Browse code
libssh2- Fix CVE-2019-3855
Change-Id: Ic990106d00547844431bc475b937b25c4648e369
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6940
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
Tapas Kundu authored on 2019/03/28 23:42:43Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,17 @@ |
| 0 |
+diff --git a/src/transport.c b/src/transport.c |
|
| 1 |
+index 8725da0..1c5a13c 100644 |
|
| 2 |
+--- a/src/transport.c |
|
| 3 |
+@@ -438,6 +438,12 @@ int _libssh2_transport_read(LIBSSH2_SESSION * session) |
|
| 4 |
+ return LIBSSH2_ERROR_DECRYPT; |
|
| 5 |
+ |
|
| 6 |
+ p->padding_length = block[4]; |
|
| 7 |
++ if(p->packet_length < 1) {
|
|
| 8 |
++ return LIBSSH2_ERROR_DECRYPT; |
|
| 9 |
++ } |
|
| 10 |
++ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) {
|
|
| 11 |
++ return LIBSSH2_ERROR_OUT_OF_BOUNDARY; |
|
| 12 |
++ } |
|
| 13 |
+ |
|
| 14 |
+ /* total_num is the number of bytes following the initial |
|
| 15 |
+ (5 bytes) packet length and padding length fields */ |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
Summary: libssh2 is a library implementing the SSH2 protocol. |
| 2 | 2 |
Name: libssh2 |
| 3 | 3 |
Version: 1.8.0 |
| 4 |
-Release: 1%{?dist}
|
|
| 4 |
+Release: 2%{?dist}
|
|
| 5 | 5 |
License: BSD |
| 6 | 6 |
URL: https://www.libssh2.org/ |
| 7 | 7 |
Group: System Environment/NetworkingLibraries |
| ... | ... |
@@ -9,6 +9,7 @@ Vendor: VMware, Inc. |
| 9 | 9 |
Distribution: Photon |
| 10 | 10 |
Source0: https://www.libssh2.org/download/libssh2-%{version}.tar.gz
|
| 11 | 11 |
%define sha1 libssh2=baf2d1fb338eee531ba9b6b121c64235e089e0f5 |
| 12 |
+Patch0: CVE-2019-3855.patch |
|
| 12 | 13 |
BuildRequires: openssl-devel |
| 13 | 14 |
BuildRequires: zlib-devel |
| 14 | 15 |
|
| ... | ... |
@@ -27,13 +28,10 @@ These are the header files of libssh2. |
| 27 | 27 |
|
| 28 | 28 |
%prep |
| 29 | 29 |
%setup -q |
| 30 |
+%patch0 -p1 |
|
| 30 | 31 |
|
| 31 | 32 |
%build |
| 32 |
-./configure --prefix=%{_prefix} \
|
|
| 33 |
- --bindir=%{_bindir} \
|
|
| 34 |
- --libdir=%{_libdir} \
|
|
| 35 |
- --mandir=%{_mandir} \
|
|
| 36 |
- --disable-static \ |
|
| 33 |
+%configure --disable-static \ |
|
| 37 | 34 |
--enable-shared |
| 38 | 35 |
make |
| 39 | 36 |
|
| ... | ... |
@@ -53,6 +51,8 @@ find %{buildroot} -name '*.la' -exec rm -f {} ';'
|
| 53 | 53 |
%{_mandir}/man3/*
|
| 54 | 54 |
|
| 55 | 55 |
%changelog |
| 56 |
+* Thu Mar 28 2019 Tapas Kundu <tkundu@vmware.com> 1.8.0-2 |
|
| 57 |
+- Fix for CVE-2019-3855 |
|
| 56 | 58 |
* Wed Nov 30 2016 Xiaolin Li <xiaolinl@vmware.com> 1.8.0-1 |
| 57 | 59 |
- Add libssh2 1.8.0 package. |
| 58 | 60 |
|