Fix CVE-2022-2735

Fix-CVE-2022-2735.patch

@@ -0,0 +1,46 @@
+From c44b3139334dc6f132d73e0771b0e3254756df20 Mon Sep 17 00:00:00 2001
+From: rpm-build <rpm-build>
+Date: Thu, 19 Oct 2023 17:02:43 +0800
+Subject: [PATCH] Fix CVE-2022-2735
+
+---
+ pcsd/rserver.rb | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/pcsd/rserver.rb b/pcsd/rserver.rb
+index e2c5e2a..4fde639 100644
+--- a/pcsd/rserver.rb
++++ b/pcsd/rserver.rb
+@@ -7,6 +7,29 @@ require 'thin'
+ 
+ require 'settings.rb'
+ 
++# Replace Thin::Backends::UnixServer:connect
++# The only change is 'File.umask(0o777)' instead of 'File.umask(0)' to properly
++# set python-ruby socket permissions
++module Thin
++  module Backends
++    class UnixServer < Base
++      def connect
++        at_exit { remove_socket_file } # In case it crashes
++        old_umask = File.umask(0o077)
++        begin
++          EventMachine.start_unix_domain_server(@socket, UnixConnection, &method(:initialize_connection))
++          # HACK EventMachine.start_unix_domain_server doesn't return the connection signature
++          #      so we have to go in the internal stuff to find it.
++        @signature = EventMachine.instance_eval{@acceptors.keys.first}
++        ensure
++          File.umask(old_umask)
++        end
++      end
++    end
++  end
++end
++
++
+ def pack_response(response)
+   return [200, {}, [response.to_json.to_str]]
+ end
+-- 
+2.27.0
+

pcs.spec

@@ -1,6 +1,6 @@
 Name:    pcs
 Version: 0.11.2
-Release: 7
+Release: 8
 License: GPLv2 and BSD-2-Clause and ASL 2.0 and MIT
 URL:     https://github.com/ClusterLabs/pcs
 Summary: Pacemaker Configuration System
@@ -47,6 +47,7 @@ Patch6: fix-pcs-config-checkpoint-diff-command.patch
 Patch7: fix-pcs-quorum-device-remove.patch
 Patch8: tests-fix-datetime-race-condition.patch
 Patch9: Fix-CVE-2022-1049.patch
+Patch10: Fix-CVE-2022-2735.patch
 
 # git for patches
 BuildRequires: git-core
@@ -410,6 +411,9 @@ run_all_tests
 %license pyagentx_LICENSE.txt
 
 %changelog
+* Fri Oct 20 2023 bizhiyuan <bizhiyuan@kylinos.cn> - 0.11.2-8
+- Fix-CVE-2022-2735
+
 * Thu Oct 19 2023 bizhiyuan <bizhiyuan@kylinos.cn> - 0.11.2-7
 - Fix CVE-2022-1049