From 9073da9177afbab893880c355266cf282fd6836c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= Date: Mon, 27 Jan 2020 13:54:59 +0100 Subject: [PATCH 01/24] Fix potential stack exhaustion in function listdir (CVE-2019-20176) Resolves: rhbz#1795152 --- ...single-buffer-to-store-every-file-na.patch | 70 +++++++++++++++++++ pure-ftpd.spec | 8 ++- 2 files changed, 77 insertions(+), 1 deletion(-) create mode 100644 0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch diff --git a/0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch b/0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch new file mode 100644 index 0000000..efed2f3 --- /dev/null +++ b/0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch @@ -0,0 +1,70 @@ +From aea56f4bcb9948d456f3fae4d044fd3fa2e19706 Mon Sep 17 00:00:00 2001 +From: Frank Denis +Date: Mon, 30 Dec 2019 17:40:04 +0100 +Subject: [PATCH] listdir(): reuse a single buffer to store every file name to + display + +Allocating a new buffer for each entry is useless. + +And as these buffers are allocated on the stack, on systems with a +small stack size, with many entries, the limit can easily be reached, +causing a stack exhaustion and aborting the user session. + +Reported by Antonio Morales from the GitHub Security Lab team, thanks! +--- + src/ls.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/src/ls.c b/src/ls.c +index cf804c7..f8a588f 100644 +--- a/src/ls.c ++++ b/src/ls.c +@@ -661,6 +661,8 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, + char *names; + PureFileInfo *s; + PureFileInfo *r; ++ char *alloca_subdir; ++ size_t sizeof_subdir; + int d; + + if (depth >= max_ls_depth || matches >= max_ls_files) { +@@ -690,14 +692,12 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, + } + outputfiles(f, tls_fd); + r = dir; ++ sizeof_subdir = PATH_MAX + 1U; ++ if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) { ++ goto toomany; ++ } + while (opt_R && r != s) { + if (r->name_offset != (size_t) -1 && !chdir(FI_NAME(r))) { +- char *alloca_subdir; +- const size_t sizeof_subdir = PATH_MAX + 1U; +- +- if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) { +- goto toomany; +- } + if (SNCHECK(snprintf(alloca_subdir, sizeof_subdir, "%s/%s", + name, FI_NAME(r)), sizeof_subdir)) { + goto nolist; +@@ -706,8 +706,8 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, + wrstr(f, tls_fd, alloca_subdir); + wrstr(f, tls_fd, ":\r\n\r\n"); + listdir(depth + 1U, f, tls_fd, alloca_subdir); ++ + nolist: +- ALLOCA_FREE(alloca_subdir); + if (matches >= max_ls_files) { + goto toomany; + } +@@ -720,6 +720,7 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, + r++; + } + toomany: ++ ALLOCA_FREE(alloca_subdir); + free(names); + free(dir); + names = NULL; +-- +2.20.1 + diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 24d2838..afc2ef3 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -16,6 +16,8 @@ Source8: pure-ftpd-with-tls-init.service Source9: pure-ftpd-with-tls.service Patch0: 0001-modify-pam.patch Patch1: 0002-fedora-specific-config-file.patch +# Upstream patch: +Patch2: 0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch Provides: ftpserver BuildRequires: pam-devel, libcap-devel @@ -227,6 +229,10 @@ fi %changelog +* Mon Jan 27 2020 Ondřej Lysoněk - 1.0.49-3 +- Fix potential stack exhaustion in function listdir (CVE-2019-20176) +- Resolves: rhbz#1795152 + * Fri Jul 26 2019 Fedora Release Engineering - 1.0.49-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 07656be37eb46816a406dcde0506dda3f80150d0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 30 Jan 2020 09:59:24 +0000 Subject: [PATCH 02/24] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index afc2ef3..d266ea4 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -229,6 +229,9 @@ fi %changelog +* Thu Jan 30 2020 Fedora Release Engineering - 1.0.49-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Mon Jan 27 2020 Ondřej Lysoněk - 1.0.49-3 - Fix potential stack exhaustion in function listdir (CVE-2019-20176) - Resolves: rhbz#1795152 From a8e246895844b624a0b71b14aaed20bda5702ef4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Lyson=C4=9Bk?= Date: Wed, 6 May 2020 18:27:45 +0200 Subject: [PATCH 03/24] Fix CVE-2020-9365 and CVE-2020-9274 Resolves: rhbz#1828688 Resolves: rhbz#1831059 --- ...ays-set-the-tail-of-the-list-to-NULL.patch | 34 +++++++++++++++++++ 0001-pure_strcmp-len-s2-can-be-len-s1.patch | 28 +++++++++++++++ pure-ftpd.spec | 11 +++++- 3 files changed, 72 insertions(+), 1 deletion(-) create mode 100644 0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch create mode 100644 0001-pure_strcmp-len-s2-can-be-len-s1.patch diff --git a/0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch b/0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch new file mode 100644 index 0000000..d5b2523 --- /dev/null +++ b/0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch @@ -0,0 +1,34 @@ +From 8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa Mon Sep 17 00:00:00 2001 +From: Frank Denis +Date: Tue, 18 Feb 2020 18:36:58 +0100 +Subject: [PATCH] diraliases: always set the tail of the list to NULL + +Spotted and reported by Antonio Norales from GitHub Security Labs. +Thanks! +--- + src/diraliases.