mirror of
https://git.yoctoproject.org/poky
synced 2026-02-27 03:49:41 +01:00
a64e37ac0e
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3528 (From OE-Core rev: e0dc0432b13f38d16f642bdadf8ebc78b7a74806) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
30 lines
1.1 KiB
Diff
30 lines
1.1 KiB
Diff
Upstream-Status: Backport
|
|
|
|
Signed-off-by: Yue Tao <yue.tao@windriver.com>
|
|
|
|
diff --git a/subversion/libsvn_subr/config_auth.c.old b/subversion/libsvn_subr/config_auth.c
|
|
index ff50270..c511d04 100644
|
|
--- a/subversion/libsvn_subr/config_auth.c.old
|
|
+++ b/subversion/libsvn_subr/config_auth.c
|
|
@@ -85,6 +85,7 @@ svn_config_read_auth_data(apr_hash_t **hash,
|
|
if (kind == svn_node_file)
|
|
{
|
|
svn_stream_t *stream;
|
|
+ svn_string_t *stored_realm;
|
|
|
|
SVN_ERR_W(svn_stream_open_readonly(&stream, auth_path, pool, pool),
|
|
_("Unable to open auth file for reading"));
|
|
@@ -95,6 +96,12 @@ svn_config_read_auth_data(apr_hash_t **hash,
|
|
apr_psprintf(pool, _("Error parsing '%s'"),
|
|
svn_path_local_style(auth_path, pool)));
|
|
|
|
+ stored_realm = apr_hash_get(*hash, SVN_CONFIG_REALMSTRING_KEY,
|
|
+ APR_HASH_KEY_STRING);
|
|
+
|
|
+ if (!stored_realm || strcmp(stored_realm->data, realmstring) != 0)
|
|
+ *hash = NULL; /* Hash collision, or somebody tampering with storage */
|
|
+
|
|
SVN_ERR(svn_stream_close(stream));
|
|
}
|
|
|