
|
||||
+ SoupSession *session;
|
||||
+ SoupMessage *msg;
|
||||
+ SoupServer *server1, *server2;
|
||||
+ SoupAuthDomain *auth_domain;
|
||||
+ GUri *uri;
|
||||
+ gint status;
|
||||
+
|
||||
+ server1 = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
|
||||
+ server2 = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
|
||||
+
|
||||
+ /* Both servers have the same credentials. */
|
||||
+ auth_domain = soup_auth_domain_basic_new ("realm", "auth-test", "auth-callback", server_basic_auth_callback, NULL);
|
||||
+ soup_auth_domain_add_path (auth_domain, "/");
|
||||
+ soup_server_add_auth_domain (server1, auth_domain);
|
||||
+ soup_server_add_auth_domain (server2, auth_domain);
|
||||
+ g_object_unref (auth_domain);
|
||||
+
|
||||
+ /* Server 1 asks for auth, then redirects to Server 2. */
|
||||
+ soup_server_add_handler (server1, NULL,
|
||||
+ redirect_server_callback,
|
||||
+ soup_test_server_get_uri (server2, "http", NULL), (GDestroyNotify)g_uri_unref);
|
||||
+ /* Server 2 requires auth. */
|
||||
+ soup_server_add_handler (server2, NULL, server_callback, NULL, NULL);
|
||||
+
|
||||
+ session = soup_test_session_new (NULL);
|
||||
+ uri = soup_test_server_get_uri (server1, "http", NULL);
|
||||
+ msg = soup_message_new_from_uri ("GET", uri);
|
||||
+ /* The client only sends credentials for the host it knows. */
|
||||
+ g_signal_connect (msg, "authenticate", G_CALLBACK (auth_for_redirect_callback), uri);
|
||||
+
|
||||
+ status = soup_test_session_send_message (session, msg);
|
||||
+
|
||||
+ g_assert_cmpint (status, ==, SOUP_STATUS_UNAUTHORIZED);
|
||||
+
|
||||
+ g_uri_unref (uri);
|
||||
+ soup_test_server_quit_unref (server1);
|
||||
+ soup_test_server_quit_unref (server2);
|
||||
+}
|
||||
+
|
||||
int
|
||||
main (int argc, char **argv)
|
||||
{
|
||||
@@ -1626,6 +1702,7 @@ main (int argc, char **argv)
|
||||
g_test_add_func ("/auth/async-message-do-not-use-auth-cache", do_async_message_do_not_use_auth_cache_test);
|
||||
g_test_add_func ("/auth/authorization-header-request", do_message_has_authorization_header_test);
|
||||
g_test_add_func ("/auth/cancel-after-retry", do_cancel_after_retry_test);
|
||||
+ g_test_add_func ("/auth/strip-on-crossorigin-redirect", do_strip_on_crossorigin_redirect);
|
||||
g_test_add_data_func ("/auth/missing-params/realm", "Digest qop=\"auth\"", do_missing_params_test);
|
||||
g_test_add_data_func ("/auth/missing-params/nonce", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\"", do_missing_params_test);
|
||||
g_test_add_data_func ("/auth/missing-params/nonce-md5-sess", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\" algorithm=\"MD5-sess\"", do_missing_params_test);
|
||||
--
|
||||
2.33.0
|
||||
|
||||
10
libsoup.spec
10
libsoup.spec
@ -1,6 +1,6 @@
|
||||
Name: libsoup
|
||||
Version: 2.74.3
|
||||
Release: 8
|
||||
Release: 9
|
||||
Summary: An HTTP library implementation
|
||||
License: LGPLv2
|
||||
URL: https://wiki.gnome.org/Projects/libsoup
|
||||
@ -38,6 +38,8 @@ Patch6023: backport-content-sniffer-empty-resources-should-be-considered-te
|
||||
Patch6024: backport-CVE-2025-32909.patch
|
||||
Patch6025: backport-CVE-2025-32914.patch
|
||||
Patch6026: backport-CVE-2025-32907.patch
|
||||
Patch6027: backport-CVE-2025-46420.patch
|
||||
Patch6028: backport-CVE-2025-46421.patch
|
||||
|
||||
%description
|
||||
libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop,
|
||||
@ -89,6 +91,12 @@ sed -i 's/idm[0-9]\{5,32\}/idm12345678912345/g' %{buildroot}%{_datadir}/gtk-doc/
|
||||
%{_datadir}/gtk-doc/html/libsoup-2.4/*
|
||||
|
||||
%changelog
|
||||
* Tue Apr 29 2025 zhangpan <zhangpan103@h-partners.com> - 2.74.3-9
|
||||
- Type:cves
|
||||
- ID:CVE-2025-46420 CVE-2025-46421
|
||||
- SUG:NA
|
||||
- DESC:fix CVE-2025-46420 CVE-2025-46421
|
||||
|
||||
* Wed Apr 23 2025 zhangpan <zhangpan103@h-partners.com> - 2.74.3-8
|
||||
- Type:cves
|
||||
- ID:CVE-2025-32907 CVE-2025-32914
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user