libsoup: security bump to version 2.62.3

PATCH New Baruch Siach 3 participants 6 messages Aug 28, 2018

Share & tools

Baruch Siach

author

2018-08-28 09:27 UTC #0 lore raw

PATCH 1/1 libsoup: security bump to version 2.62.3

Fixes CVE-2018-12910: The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.

Cc Fabrice Fontaine <[email protected]>

Signed-off-by Baruch Siach <[email protected]>

---
 package/libsoup/libsoup.hash | 4 ++--
 package/libsoup/libsoup.mk   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

package/libsoup/libsoup.hash +2 -2

index 6e1ff428afc0..666bbc278bf5 100644
@@ -1,4 +1,4 @@
-# From http://ftp.gnome.org/pub/gnome/sources/libsoup/2.56/libsoup-2.56.1.sha256sum
-sha256	c32a46d77b4da433b51d8fd09a57a44b198e03bdc93e5219afcc687c7948eac3  libsoup-2.56.1.tar.xz
+# From https://ftp.gnome.org/pub/GNOME/sources/libsoup/2.62/libsoup-2.62.3.sha256sum
+sha256	d312ade547495c2093ff8bda61f9b9727a98cfdae339f3263277dd39c0451172  libsoup-2.62.3.tar.xz
 # Locally calculated
 sha256  b7993225104d90ddd8024fd838faf300bea5e83d91203eab98e29512acebd69c  COPYING

package/libsoup/libsoup.mk +2 -2

index a3ce686aa7d7..95bd68201065 100644
@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-LIBSOUP_VERSION_MAJOR = 2.56
-LIBSOUP_VERSION = $(LIBSOUP_VERSION_MAJOR).1
+LIBSOUP_VERSION_MAJOR = 2.62
+LIBSOUP_VERSION = $(LIBSOUP_VERSION_MAJOR).3
 LIBSOUP_SOURCE = libsoup-$(LIBSOUP_VERSION).tar.xz
 LIBSOUP_SITE = http://ftp.gnome.org/pub/gnome/sources/libsoup/$(LIBSOUP_VERSION_MAJOR)
 LIBSOUP_LICENSE = LGPL-2.0+

Signature · 1 line

2.18.0

Peter Korsgaard

2018-08-28 11:18 UTC #1 lore raw

PATCH 1/1 libsoup: security bump to version 2.62.3

Quoted 8 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Baruch" == Baruch Siach <[email protected]> writes:
Fixes CVE-2018-12910: The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.
Cc Fabrice Fontaine <[email protected]>
Signed-off-by Baruch Siach <[email protected]>

Thanks! I started looking at this myself, but got sidetracked.

Is 2.62.x the first release containing this fix? Should we also cherry pick this for 2018.02.x / 2018.05.x or is there a smaller patch that could be applied instead?

Signature · 1 line

Bye, Peter Korsgaard

Baruch Siach

author

2018-08-28 11:29 UTC #2 lore raw

PATCH 1/1 libsoup: security bump to version 2.62.3

Hi Peter,

Quoted 6 lines · Peter Korsgaard

Quoted 5 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Baruch" == Baruch Siach <[email protected]> writes:
Fixes CVE-2018-12910: The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.

Quoted 8 lines

Quoted 2 lines
Cc Fabrice Fontaine <[email protected]>
Signed-off-by Baruch Siach <[email protected]>
Thanks! I started looking at this myself, but got sidetracked.
Is 2.62.x the first release containing this fix? Should we also cherry pick this for 2018.02.x / 2018.05.x or is there a smaller patch that could be applied instead?

The upstream fix from the (stable) gnome-3-28 branch is:

https://gitlab.gnome.org/GNOME/libsoup/commit/c5c41ad1d36c1efb3226a74ac8ea591419882892

You can cherry pick it to the gnome-3-22 branch that carries 2.56.x.

baruch

--
http://baruch.siach.name/blog/ ~. .~ Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
- baruch at tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -

Peter Korsgaard

2018-08-28 12:08 UTC #3 lore raw

PATCH 1/1 libsoup: security bump to version 2.62.3

Quoted 20 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Baruch" == Baruch Siach <[email protected]> writes:
Hi Peter,
Quoted 6 lines · Peter Korsgaard
Quoted 5 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Baruch" == Baruch Siach <[email protected]> writes:
Fixes CVE-2018-12910: The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.
Quoted 8 lines
Quoted 2 lines
Cc Fabrice Fontaine <[email protected]>
Signed-off-by Baruch Siach <[email protected]>
Thanks! I started looking at this myself, but got sidetracked.
Is 2.62.x the first release containing this fix? Should we also cherry pick this for 2018.02.x / 2018.05.x or is there a smaller patch that could be applied instead?

Quoted 5 lines

The upstream fix from the (stable) gnome-3-28 branch is:
https://gitlab.gnome.org/GNOME/libsoup/commit/c5c41ad1d36c1efb3226a74ac8ea591419882892
You can cherry pick it to the gnome-3-22 branch that carries 2.56.x.

Thanks. Is that the best solution or does upgrading to 2.62.x look "safe" for 2018.02 / 2018.05 / 2018.08?

Signature · 1 line

Bye, Peter Korsgaard

Baruch Siach

author

2018-08-28 12:17 UTC #4 lore raw

PATCH 1/1 libsoup: security bump to version 2.62.3

Hi Peter,

Quoted 17 lines · Peter Korsgaard

Quoted 16 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Baruch" == Baruch Siach <[email protected]> writes:
Quoted 14 lines · Peter Korsgaard
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Baruch" == Baruch Siach <[email protected]> writes:
Fixes CVE-2018-12910: The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.
Cc Fabrice Fontaine <[email protected]>
Signed-off-by Baruch Siach <[email protected]>
Thanks! I started looking at this myself, but got sidetracked.
Is 2.62.x the first release containing this fix? Should we also cherry pick this for 2018.02.x / 2018.05.x or is there a smaller patch that could be applied instead?

Quoted 8 lines

Quoted 5 lines
The upstream fix from the (stable) gnome-3-28 branch is:
https://gitlab.gnome.org/GNOME/libsoup/commit/c5c41ad1d36c1efb3226a74ac8ea591419882892
You can cherry pick it to the gnome-3-22 branch that carries 2.56.x.
Thanks. Is that the best solution or does upgrading to 2.62.x look "safe" for 2018.02 / 2018.05 / 2018.08?

Patch backport would probably be safer for master and stable. I'll post a patch.

baruch

Thomas Petazzoni

2018-08-28 20:39 UTC #5 lore raw

PATCH 1/1 libsoup: security bump to version 2.62.3

In reply to Baruch Siach

Hello,

Quoted 10 lines · Baruch Siach

Fixes CVE-2018-12910: The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.
Cc Fabrice Fontaine <[email protected]>
Signed-off-by Baruch Siach <[email protected]>
---
 package/libsoup/libsoup.hash | 4 ++--
 package/libsoup/libsoup.mk   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

Applied to next, thanks. The security fix has been added to master, so we will have to pay attention when merging back next into master: the security patch will be in package/libsoup/, but it should be removed, because it won't apply on the new version of libsoup.

Best regards,

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Bootlin (formerly Free Electrons)
Embedded Linux and Kernel engineering
https://bootlin.com