Compare commits

..

2 commits

Author SHA1 Message Date
Michal Srb
3e0750ab4b Revert RPM 6.0.0 patch
Signed-off-by: Michal Srb <michal@redhat.com>
2025-12-04 21:20:32 +01:00
Michal Srb
484142c1a3 a-a-save-container-data: validate input
Resolves: CVE-2025-12744

Signed-off-by: Michal Srb <michal@redhat.com>
2025-12-04 20:46:04 +01:00
2 changed files with 55 additions and 45 deletions

View file

@ -0,0 +1,45 @@
From cf1ececd9378fc14125c929833043f26e8f3486d Mon Sep 17 00:00:00 2001
From: Michal Srb <michal@redhat.com>
Date: Thu, 4 Dec 2025 21:14:52 +0100
Subject: [PATCH] Revert "Use rpmPubkeyKeyIDAsHex() to obtain the gpg key in
hex format"
This reverts commit 0158baaaba86b2c37b03922c2875a666ecc9b687.
---
src/daemon/rpm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/daemon/rpm.c b/src/daemon/rpm.c
index 1b745f70..524dc749 100644
--- a/src/daemon/rpm.c
+++ b/src/daemon/rpm.c
@@ -90,7 +90,7 @@ void rpm_destroy()
rpmFreeRpmrc();
#endif
- g_list_free_full(g_steal_pointer(&list_fingerprints), g_free);
+ g_list_free_full(g_steal_pointer(&list_fingerprints), free);
}
@@ -113,7 +113,7 @@ void rpm_load_gpgkey(const char* filename)
pubkey = rpmPubkeyNew(pkt, pklen);
if (pubkey != NULL)
{
- fingerprint = g_strdup(rpmPubkeyKeyIDAsHex(pubkey));
+ fingerprint = rpmhex(pubkey->keyid, sizeof(pubkey->keyid));
if (fingerprint != NULL)
list_fingerprints = g_list_append(list_fingerprints, fingerprint);
@@ -123,7 +123,7 @@ void rpm_load_gpgkey(const char* filename)
rpmPubkey subkey = subkeys[i];
if (subkey != NULL)
{
- fingerprint = g_strdup(rpmPubkeyKeyIDAsHex(subkey));
+ fingerprint = rpmhex(subkey->keyid, sizeof(subkey->keyid));
if (fingerprint != NULL)
list_fingerprints = g_list_append(list_fingerprints, fingerprint);
}
--
2.52.0

View file

@ -57,16 +57,17 @@
Summary: Automatic bug detection and reporting tool
Name: abrt
Version: 2.17.8
Release: 2%{?dist}
Release: 1%{?dist}
License: GPL-2.0-or-later
URL: https://abrt.readthedocs.org/
Source: https://github.com/abrt/%{name}/archive/%{version}/%{name}-%{version}.tar.gz
Patch001: 0001-Revert-Use-rpmPubkeyKeyIDAsHex-to-obtain-the-gpg-key.patch
BuildRequires: git-core
BuildRequires: %{dbus_devel}
BuildRequires: hostname
BuildRequires: gtk3-devel
BuildRequires: glib2-devel >= %{glib_ver}
BuildRequires: rpm-devel >= 6.0.0
BuildRequires: rpm-devel >= 4.18
BuildRequires: desktop-file-utils
BuildRequires: libnotify-devel
#why? BuildRequires: file-devel
@ -118,11 +119,6 @@ Requires: libreport-plugin-systemd-journal
%endif
# to fix upgrade path abrt-plugin-sosreport was removed in 2.14.5 version.
Obsoletes: abrt-plugin-sosreport < 2.14.5
# fros was retired 2025-07, and was initially added to comps to support
# abrt-desktop, so let's obsolete it here
Obsoletes: fros < 1.1-42
Obsoletes: fros-gnome < 1.1-42
Obsoletes: fros-recordmydesktop < 1.1-42
#gui
BuildRequires: libreport-gtk-devel >= %{libreport_ver}
@ -474,13 +470,6 @@ to the shell
%global __scm_apply_git(qp:m:) %{__git} am --exclude doc/design --exclude doc/project/abrt.tex
%autosetup -S git -p 0
# Create a sysusers.d config file
#uidgid pair 173:173 reserved in setup rhbz#670231
%global abrt_gid_uid 173
cat >abrt.sysusers.conf <<EOF
u abrt %{abrt_gid_uid} - /etc/abrt -
EOF
%build
./autogen.sh
@ -550,8 +539,6 @@ rm -vf %{buildroot}%{python3_sitelib}/__pycache__/abrt_exception_handler3_contai
# After everything is installed, remove info dir
rm -f %{buildroot}%{_infodir}/dir
install -m0644 -D abrt.sysusers.conf %{buildroot}%{_sysusersdir}/abrt.conf
%check
make check|| {
# find and print the logs of failed test
@ -561,6 +548,13 @@ make check|| {
exit 1
}
%pre
#uidgid pair 173:173 reserved in setup rhbz#670231
%define abrt_gid_uid 173
getent group abrt >/dev/null || groupadd -f -g %{abrt_gid_uid} --system abrt
getent passwd abrt >/dev/null || useradd --system -g abrt -u %{abrt_gid_uid} -d /etc/abrt -s /sbin/nologin abrt
exit 0
%post
# $1 == 1 if install; 2 if upgrade
%systemd_post abrtd.service
@ -760,7 +754,6 @@ killall abrt-dbus >/dev/null 2>&1 || :
%{_mandir}/man5/abrt-action-save-package-data.conf.5*
%{_mandir}/man5/gpg_keys.conf.5*
%{_mandir}/man8/abrtd.8*
%{_sysusersdir}/abrt.conf
%files libs
%{_libdir}/libabrt.so.*
@ -994,38 +987,10 @@ killall abrt-dbus >/dev/null 2>&1 || :
%config(noreplace) %{_sysconfdir}/profile.d/abrt-console-notification.sh
%changelog
* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.8-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
* Thu Dec 04 2025 Michal Srb <michal@redhat.com> - 2.17.8-1
- a-a-save-container-data: validate input
- Resolves: CVE-2025-12744
* Thu Oct 02 2025 Michal Srb <michal@redhat.com> - 2.17.7-1
- Update to upstream release 2.17.7
- Fix reading gpg keys with RPM 6.0.0 (rhbz#2396899)
* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 2.17.6-10
- Rebuilt for Python 3.14.0rc3 bytecode
* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 2.17.6-9
- Rebuilt for Python 3.14.0rc2 bytecode
* Fri Aug 01 2025 Adam Williamson <awilliam@redhat.com> - 2.17.6-8
- Obsolete fros packages
* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.6-7
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Tue Jun 03 2025 Python Maint <python-maint@redhat.com> - 2.17.6-6
- Rebuilt for Python 3.14
* Thu Jan 23 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.17.6-5
- Add sysusers.d config file to allow rpm to create users/groups automatically
* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.6-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Wed Nov 20 2024 David Abdurachmanov <davidlt@rivosinc.com> - 2.17.6-3
- Disable Requires for kexec-tools on riscv64 (not supported)