mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-03-11 09:49:41 +01:00
Code Issues Packages Projects Releases Wiki Activity

inetutils: patch CVE-2026-24061

Browse Source 
Pick patches per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-24061

(From OE-Core rev: 042f02ff7072e9cf4b02a335d1d3186d68ba669b)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Peter Marko
2026-01-31 20:54:02 +01:00
committed by Paul Barker
parent 7cdc92f5cb
commit 9a24d18f40
3 changed files with 122 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-01.patch Normal file
View File

@@ -0,0 +1,38 @@
From fd702c02497b2f398e739e3119bed0b23dd7aa7b Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Tue, 20 Jan 2026 01:10:36 -0800
Subject: [PATCH] Fix injection bug with bogus user names
Problem reported by Kyu Neushwaistein.
* telnetd/utility.c (_var_short_name):
Ignore user names that start with '-' or contain shell metacharacters.
Signed-off-by: Simon Josefsson <simon@josefsson.org>
CVE: CVE-2026-24061
Upstream-Status: Backport [https://codeberg.org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7b]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
telnetd/utility.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/telnetd/utility.c b/telnetd/utility.c
index b486226e..c02cd0e6 100644
--- a/telnetd/utility.c
+++ b/telnetd/utility.c
@@ -1737,7 +1737,14 @@ _var_short_name (struct line_expander *exp)
return user_name ? xstrdup (user_name) : NULL;
case 'U':
- return getenv ("USER") ? xstrdup (getenv ("USER")) : xstrdup ("");
+ {
+ /* Ignore user names starting with '-' or containing shell
+ metachars, as they can cause trouble. */
+ char const *u = getenv ("USER");
+ return xstrdup ((u && *u != '-'
+ && !u[strcspn (u, "\t\n !\"#$&'()*;<=>?[\\^`{|}~")])
+ ? u : "");
+ }
default:
exp->state = EXP_STATE_ERROR;

82
meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-02.patch Normal file
View File

@@ -0,0 +1,82 @@
From ccba9f748aa8d50a38d7748e2e60362edd6a32cc Mon Sep 17 00:00:00 2001
From: Simon Josefsson <simon@josefsson.org>
Date: Tue, 20 Jan 2026 14:02:39 +0100
Subject: [PATCH] telnetd: Sanitize all variable expansions
* telnetd/utility.c (sanitize): New function.
(_var_short_name): Use it for all variables.
CVE: CVE-2026-24061
Upstream-Status: Backport [https://codeberg.org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cc]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
telnetd/utility.c | 32 ++++++++++++++++++--------------
1 file changed, 18 insertions(+), 14 deletions(-)
diff --git a/telnetd/utility.c b/telnetd/utility.c
index c02cd0e6..b21ad961 100644
--- a/telnetd/utility.c
+++ b/telnetd/utility.c
@@ -1688,6 +1688,17 @@ static void _expand_cond (struct line_expander *exp);
static void _skip_block (struct line_expander *exp);
static void _expand_block (struct line_expander *exp);
+static char *
+sanitize (const char *u)
+{
+ /* Ignore values starting with '-' or containing shell metachars, as
+ they can cause trouble. */
+ if (u && *u != '-' && !u[strcspn (u, "\t\n !\"#$&'()*;<=>?[\\^`{|}~")])
+ return u;
+ else
+ return "";
+}
+
/* Expand a variable referenced by its short one-symbol name.
Input: exp->cp points to the variable name.
FIXME: not implemented */
@@ -1714,13 +1725,13 @@ _var_short_name (struct line_expander *exp)
return xstrdup (timebuf);
case 'h':
- return xstrdup (remote_hostname);
+ return xstrdup (sanitize (remote_hostname));
case 'l':
- return xstrdup (local_hostname);
+ return xstrdup (sanitize (local_hostname));
case 'L':
- return xstrdup (line);
+ return xstrdup (sanitize (line));
case 't':
q = strchr (line + 1, '/');
@@ -1728,23 +1739,16 @@ _var_short_name (struct line_expander *exp)
q++;
else
q = line;
- return xstrdup (q);
+ return xstrdup (sanitize (q));
case 'T':
- return terminaltype ? xstrdup (terminaltype) : NULL;
+ return terminaltype ? xstrdup (sanitize (terminaltype)) : NULL;
case 'u':
- return user_name ? xstrdup (user_name) : NULL;
+ return user_name ? xstrdup (sanitize (user_name)) : NULL;
case 'U':
- {
- /* Ignore user names starting with '-' or containing shell
- metachars, as they can cause trouble. */
- char const *u = getenv ("USER");
- return xstrdup ((u && *u != '-'
- && !u[strcspn (u, "\t\n !\"#$&'()*;<=>?[\\^`{|}~")])
- ? u : "");
- }
+ return xstrdup (sanitize (getenv ("USER")));
default:
exp->state = EXP_STATE_ERROR;

2
meta/recipes-connectivity/inetutils/inetutils_2.2.bb
View File

@@ -24,6 +24,8 @@ SRC_URI = "${GNU_MIRROR}/inetutils/inetutils-${PV}.tar.xz \
file://CVE-2022-39028.patch \
file://0001-CVE-2023-40303-ftpd-rcp-rlogin-rsh-rshd-uucpd-fix-ch.patch \
file://0002-CVE-2023-40303-Indent-changes-in-previous-commit.patch \
file://CVE-2026-24061-01.patch \
file://CVE-2026-24061-02.patch \
"
inherit autotools gettext update-alternatives texinfo