From daac0c001006a66e13473820f2c187ae83e3c74b Mon Sep 17 00:00:00 2001 From: Vitezslav Crhonek Date: Wed, 21 Feb 2018 11:05:38 +0100 Subject: [PATCH 1/4] Fix wrong SSL_CTX_set_cipher_list() retval check --- ...sman-2.6.5-fix-set-cipher-list-retval-check.patch | 12 ++++++++++++ openwsman.spec | 6 +++++- 2 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 openwsman-2.6.5-fix-set-cipher-list-retval-check.patch diff --git a/openwsman-2.6.5-fix-set-cipher-list-retval-check.patch b/openwsman-2.6.5-fix-set-cipher-list-retval-check.patch new file mode 100644 index 0000000..dc3e52c --- /dev/null +++ b/openwsman-2.6.5-fix-set-cipher-list-retval-check.patch @@ -0,0 +1,12 @@ +diff -up openwsman-2.6.5/src/server/shttpd/shttpd.c.orig openwsman-2.6.5/src/server/shttpd/shttpd.c +--- openwsman-2.6.5/src/server/shttpd/shttpd.c.orig 2018-02-21 10:53:24.964163710 +0100 ++++ openwsman-2.6.5/src/server/shttpd/shttpd.c 2018-02-21 10:53:31.854162875 +0100 +@@ -1541,7 +1541,7 @@ set_ssl(struct shttpd_ctx *ctx, const ch + + if (ssl_cipher_list) { + int rc = SSL_CTX_set_cipher_list(CTX, ssl_cipher_list); +- if (rc != 0) { ++ if (rc != 1) { + _shttpd_elog(E_LOG, NULL, "Failed to set SSL cipher list \"%s\"", ssl_cipher_list); + } + } diff --git a/openwsman.spec b/openwsman.spec index b46e1b3..d062f11 100644 --- a/openwsman.spec +++ b/openwsman.spec @@ -3,7 +3,7 @@ Name: openwsman Version: 2.6.5 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Open source Implementation of WS-Management License: BSD @@ -19,6 +19,7 @@ Patch1: openwsman-2.4.0-pamsetup.patch Patch2: openwsman-2.4.12-ruby-binding-build.patch Patch3: openwsman-2.6.2-openssl-1.1-fix.patch Patch4: openwsman-2.6.5-http-status-line.patch +Patch5: openwsman-2.6.5-fix-set-cipher-list-retval-check.patch BuildRequires: swig BuildRequires: libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel BuildRequires: python3 python3-devel ruby ruby-devel rubygems-devel perl-interpreter @@ -279,6 +280,9 @@ rm -f /var/log/wsmand.log %{_bindir}/winrs %changelog +* Wed Feb 21 2018 Vitezslav Crhonek - 2.6.5-3 +- Fix wrong SSL_CTX_set_cipher_list() retval check + * Thu Feb 08 2018 Fedora Release Engineering - 2.6.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild From 7ba0946df4a41050fdcc76e59adfe0f3bb1db58d Mon Sep 17 00:00:00 2001 From: Vitezslav Crhonek Date: Thu, 22 Feb 2018 10:00:43 +0100 Subject: [PATCH 2/4] Apply the last patch --- openwsman.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/openwsman.spec b/openwsman.spec index d062f11..e406ffa 100644 --- a/openwsman.spec +++ b/openwsman.spec @@ -125,6 +125,7 @@ You can use it to send shell commands to a remote Windows hosts. %patch2 -p1 -b .ruby-binding-build %patch3 -p1 -b .openssl-1.1-fix %patch4 -p1 -b .http-status-line +%patch5 -p1 -b .fix-set-cipher-list-retval-check %build # Removing executable permissions on .c and .h files to fix rpmlint warnings. From b58164a39c6e5f039217398bb20660f7d45bd808 Mon Sep 17 00:00:00 2001 From: Vitezslav Crhonek Date: Wed, 28 Feb 2018 10:17:02 +0100 Subject: [PATCH 3/4] Explicitly disable build of java binding --- openwsman.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openwsman.spec b/openwsman.spec index e406ffa..0afaaac 100644 --- a/openwsman.spec +++ b/openwsman.spec @@ -147,6 +147,7 @@ cmake \ -DCMAKE_SKIP_RPATH=1 \ -DPACKAGE_ARCHITECTURE=`uname -m` \ -DLIB=%{_lib} \ + -DBUILD_JAVA=no \ .. make @@ -283,6 +284,7 @@ rm -f /var/log/wsmand.log %changelog * Wed Feb 21 2018 Vitezslav Crhonek - 2.6.5-3 - Fix wrong SSL_CTX_set_cipher_list() retval check +- Explicitly disable build of java bindings (build fails if java-devel is installed) * Thu Feb 08 2018 Fedora Release Engineering - 2.6.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild From 765e7c501babb71cd73f28ed7117b93510760bf6 Mon Sep 17 00:00:00 2001 From: Vitezslav Crhonek Date: Wed, 13 Mar 2019 15:24:07 +0100 Subject: [PATCH 4/4] Fix CVE-2019-3816 and CVE-2019-3833 --- openwsman-2.6.5-CVE-2019-3816.patch | 79 ++++++++++++++++++++++++ openwsman-2.6.5-CVE-2019-3833.patch | 94 +++++++++++++++++++++++++++++ openwsman.spec | 12 +++- 3 files changed, 184 insertions(+), 1 deletion(-) create mode 100644 openwsman-2.6.5-CVE-2019-3816.patch create mode 100644 openwsman-2.6.5-CVE-2019-3833.patch diff --git a/openwsman-2.6.5-CVE-2019-3816.patch b/openwsman-2.6.5-CVE-2019-3816.patch new file mode 100644 index 0000000..ba91ba7 --- /dev/null +++ b/openwsman-2.6.5-CVE-2019-3816.patch @@ -0,0 +1,79 @@ +diff -up openwsman-2.6.5/src/server/shttpd/shttpd.c.orig openwsman-2.6.5/src/server/shttpd/shttpd.c +--- openwsman-2.6.5/src/server/shttpd/shttpd.c.orig 2019-03-13 10:20:07.376527798 +0100 ++++ openwsman-2.6.5/src/server/shttpd/shttpd.c 2019-03-13 10:20:07.380527801 +0100 +@@ -336,10 +336,12 @@ date_to_epoch(const char *s) + } + + static void +-remove_double_dots(char *s) ++remove_all_leading_dots(char *s) + { + char *p = s; + ++ while (*s != '\0' && *s == '.') s++; ++ + while (*s != '\0') { + *p++ = *s++; + if (s[-1] == '/' || s[-1] == '\\') +@@ -546,7 +548,7 @@ decide_what_to_do(struct conn *c) + *c->query++ = '\0'; + + _shttpd_url_decode(c->uri, strlen(c->uri), c->uri, strlen(c->uri) + 1); +- remove_double_dots(c->uri); ++ remove_all_leading_dots(c->uri); + + root = c->ctx->options[OPT_ROOT]; + if (strlen(c->uri) + strlen(root) >= sizeof(path)) { +@@ -556,6 +558,7 @@ decide_what_to_do(struct conn *c) + + (void) _shttpd_snprintf(path, sizeof(path), "%s%s", root, c->uri); + ++ DBG(("decide_what_to_do -> processed path: [%s]", path)); + /* User may use the aliases - check URI for mount point */ + if (is_alias(c->ctx, c->uri, &alias_uri, &alias_path) != NULL) { + (void) _shttpd_snprintf(path, sizeof(path), "%.*s%s", +@@ -572,7 +575,10 @@ decide_what_to_do(struct conn *c) + if ((ruri = _shttpd_is_registered_uri(c->ctx, c->uri)) != NULL) { + _shttpd_setup_embedded_stream(c, + ruri->callback, ruri->callback_data); +- } else ++ } else { ++ _shttpd_send_server_error(c, 403, "Forbidden"); ++ } ++#if 0 + if (strstr(path, HTPASSWD)) { + /* Do not allow to view passwords files */ + _shttpd_send_server_error(c, 403, "Forbidden"); +@@ -656,6 +662,7 @@ decide_what_to_do(struct conn *c) + } else { + _shttpd_send_server_error(c, 500, "Internal Error"); + } ++#endif + } + + static int +diff -up openwsman-2.6.5/src/server/wsmand.c.orig openwsman-2.6.5/src/server/wsmand.c +--- openwsman-2.6.5/src/server/wsmand.c.orig 2017-11-28 09:32:15.000000000 +0100 ++++ openwsman-2.6.5/src/server/wsmand.c 2019-03-13 10:20:07.380527801 +0100 +@@ -198,6 +198,10 @@ static void daemonize(void) + int fd; + char *pid; + ++ /* Change our CWD to / */ ++ i = chdir("/"); ++ assert(i == 0); ++ + if (wsmand_options_get_foreground_debug() > 0) { + return; + } +@@ -214,10 +218,6 @@ static void daemonize(void) + log_pid = 0; + setsid(); + +- /* Change our CWD to / */ +- i=chdir("/"); +- assert(i == 0); +- + /* Close all file descriptors. */ + for (i = getdtablesize(); i >= 0; --i) + close(i); diff --git a/openwsman-2.6.5-CVE-2019-3833.patch b/openwsman-2.6.5-CVE-2019-3833.patch new file mode 100644 index 0000000..55bca2e --- /dev/null +++ b/openwsman-2.6.5-CVE-2019-3833.patch @@ -0,0 +1,94 @@ +diff -up openwsman-2.6.5/src/server/shttpd/shttpd.c.orig openwsman-2.6.5/src/server/shttpd/shttpd.c +--- openwsman-2.6.5/src/server/shttpd/shttpd.c.orig 2019-03-13 10:22:04.707624240 +0100 ++++ openwsman-2.6.5/src/server/shttpd/shttpd.c 2019-03-13 10:22:04.711624243 +0100 +@@ -705,11 +705,11 @@ parse_http_request(struct conn *c) + _shttpd_send_server_error(c, 500, "Cannot allocate request"); + } + ++ io_inc_tail(&c->rem.io, req_len); ++ + if (c->loc.flags & FLAG_CLOSED) + return; + +- io_inc_tail(&c->rem.io, req_len); +- + DBG(("Conn %d: parsing request: [%.