Backport fix for CVE-2017-9735

0001-Fedora-jetty.home.patch

@@ -1,7 +1,7 @@
-From f1f4aeb6dba93f9a661d2a256354340e20b4c34b Mon Sep 17 00:00:00 2001
+From eb9188494ba02e814743ada328c3c6974e8c8005 Mon Sep 17 00:00:00 2001
 From: Michael Simacek <msimacek@redhat.com>
 Date: Tue, 2 Jun 2015 22:52:21 +0200
-Subject: [PATCH 1/2] Fedora jetty.home
+Subject: [PATCH 1/3] Fedora jetty.home
 
 ---
  .../java/org/eclipse/jetty/start/config/CommandLineConfigSource.java | 5 ++++-
@@ -24,5 +24,5 @@ index 4643da6..b99c7c0 100644
                  catch (URISyntaxException e)
                  {
 -- 
-2.5.0
+2.9.4
 

0002-Port-to-current-mongo-java-driver.patch

@@ -1,7 +1,7 @@
-From 18e34079ebd36a73ce0ed1522ef52f8e8f702fb7 Mon Sep 17 00:00:00 2001
+From d3df89f397f271ab06282c6bc04bb53ec5f3dc02 Mon Sep 17 00:00:00 2001
 From: Michael Simacek <msimacek@redhat.com>
 Date: Mon, 15 Feb 2016 10:51:24 +0100
-Subject: [PATCH 2/2] Port to current mongo-java-driver
+Subject: [PATCH 2/3] Port to current mongo-java-driver
 
 ---
  .../java/org/eclipse/jetty/nosql/mongodb/MongoSessionIdManager.java | 6 +++---
@@ -33,5 +33,5 @@ index e078b9a..62c1c15 100644
                  BasicDBObjectBuilder.start().add("sparse", false).add("background", true).get());
      }
 -- 
-2.5.0
+2.9.4
 

