[PATCH] gnu: OpenLDAP: Update to 2.4.50 [fixes CVE-2019-{13057, 13565}].

Leo Famulari wrote on 28 Apr 2020 22:22

Recipients:(address . guix-patches@gnu.org)

Message-ID:c2af3e3e607ae0be38ca2e2336e6c249edf84291.1588105377.git.leo@famulari.name

* gnu/packages/openldap.scm (openldap)[replacement]: Use openldap-2.4.50.(openldap/fixed): Replace with ...(openldap-2.4.50): ... new variable.* gnu/packages/patches/openldap-CVE-2020-12243.patch: Delete file.* gnu/local.mk (dist_patch_DATA): Remove it.--- gnu/local.mk                                  |   1 - gnu/packages/openldap.scm                     |  16 ++- .../patches/openldap-CVE-2020-12243.patch     | 125 ------------------ 3 files changed, 11 insertions(+), 131 deletions(-) delete mode 100644 gnu/packages/patches/openldap-CVE-2020-12243.patch

Toggle diff (182 lines)diff --git a/gnu/local.mk b/gnu/local.mkindex 67bf04547c..9426ee30a0 100644--- a/gnu/local.mk+++ b/gnu/local.mk@@ -1276,7 +1276,6 @@ dist_patch_DATA =						\   %D%/packages/patches/opencv-rgbd-aarch64-test-fix.patch	\   %D%/packages/patches/openfoam-4.1-cleanup.patch			\   %D%/packages/patches/openjdk-10-idlj-reproducibility.patch	\-  %D%/packages/patches/openldap-CVE-2020-12243.patch		\   %D%/packages/patches/openmpi-mtl-priorities.patch		\   %D%/packages/patches/openocd-nrf52.patch			\   %D%/packages/patches/openssl-runpath.patch			\diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scmindex aa51520654..53c57e846f 100644--- a/gnu/packages/openldap.scm+++ b/gnu/packages/openldap.scm@@ -58,8 +58,8 @@  (define-public openldap   (package-   (replacement openldap/fixed)    (name "openldap")+   (replacement openldap-2.4.50)    (version "2.4.47")    (source (origin             (method url-fetch)@@ -112,12 +112,18 @@    (license openldap2.8)    (home-page "https://www.openldap.org/"))) -(define openldap/fixed+(define openldap-2.4.50   (package     (inherit openldap)-    (source-      (origin (inherit (package-source openldap))-              (patches (search-patches "openldap-CVE-2020-12243.patch"))))))+    (version "2.4.50")+    (source (origin+              (method url-fetch)+              (uri (string-append "https://www.openldap.org/software/download/"+                                  "OpenLDAP/openldap-release/openldap-" version+                                  ".tgz"))+              (sha256+               (base32+                "1f46nlfwmys110j36sifm7ah8m8f3s10c3vaiikmmigmifapvdaw"))))))  (define-public nss-pam-ldapd   (packagediff --git a/gnu/packages/patches/openldap-CVE-2020-12243.patch b/gnu/packages/patches/openldap-CVE-2020-12243.patchdeleted file mode 100644index 6321998198..0000000000--- a/gnu/packages/patches/openldap-CVE-2020-12243.patch+++ /dev/null@@ -1,125 +0,0 @@-From 98464c11df8247d6a11b52e294ba5dd4f0380440 Mon Sep 17 00:00:00 2001-From: Howard Chu <hyc@openldap.org>-Date: Thu, 16 Apr 2020 01:08:19 +0100-Subject: [PATCH] ITS#9202 limit depth of nested filters--Using a hardcoded limit for now; no reasonable apps-should ever run into it.----- servers/slapd/filter.c | 41 ++++++++++++++++++++++++++++++++---------- 1 file changed, 32 insertions(+), 9 deletions(-)--diff --git a/servers/slapd/filter.c b/servers/slapd/filter.c-index 3252cf2a7..ed57bbd7b 100644---- a/servers/slapd/filter.c-+++ b/servers/slapd/filter.c-@@ -37,11 +37,16 @@- const Filter *slap_filter_objectClass_pres;- const struct berval *slap_filterstr_objectClass_pres;- -+#ifndef SLAPD_MAX_FILTER_DEPTH-+#define SLAPD_MAX_FILTER_DEPTH	5000-+#endif-+- static int	get_filter_list(- 	Operation *op,- 	BerElement *ber,- 	Filter **f,--	const char **text );-+	const char **text,-+	int depth );- - static int	get_ssa(- 	Operation *op,-@@ -80,12 +85,13 @@ filter_destroy( void )- 	return;- }- --int--get_filter(-+static int-+get_filter0(- 	Operation *op,- 	BerElement *ber,- 	Filter **filt,--	const char **text )-+	const char **text,-+	int depth )- {- 	ber_tag_t	tag;- 	ber_len_t	len;-@@ -126,6 +132,11 @@ get_filter(- 	 *- 	 */- -+	if( depth > SLAPD_MAX_FILTER_DEPTH ) {-+		*text = "filter nested too deeply";-+		return SLAPD_DISCONNECT;-+	}-+- 	tag = ber_peek_tag( ber, &len );- - 	if( tag == LBER_ERROR ) {-@@ -221,7 +232,7 @@ get_filter(- - 	case LDAP_FILTER_AND:- 		Debug( LDAP_DEBUG_FILTER, "AND\n", 0, 0, 0 );--		err = get_filter_list( op, ber, &f.f_and, text );-+		err = get_filter_list( op, ber, &f.f_and, text, depth+1 );- 		if ( err != LDAP_SUCCESS ) {- 			break;- 		}-@@ -234,7 +245,7 @@ get_filter(- - 	case LDAP_FILTER_OR:- 		Debug( LDAP_DEBUG_FILTER, "OR\n", 0, 0, 0 );--		err = get_filter_list( op, ber, &f.f_or, text );-+		err = get_filter_list( op, ber, &f.f_or, text, depth+1 );- 		if ( err != LDAP_SUCCESS ) {- 			break;- 		}-@@ -248,7 +259,7 @@ get_filter(- 	case LDAP_FILTER_NOT:- 		Debug( LDAP_DEBUG_FILTER, "NOT\n", 0, 0, 0 );- 		(void) ber_skip_tag( ber, &len );--		err = get_filter( op, ber, &f.f_not, text );-+		err = get_filter0( op, ber, &f.f_not, text, depth+1 );- 		if ( err != LDAP_SUCCESS ) {- 			break;- 		}-@@ -311,10 +322,22 @@ get_filter(- 	return( err );- }- -+int-+get_filter(-+	Operation *op,-+	BerElement *ber,-+	Filter **filt,-+	const char **text )-+{-+	return get_filter0( op, ber, filt, text, 0 );-+}-+-+- static int- get_filter_list( Operation *op, BerElement *ber,- 	Filter **f,--	const char **text )-+	const char **text,-+	int depth )- {- 	Filter		**new;- 	int		err;-@@ -328,7 +351,7 @@ get_filter_list( Operation *op, BerElement *ber,- 		tag != LBER_DEFAULT;- 		tag = ber_next_element( ber, &len, last ) )- 	{--		err = get_filter( op, ber, new, text );-+		err = get_filter0( op, ber, new, text, depth );- 		if ( err != LDAP_SUCCESS )- 			return( err );- 		new = &(*new)->f_next;--- -2.26.2--- 2.26.2