*s]", c->rem.chan.sock, req_len, s)); + c->rem.flags |= FLAG_HEADERS_PARSED; + +@@ -975,7 +975,7 @@ write_stream(struct stream *from, struct + } + + +-static void ++static int + connection_desctructor(struct llhead *lp) + { + struct conn *c = LL_ENTRY(lp, struct conn, link); +@@ -999,7 +999,8 @@ connection_desctructor(struct llhead *lp + * Check the "Connection: " header before we free c->request + * If it its 'keep-alive', then do not close the connection + */ +- do_close = (c->ch.connection.v_vec.len >= vec.len && ++ do_close = c->rem.flags & FLAG_CLOSED || ++ (c->ch.connection.v_vec.len >= vec.len && + !_shttpd_strncasecmp(vec.ptr,c->ch.connection.v_vec.ptr,vec.len)) || + (c->major_version < 1 || + (c->major_version >= 1 && c->minor_version < 1)); +@@ -1021,7 +1022,7 @@ connection_desctructor(struct llhead *lp + io_clear(&c->loc.io); + c->birth_time = _shttpd_current_time; + if (io_data_len(&c->rem.io) > 0) +- process_connection(c, 0, 0); ++ return 1; + } else { + if (c->rem.io_class != NULL) + c->rem.io_class->close(&c->rem); +@@ -1032,6 +1033,8 @@ connection_desctructor(struct llhead *lp + + free(c); + } ++ ++ return 0; + } + + static void +@@ -1039,7 +1042,7 @@ worker_destructor(struct llhead *lp) + { + struct worker *worker = LL_ENTRY(lp, struct worker, link); + +- free_list(&worker->connections, connection_desctructor); ++ free_list(&worker->connections, (void (*)(struct llhead *))connection_desctructor); + free(worker); + } + +@@ -1072,6 +1075,8 @@ add_to_set(int fd, fd_set *set, int *max + static void + process_connection(struct conn *c, int remote_ready, int local_ready) + { ++again: ++ + /* Read from remote end if it is ready */ + if (remote_ready && io_space_len(&c->rem.io)) + read_stream(&c->rem); +@@ -1100,7 +1105,11 @@ process_connection(struct conn *c, int r + if ((_shttpd_current_time > c->expire_time) || + (c->rem.flags & FLAG_CLOSED) || + ((c->loc.flags & FLAG_CLOSED) && !io_data_len(&c->loc.io))) +- connection_desctructor(&c->link); ++ if (connection_desctructor(&c->link)) { ++ remote_ready = 0; ++ local_ready = 0; ++ goto again; ++ } + } + + static int +@@ -1640,7 +1649,7 @@ worker_function(void *param) + while (worker->exit_flag == 0) + poll_worker(worker, 1000 * 10); + +- free_list(&worker->connections, connection_desctructor); ++ free_list(&worker->connections, (void (*)(struct llhead *))connection_desctructor); + free(worker); + } + diff --git a/openwsman.spec b/openwsman.spec index 0afaaac..c6c2122 100644 --- a/openwsman.spec +++ b/openwsman.spec @@ -3,7 +3,7 @@ Name: openwsman Version: 2.6.5 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Open source Implementation of WS-Management License: BSD @@ -20,6 +20,8 @@ Patch2: openwsman-2.4.12-ruby-binding-build.patch Patch3: openwsman-2.6.2-openssl-1.1-fix.patch Patch4: openwsman-2.6.5-http-status-line.patch Patch5: openwsman-2.6.5-fix-set-cipher-list-retval-check.patch +Patch6: openwsman-2.6.5-CVE-2019-3816.patch +Patch7: openwsman-2.6.5-CVE-2019-3833.patch BuildRequires: swig BuildRequires: libcurl-devel libxml2-devel pam-devel sblim-sfcc-devel BuildRequires: python3 python3-devel ruby ruby-devel rubygems-devel perl-interpreter @@ -126,6 +128,8 @@ You can use it to send shell commands to a remote Windows hosts. %patch3 -p1 -b .openssl-1.1-fix %patch4 -p1 -b .http-status-line %patch5 -p1 -b .fix-set-cipher-list-retval-check +%patch6 -p1 -b .CVE-2019-3816 +%patch7 -p1 -b .CVE-2019-3833 %build # Removing executable permissions on .c and .h files to fix rpmlint warnings. @@ -282,6 +286,12 @@ rm -f /var/log/wsmand.log %{_bindir}/winrs %changelog +* Wed Mar 13 2019 Vitezslav Crhonek - 2.6.5-4 +- Fix CVE-2019-3816 + Resolves: #1687760 +- Fix CVE-2019-3833 + Resolves: #1687762 + * Wed Feb 21 2018 Vitezslav Crhonek - 2.6.5-3 - Fix wrong SSL_CTX_set_cipher_list() retval check - Explicitly disable build of java bindings (build fails if java-devel is installed)