Skip to contentSkip to conversation

linux-pam: add security patches

PATCH New Gustavo Zacarias 2 participants 2 messages Dec 18, 2014

lore
Share & tools
lore

Gustavo Zacarias

author
#0 lore raw

PATCH 1/1 linux-pam: add security patches

To fix:
CVE-2013-7041 - use case sensitive comparison in pam_userdb CVE-2014-2583 - potential path traversal issue in pam_timestamp

Also add hash file (computed, the hash files upstream cover up to 1.1.7)

Signed-off-by Gustavo Zacarias <[email protected]>
---
 ...pam-01-configure.patch => 0001-configure.patch} |  0
 ...akefile-am.patch => 0002-doc-makefile-am.patch} |  0
 .../{linux-pam-03-group.patch => 0003-group.patch} |  0
 .../{linux-pam-04-mkdir.patch => 0004-mkdir.patch} |  0
 ...nux-pam-05-succeed.patch => 0005-succeed.patch} |  0
 .../{linux-pam-06-time.patch => 0006-time.patch}   |  0
 ...linux-pam-07-rhosts.patch => 0007-rhosts.patch} |  0
 package/linux-pam/0008-fix-CVE-2014-2583.patch     | 53 ++++++++++++++++++++++
 package/linux-pam/0009-fix-CVE-2013-7041.patch     | 50 ++++++++++++++++++++
 package/linux-pam/linux-pam.hash                   |  2 +
 10 files changed, 105 insertions(+)
 rename package/linux-pam/{linux-pam-01-configure.patch => 0001-configure.patch} (100%)
 rename package/linux-pam/{linux-pam-02-doc-makefile-am.patch => 0002-doc-makefile-am.patch} (100%)
 rename package/linux-pam/{linux-pam-03-group.patch => 0003-group.patch} (100%)
 rename package/linux-pam/{linux-pam-04-mkdir.patch => 0004-mkdir.patch} (100%)
 rename package/linux-pam/{linux-pam-05-succeed.patch => 0005-succeed.patch} (100%)
 rename package/linux-pam/{linux-pam-06-time.patch => 0006-time.patch} (100%)
 rename package/linux-pam/{linux-pam-07-rhosts.patch => 0007-rhosts.patch} (100%)
 create mode 100644 package/linux-pam/0008-fix-CVE-2014-2583.patch
 create mode 100644 package/linux-pam/0009-fix-CVE-2013-7041.patch
 create mode 100644 package/linux-pam/linux-pam.hash
package/linux-pam/0001-configure.patch renamed from package/linux-pam/linux-pam-01-configure.patch +0 -0
similarity index 100%
rename from package/linux-pam/linux-pam-01-configure.patch
rename to package/linux-pam/0001-configure.patch
package/linux-pam/0002-doc-makefile-am.patch renamed from package/linux-pam/linux-pam-02-doc-makefile-am.patch +0 -0
similarity index 100%
rename from package/linux-pam/linux-pam-02-doc-makefile-am.patch
rename to package/linux-pam/0002-doc-makefile-am.patch
package/linux-pam/0003-group.patch renamed from package/linux-pam/linux-pam-03-group.patch +0 -0
similarity index 100%
rename from package/linux-pam/linux-pam-03-group.patch
rename to package/linux-pam/0003-group.patch
package/linux-pam/0004-mkdir.patch renamed from package/linux-pam/linux-pam-04-mkdir.patch +0 -0
similarity index 100%
rename from package/linux-pam/linux-pam-04-mkdir.patch
rename to package/linux-pam/0004-mkdir.patch
package/linux-pam/0005-succeed.patch renamed from package/linux-pam/linux-pam-05-succeed.patch +0 -0
similarity index 100%
rename from package/linux-pam/linux-pam-05-succeed.patch
rename to package/linux-pam/0005-succeed.patch
package/linux-pam/0006-time.patch renamed from package/linux-pam/linux-pam-06-time.patch +0 -0
similarity index 100%
rename from package/linux-pam/linux-pam-06-time.patch
rename to package/linux-pam/0006-time.patch
package/linux-pam/0007-rhosts.patch renamed from package/linux-pam/linux-pam-07-rhosts.patch +0 -0
similarity index 100%
rename from package/linux-pam/linux-pam-07-rhosts.patch
rename to package/linux-pam/0007-rhosts.patch
package/linux-pam/0008-fix-CVE-2014-2583.patch new file +53 -0

53 lines not on this page · raw message

package/linux-pam/0009-fix-CVE-2013-7041.patch new file +50 -0

50 lines not on this page · raw message

package/linux-pam/linux-pam.hash new file +2 -0
new file mode 100644
index 0000000..3f420c2
@@ -0,0 +1,2 @@
+# Locally computed hashes, not provided by upstream
+sha256	c4b1f23a236d169e2496fea20721578d864ba00f7242d2b41d81050ac87a1e55	Linux-PAM-1.1.8.tar.bz2
Signature · 1 line
2.0.4
#1 lore raw

PATCH 1/1 linux-pam: add security patches

Quoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Gustavo" == Gustavo Zacarias <[email protected]> writes:

To fix:
CVE-2013-7041 - use case sensitive comparison in pam_userdb CVE-2014-2583 - potential path traversal issue in pam_timestamp

Also add hash file (computed, the hash files upstream cover up to 1.1.7)

Signed-off-by Gustavo Zacarias <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard