From cf3f3b869b22bf7273c6e53ac92928c3f9f2789c Mon Sep 17 00:00:00 2001 From: Suresh Thelkar Date: Tue, 17 Sep 2024 12:50:24 +0530 Subject: [PATCH] Patch CVE-2023-27533 in cmake --- SPECS/cmake/CVE-2023-27533.patch | 60 +++++++++++++++++++ SPECS/cmake/cmake.spec | 6 +- .../manifests/package/toolchain_aarch64.txt | 4 +- .../manifests/package/toolchain_x86_64.txt | 4 +- 4 files changed, 69 insertions(+), 5 deletions(-) create mode 100644 SPECS/cmake/CVE-2023-27533.patch diff --git a/SPECS/cmake/CVE-2023-27533.patch b/SPECS/cmake/CVE-2023-27533.patch new file mode 100644 index 00000000000..93fc34e7737 --- /dev/null +++ b/SPECS/cmake/CVE-2023-27533.patch @@ -0,0 +1,60 @@ +From 7aee1a49cb796ad199f02746222808d3313fbe9b Mon Sep 17 00:00:00 2001 +From: Suresh Thelkar +Date: Tue, 17 Sep 2024 12:38:59 +0530 +Subject: [PATCH] Backporting patch for CVE-2023-27533 + +Upstream patch details are given below. +https://github.com/curl/curl/pull/10728/commits +--- + Utilities/cmcurl/lib/telnet.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/Utilities/cmcurl/lib/telnet.c b/Utilities/cmcurl/lib/telnet.c +index fdd137fb..c8af4c95 100644 +--- a/Utilities/cmcurl/lib/telnet.c ++++ b/Utilities/cmcurl/lib/telnet.c +@@ -770,6 +770,17 @@ static void printsub(struct Curl_easy *data, + } + } + ++static bool str_is_nonascii(const char *str) ++{ ++ size_t len = strlen(str); ++ while(len--) { ++ if(*str & 0x80) ++ return TRUE; ++ str++; ++ } ++ return FALSE; ++} ++ + static CURLcode check_telnet_options(struct Curl_easy *data) + { + struct curl_slist *head; +@@ -784,6 +795,8 @@ static CURLcode check_telnet_options(struct Curl_easy *data) + /* Add the user name as an environment variable if it + was given on the command line */ + if(conn->bits.user_passwd) { ++ if(str_is_nonascii(conn->user)) ++ return CURLE_BAD_FUNCTION_ARGUMENT; + msnprintf(option_arg, sizeof(option_arg), "USER,%s", conn->user); + beg = curl_slist_append(tn->telnet_vars, option_arg); + if(!beg) { +@@ -796,6 +809,14 @@ static CURLcode check_telnet_options(struct Curl_easy *data) + } + + for(head = data->set.telnet_options; head; head = head->next) { ++ char *option = head->data; ++ char *arg; ++ char *sep = strchr(option, '='); ++ if(sep) { ++ arg = ++sep; ++ if(str_is_nonascii(arg)) ++ continue; ++ } + if(sscanf(head->data, "%127[^= ]%*[ =]%255s", + option_keyword, option_arg) == 2) { + +-- +2.34.1 + diff --git a/SPECS/cmake/cmake.spec b/SPECS/cmake/cmake.spec index 3bf920bff39..165044311d2 100644 --- a/SPECS/cmake/cmake.spec +++ b/SPECS/cmake/cmake.spec @@ -2,7 +2,7 @@ Summary: Cmake Name: cmake Version: 3.21.4 -Release: 11%{?dist} +Release: 12%{?dist} License: BSD AND LGPLv2+ Vendor: Microsoft Corporation Distribution: Mariner @@ -21,6 +21,7 @@ Patch6: CVE-2023-38545.patch Patch7: CVE-2023-38546.patch Patch8: cve-2023-44487.patch Patch9: CVE-2023-28320.patch +Patch10: CVE-2023-27533.patch BuildRequires: bzip2 BuildRequires: bzip2-devel BuildRequires: curl @@ -86,6 +87,9 @@ bin/ctest --force-new-ctest-process --rerun-failed --output-on-failure %{_prefix}/doc/%{name}-*/* %changelog +* Tue Sep 17 2024 Suresh Thelkar - 3.21.4-12 +- Patch CVE-2023-27533 + * Fri Jul 26 2024 Zhichun Wan - 3.21.4-11 - Patch CVE-2023-28320.patch diff --git a/toolkit/resources/manifests/package/toolchain_aarch64.txt b/toolkit/resources/manifests/package/toolchain_aarch64.txt index 9fe530e7113..f4f871f05c2 100644 --- a/toolkit/resources/manifests/package/toolchain_aarch64.txt +++ b/toolkit/resources/manifests/package/toolchain_aarch64.txt @@ -30,8 +30,8 @@ check-debuginfo-0.15.2-1.cm2.aarch64.rpm chkconfig-1.20-4.cm2.aarch64.rpm chkconfig-debuginfo-1.20-4.cm2.aarch64.rpm chkconfig-lang-1.20-4.cm2.aarch64.rpm -cmake-3.21.4-11.cm2.aarch64.rpm -cmake-debuginfo-3.21.4-11.cm2.aarch64.rpm +cmake-3.21.4-12.cm2.aarch64.rpm +cmake-debuginfo-3.21.4-12.cm2.aarch64.rpm coreutils-8.32-7.cm2.aarch64.rpm coreutils-debuginfo-8.32-7.cm2.aarch64.rpm coreutils-lang-8.32-7.cm2.aarch64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index c803aafac3c..b7ceda2366a 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -31,8 +31,8 @@ check-debuginfo-0.15.2-1.cm2.x86_64.rpm chkconfig-1.20-4.cm2.x86_64.rpm chkconfig-debuginfo-1.20-4.cm2.x86_64.rpm chkconfig-lang-1.20-4.cm2.x86_64.rpm -cmake-3.21.4-11.cm2.x86_64.rpm -cmake-debuginfo-3.21.4-11.cm2.x86_64.rpm +cmake-3.21.4-12.cm2.x86_64.rpm +cmake-debuginfo-3.21.4-12.cm2.x86_64.rpm coreutils-8.32-7.cm2.x86_64.rpm coreutils-debuginfo-8.32-7.cm2.x86_64.rpm coreutils-lang-8.32-7.cm2.x86_64.rpm