0003-Backport-fix-for-CVE-2017-9735.patch

@@ -0,0 +1,213 @@
+From cacb900d245328a39b2f085dcd7f63d93db5773f Mon Sep 17 00:00:00 2001
+From: Simone Bordet <simone.bordet@gmail.com>
+Date: Tue, 16 May 2017 10:41:08 +0200
+Subject: [PATCH 3/3] Backport fix for CVE-2017-9735
+
+---
+ .../security/jaspi/modules/DigestAuthModule.java   |  3 +-
+ .../authentication/DigestAuthenticator.java        |  2 +-
+ .../eclipse/jetty/util/security/Credential.java    | 67 +++++++++++++++++-----
+ .../org/eclipse/jetty/util/security/Password.java  | 28 ++++-----
+ 4 files changed, 69 insertions(+), 31 deletions(-)
+
+diff --git a/jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/modules/DigestAuthModule.java b/jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/modules/DigestAuthModule.java
+index a6a39c3..c28b230 100644
+--- a/jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/modules/DigestAuthModule.java
++++ b/jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/modules/DigestAuthModule.java
+@@ -336,7 +336,7 @@ public class DigestAuthModule extends BaseAuthModule
+                 byte[] digest = md.digest();
+ 
+                 // check digest
+-                return (TypeUtil.toString(digest, 16).equalsIgnoreCase(response));
++                return stringEquals(TypeUtil.toString(digest, 16).toLowerCase(), response == null ? null : response.toLowerCase());
+             }
+             catch (Exception e)
+             {
+@@ -351,6 +351,5 @@ public class DigestAuthModule extends BaseAuthModule
+         {
+             return username + "," + response;
+         }
+-
+     }
+ }
+diff --git a/jetty-security/src/main/java/org/eclipse/jetty/security/authentication/DigestAuthenticator.java b/jetty-security/src/main/java/org/eclipse/jetty/security/authentication/DigestAuthenticator.java
+index 9359da1..0413f61 100644
+--- a/jetty-security/src/main/java/org/eclipse/jetty/security/authentication/DigestAuthenticator.java
++++ b/jetty-security/src/main/java/org/eclipse/jetty/security/authentication/DigestAuthenticator.java
+@@ -402,7 +402,7 @@ public class DigestAuthenticator extends LoginAuthenticator
+                 byte[] digest = md.digest();
+ 
+                 // check digest
+-                return (TypeUtil.toString(digest, 16).equalsIgnoreCase(response));
++                return stringEquals(TypeUtil.toString(digest, 16).toLowerCase(), response == null ? null : response.toLowerCase());
+             }
+             catch (Exception e)
+             {
+diff --git a/jetty-util/src/main/java/org/eclipse/jetty/util/security/Credential.java b/jetty-util/src/main/java/org/eclipse/jetty/util/security/Credential.java
+index 660116f..af43c97 100644
+--- a/jetty-util/src/main/java/org/eclipse/jetty/util/security/Credential.java
++++ b/jetty-util/src/main/java/org/eclipse/jetty/util/security/Credential.java
+@@ -78,6 +78,54 @@ public abstract class Credential implements Serializable
+ 
+     /* ------------------------------------------------------------ */
+     /**
++     * <p>Utility method that replaces String.equals() to avoid timing attacks.</p>
++     *
++     * @param s1 the first string to compare
++     * @param s2 the second string to compare
++     * @return whether the two strings are equal
++     */
++    protected static boolean stringEquals(String s1, String s2)
++    {
++        if (s1 == s2)
++            return true;
++        if (s1 == null || s2 == null)
++            return false;
++        boolean result = true;
++        int l1 = s1.length();
++        int l2 = s2.length();
++        if (l1 != l2)
++            result = false;
++        int l = Math.min(l1, l2);
++        for (int i = 0; i < l; ++i)
++            result &= s1.charAt(i) == s2.charAt(i);
++        return result;
++    }
++
++    /**
++     * <p>Utility method that replaces Arrays.equals() to avoid timing attacks.</p>
++     *
++     * @param b1 the first byte array to compare
++     * @param b2 the second byte array to compare
++     * @return whether the two byte arrays are equal
++     */
++    protected static boolean byteEquals(byte[] b1, byte[] b2)
++    {
++        if (b1 == b2)
++            return true;
++        if (b1 == null || b2 == null)
++            return false;
++        boolean result = true;
++        int l1 = b1.length;
++        int l2 = b2.length;
++        if (l1 != l2)
++            result = false;
++        int l = Math.min(l1, l2);
++        for (int i = 0; i < l; ++i)
++            result &= b1[i] == b2[i];
++        return result;
++    }
++
++    /**
+      * Unix Crypt Credentials
+      */
+     public static class Crypt extends Credential
+@@ -101,8 +149,7 @@ public abstract class Credential implements Serializable
+             if (!(credentials instanceof String) && !(credentials instanceof Password)) 
+                 LOG.warn("Can't check " + credentials.getClass() + " against CRYPT");
+ 
+-            String passwd = credentials.toString();
+-            return _cooked.equals(UnixCrypt.crypt(passwd, _cooked));
++            return stringEquals(_cooked, UnixCrypt.crypt(credentials.toString(), _cooked));
+         }
+ 
+         public static String crypt(String user, String pw)
+@@ -159,26 +206,18 @@ public abstract class Credential implements Serializable
+                         __md.update(credentials.toString().getBytes(StandardCharsets.ISO_8859_1));
+                         digest = __md.digest();
+                     }
+-                    if (digest == null || digest.length != _digest.length) return false;
+-                    boolean digestMismatch = false;
+-                    for (int i = 0; i < digest.length; i++)
+-                        digestMismatch |= (digest[i] != _digest[i]);
+-                    return !digestMismatch;
++                    return byteEquals(_digest, digest);
+                 }
+                 else if (credentials instanceof MD5)
+                 {
+-                    MD5 md5 = (MD5) credentials;
+-                    if (_digest.length != md5._digest.length) return false;
+-                    boolean digestMismatch = false;
+-                    for (int i = 0; i < _digest.length; i++)
+-                        digestMismatch |= (_digest[i] != md5._digest[i]);
+-                    return !digestMismatch;
++                    MD5 md5 = (MD5)credentials;
++                    return byteEquals(_digest, md5._digest);
+                 }
+                 else if (credentials instanceof Credential)
+                 {
+                     // Allow credential to attempt check - i.e. this'll work
+                     // for DigestAuthModule$Digest credentials
+-                    return ((Credential) credentials).check(this);
++                    return ((Credential)credentials).check(this);
+                 }
+                 else
+                 {
+diff --git a/jetty-util/src/main/java/org/eclipse/jetty/util/security/Password.java b/jetty-util/src/main/java/org/eclipse/jetty/util/security/Password.java
+index 9b4174e..58e862d 100644
+--- a/jetty-util/src/main/java/org/eclipse/jetty/util/security/Password.java
++++ b/jetty-util/src/main/java/org/eclipse/jetty/util/security/Password.java
+@@ -20,7 +20,7 @@ package org.eclipse.jetty.util.security;
+ 
+ import java.io.IOException;
+ import java.nio.charset.StandardCharsets;
+-import java.util.Arrays;
++
+ 
+ import org.eclipse.jetty.util.log.Log;
+ import org.eclipse.jetty.util.log.Logger;
+@@ -95,15 +95,20 @@ public class Password extends Credential
+     @Override
+     public boolean check(Object credentials)
+     {
+-        if (this == credentials) return true;
++        if (this == credentials)
++            return true;
+ 
+-        if (credentials instanceof Password) return credentials.equals(_pw);
++        if (credentials instanceof Password)
++            return credentials.equals(_pw);
+ 
+-        if (credentials instanceof String) return credentials.equals(_pw);
++        if (credentials instanceof String)
++            return stringEquals(_pw, (String)credentials);
+ 
+-        if (credentials instanceof char[]) return Arrays.equals(_pw.toCharArray(), (char[]) credentials);
++        if (credentials instanceof char[])
++            return stringEquals(_pw, new String((char[])credentials));
+ 
+-        if (credentials instanceof Credential) return ((Credential) credentials).check(_pw);
++        if (credentials instanceof Credential)
++            return ((Credential)credentials).check(_pw);
+ 
+         return false;
+     }
+@@ -119,14 +124,10 @@ public class Password extends Credential
+             return false;
+ 
+         if (o instanceof Password)
+-        {
+-            Password p = (Password) o;
+-            //noinspection StringEquality
+-            return p._pw == _pw || (null != _pw && _pw.equals(p._pw));
+-        }
++            return stringEquals(_pw, ((Password)o)._pw);
+ 
+-        if (o instanceof String) 
+-            return o.equals(_pw);
++        if (o instanceof String)
++            return stringEquals(_pw, (String)o);
+ 
+         return false;
+     }
+@@ -174,7 +175,6 @@ public class Password extends Credential
+ 
+         }
+         return buf.toString();
+-
+     }
+ 
+     /* ------------------------------------------------------------ */
+-- 
+2.9.4
+

