mirror of
https://git.yoctoproject.org/poky
synced 2026-05-25 21:52:38 +02:00
033ba67e53
CVE-2021-31810: A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes Net::FTP extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). CVE-2021-32066: Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack.” References: https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/ https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/ Patches from:bf4d05173ce2ac25d0eb(From OE-Core rev: e14761916290c01683d72eb8e3de530f944fdfab) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
103 lines
2.7 KiB
Diff
103 lines
2.7 KiB
Diff
From e2ac25d0eb66de99f098d6669cf4f06796aa6256 Mon Sep 17 00:00:00 2001
|
|
From: Shugo Maeda <shugo@ruby-lang.org>
|
|
Date: Tue, 11 May 2021 10:31:27 +0900
|
|
Subject: [PATCH] Fix StartTLS stripping vulnerability
|
|
|
|
This fixes CVE-2021-32066.
|
|
Reported by Alexandr Savca in <https://hackerone.com/reports/1178562>.
|
|
|
|
CVE: CVE-2021-32066
|
|
|
|
Upstream-Status: Backport
|
|
[https://github.com/ruby/ruby/commit/e2ac25d0eb66de99f098d6669cf4f06796aa6256]
|
|
|
|
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
|
|
---
|
|
lib/net/imap.rb | 8 +++++++-
|
|
test/net/imap/test_imap.rb | 31 +++++++++++++++++++++++++++++++
|
|
2 files changed, 38 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/lib/net/imap.rb b/lib/net/imap.rb
|
|
index 505b4c8950..d45304f289 100644
|
|
--- a/lib/net/imap.rb
|
|
+++ b/lib/net/imap.rb
|
|
@@ -1218,12 +1218,14 @@ def get_tagged_response(tag, cmd)
|
|
end
|
|
resp = @tagged_responses.delete(tag)
|
|
case resp.name
|
|
+ when /\A(?:OK)\z/ni
|
|
+ return resp
|
|
when /\A(?:NO)\z/ni
|
|
raise NoResponseError, resp
|
|
when /\A(?:BAD)\z/ni
|
|
raise BadResponseError, resp
|
|
else
|
|
- return resp
|
|
+ raise UnknownResponseError, resp
|
|
end
|
|
end
|
|
|
|
@@ -3719,6 +3721,10 @@ class BadResponseError < ResponseError
|
|
class ByeResponseError < ResponseError
|
|
end
|
|
|
|
+ # Error raised upon an unknown response from the server.
|
|
+ class UnknownResponseError < ResponseError
|
|
+ end
|
|
+
|
|
RESPONSE_ERRORS = Hash.new(ResponseError)
|
|
RESPONSE_ERRORS["NO"] = NoResponseError
|
|
RESPONSE_ERRORS["BAD"] = BadResponseError
|
|
diff --git a/test/net/imap/test_imap.rb b/test/net/imap/test_imap.rb
|
|
index 8b924b524e..85fb71d440 100644
|
|
--- a/test/net/imap/test_imap.rb
|
|
+++ b/test/net/imap/test_imap.rb
|
|
@@ -127,6 +127,16 @@ def test_starttls
|
|
imap.disconnect
|
|
end
|
|
end
|
|
+
|
|
+ def test_starttls_stripping
|
|
+ starttls_stripping_test do |port|
|
|
+ imap = Net::IMAP.new("localhost", :port => port)
|
|
+ assert_raise(Net::IMAP::UnknownResponseError) do
|
|
+ imap.starttls(:ca_file => CA_FILE)
|
|
+ end
|
|
+ imap
|
|
+ end
|
|
+ end
|
|
end
|
|
|
|
def start_server
|
|
@@ -834,6 +844,27 @@ def starttls_test
|
|
end
|
|
end
|
|
|
|
+ def starttls_stripping_test
|
|
+ server = create_tcp_server
|
|
+ port = server.addr[1]
|
|
+ start_server do
|
|
+ sock = server.accept
|
|
+ begin
|
|
+ sock.print("* OK test server\r\n")
|
|
+ sock.gets
|
|
+ sock.print("RUBY0001 BUG unhandled command\r\n")
|
|
+ ensure
|
|
+ sock.close
|
|
+ server.close
|
|
+ end
|
|
+ end
|
|
+ begin
|
|
+ imap = yield(port)
|
|
+ ensure
|
|
+ imap.disconnect if imap && !imap.disconnected?
|
|
+ end
|
|
+ end
|
|
+
|
|
def create_tcp_server
|
|
return TCPServer.new(server_addr, 0)
|
|
end
|
|
--
|
|
2.25.1
|
|
|