Marius Bakke wrote on 28 Apr 2020 23:48

Recipients:

Message-ID:87k11z5ljj.fsf@devup.no

Leo Famulari <leo@famulari.name> writes:

Toggle quote (6 lines)

> * gnu/packages/openldap.scm (openldap)[replacement]: Use openldap-2.4.50.> (openldap/fixed): Replace with ...> (openldap-2.4.50): ... new variable.> * gnu/packages/patches/openldap-CVE-2020-12243.patch: Delete file.> * gnu/local.mk (dist_patch_DATA): Remove it.

LGTM, assuming there are no ABI changes since 2.4.47.

Leo Famulari wrote on 29 Apr 2020 19:49

Recipients:(name . Marius Bakke)(address . mbakke@fastmail.com)(address . 40946-done@debbugs.gnu.org)

Message-ID:20200429174918.GA25738@jasmine.lan

On Tue, Apr 28, 2020 at 11:48:32PM +0200, Marius Bakke wrote:

Toggle quote (10 lines)> Leo Famulari <leo@famulari.name> writes:> > > * gnu/packages/openldap.scm (openldap)[replacement]: Use openldap-2.4.50.> > (openldap/fixed): Replace with ...> > (openldap-2.4.50): ... new variable.> > * gnu/packages/patches/openldap-CVE-2020-12243.patch: Delete file.> > * gnu/local.mk (dist_patch_DATA): Remove it.> > LGTM, assuming there are no ABI changes since 2.4.47.

Pushed as f224a8bb79cc3c9e5960227ffea5524eb666d34a

Closed

Your comment

Commenting via the web interface is currently disabled.

To comment on this conversation send email to 40946@debbugs.gnu.org

is:open	open issues
is:done	closed issues
submitter:<who>	search issue submitter
author:<who>	search by message author
date:yesterday..now	search by issue date
mdate:3m..2d	search by message date