jetty.spec

@@ -55,7 +55,7 @@
 
 Name:           jetty
 Version:        9.3.7
-Release:        2.%{addver}%{?dist}
+Release:        3.%{addver}%{?dist}
 Summary:        Java Webserver and Servlet Container
 
 # Jetty is dual licensed under both ASL 2.0 and EPL 1.0, see NOTICE.txt
@@ -70,6 +70,7 @@ Source6:        LICENSE-MIT
 
 Patch1:         0001-Fedora-jetty.home.patch
 Patch2:         0002-Port-to-current-mongo-java-driver.patch
+Patch3:         0003-Backport-fix-for-CVE-2017-9735.patch
 
 BuildRequires:  geronimo-annotation
 BuildRequires:  geronimo-jaspic-spec
@@ -596,6 +597,7 @@ License:        (ASL 2.0 or EPL) and MIT
 
 %patch1 -p1
 %patch2 -p1
+%patch3 -p1
 
 find . -name "*.?ar" -exec rm {} \;
 find . -name "*.class" -exec rm {} \;
@@ -656,6 +658,9 @@ sed -i 's#;</Export-Package>#</Export-Package>#' jetty-http2/http2-common/pom.xm
 %pom_xpath_remove "pom:execution[pom:id[text()='unpack-test-jndi-config']]" jetty-distribution/pom.xml
 %pom_xpath_remove "pom:execution[pom:id[text()='unpack-test-spec-config']]" jetty-distribution/pom.xml
 
+# Remove google analytics from javadoc
+%pom_xpath_remove 'pom:plugin[pom:artifactId="maven-javadoc-plugin"]/pom:configuration/pom:header'
+
 # We don't have this plugin yet
 %pom_remove_plugin :findbugs-maven-plugin jetty-websocket/pom.xml
 
@@ -969,6 +974,9 @@ exit 0
 %doc NOTICE.txt LICENSE*
 
 %changelog
+* Thu Jun 29 2017 Michael Simacek <msimacek@redhat.com> - 9.3.7-3.v20160115
+- Backport fix for CVE-2017-9735
+
 * Fri Feb 19 2016 Michael Simacek <msimacek@redhat.com> - 9.3.7-2.v20160115
 - Use %%_tmpfilesdir
 - Resolves: rhbz#1289494