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/diraliases.c b/src/diraliases.c +index 4002a36..fb70273 100644 +--- a/src/diraliases.c ++++ b/src/diraliases.c +@@ -93,7 +93,6 @@ int init_aliases(void) + (tail->dir = strdup(dir)) == NULL) { + die_mem(); + } +- tail->next = NULL; + } else { + DirAlias *curr; + +@@ -105,6 +104,7 @@ int init_aliases(void) + tail->next = curr; + tail = curr; + } ++ tail->next = NULL; + } + fclose(fp); + aliases_up++; +-- +2.25.4 + diff --git a/0001-pure_strcmp-len-s2-can-be-len-s1.patch b/0001-pure_strcmp-len-s2-can-be-len-s1.patch new file mode 100644 index 0000000..375b970 --- /dev/null +++ b/0001-pure_strcmp-len-s2-can-be-len-s1.patch @@ -0,0 +1,28 @@ +From bf6fcd4935e95128cf22af5924cdc8fe5c0579da Mon Sep 17 00:00:00 2001 +From: Frank Denis +Date: Mon, 24 Feb 2020 15:19:43 +0100 +Subject: [PATCH] pure_strcmp(): len(s2) can be > len(s1) + +Reported by Antonio Morales from GitHub Security Labs, thanks! +--- + src/utils.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/utils.c b/src/utils.c +index f41492d..5e88104 100644 +--- a/src/utils.c ++++ b/src/utils.c +@@ -45,5 +45,9 @@ int pure_memcmp(const void * const b1_, const void * const b2_, size_t len) + + int pure_strcmp(const char * const s1, const char * const s2) + { +- return pure_memcmp(s1, s2, strlen(s1) + 1U); ++ const size_t s1_len = strlen(s1); ++ const size_t s2_len = strlen(s2); ++ const size_t len = (s1_len < s2_len) ? s1_len : s2_len; ++ ++ return pure_memcmp(s1, s2, len + 1); + } +-- +2.25.4 + diff --git a/pure-ftpd.spec b/pure-ftpd.spec index d266ea4..6fa83bb 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -18,6 +18,10 @@ Patch0: 0001-modify-pam.patch Patch1: 0002-fedora-specific-config-file.patch # Upstream patch: Patch2: 0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch +# Upstream patch: +Patch3: 0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch +# Upstream patch: +Patch4: 0001-pure_strcmp-len-s2-can-be-len-s1.patch Provides: ftpserver BuildRequires: pam-devel, libcap-devel @@ -229,6 +233,11 @@ fi %changelog +* Wed May 06 2020 Ondřej Lysoněk - 1.0.49-5 +- Fix CVE-2020-9365 and CVE-2020-9274 +- Resolves: rhbz#1828688 +- Resolves: rhbz#1831059 + * Thu Jan 30 2020 Fedora Release Engineering - 1.0.49-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From 9b9a61bcc6dbb98bf7c2d9f6c46b90ac9781139e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 28 Jul 2020 23:11:18 +0000 Subject: [PATCH 04/24] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 6fa83bb..a821cb0 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -233,6 +233,9 @@ fi %changelog +* Tue Jul 28 2020 Fedora Release Engineering - 1.0.49-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Wed May 06 2020 Ondřej Lysoněk - 1.0.49-5 - Fix CVE-2020-9365 and CVE-2020-9274 - Resolves: rhbz#1828688 From 31773595729d16ea14571ffc2f5d2be1519e67d2 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Fri, 8 Jan 2021 19:38:28 +0000 Subject: [PATCH 05/24] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- pure-ftpd.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index a821cb0..68d0d37 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -24,6 +24,7 @@ Patch3: 0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch Patch4: 0001-pure_strcmp-len-s2-can-be-len-s1.patch Provides: ftpserver +BuildRequires: make BuildRequires: pam-devel, libcap-devel %{!?_without_ldap:BuildRequires: openldap-devel} %{!?_without_mysql:BuildRequires: mariadb-connector-c-devel} From 413183aa914be26711498bb775da712436787c60 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 08:45:39 +0000 Subject: [PATCH 06/24] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 68d0d37..49f15bc 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -234,6 +234,9 @@ fi %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 1.0.49-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Tue Jul 28 2020 Fedora Release Engineering - 1.0.49-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From bda0bb39680cedc80e779658f9873a4766c5cfde Mon Sep 17 00:00:00 2001 From: Pavel Raiskup Date: Mon, 8 Feb 2021 10:26:30 +0100 Subject: [PATCH 07/24] rebuild for libpq ABI fix Related: rhbz#1908268 --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 49f15bc..42fd2e5 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -234,6 +234,9 @@ fi %changelog +* Mon Feb 08 2021 Pavel Raiskup - 1.0.49-8 +- rebuild for libpq ABI fix rhbz#1908268 + * Wed Jan 27 2021 Fedora Release Engineering - 1.0.49-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From ef5dfb65053980833efa57e8c63861df0de816c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:13:00 +0100 Subject: [PATCH 08/24] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- pure-ftpd.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 42fd2e5..803b3a0 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -234,6 +234,10 @@ fi %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 1.0.49-9 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Mon Feb 08 2021 Pavel Raiskup - 1.0.49-8 - rebuild for libpq ABI fix rhbz#1908268 From 5ac4cfdf6a8ccf3feedc6b55ac9a9926d64188b2 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 04:16:34 +0000 Subject: [PATCH 09/24] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 803b3a0..25e985b 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -234,6 +234,9 @@ fi %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 1.0.49-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 1.0.49-9 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. From e7c6a52ff46509364852cb2f91e6bf8000bf7b05 Mon Sep 17 00:00:00 2001 From: Sahana Prasad Date: Tue, 14 Sep 2021 19:12:20 +0200 Subject: [PATCH 10/24] Rebuilt with OpenSSL 3.0.0 --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 25e985b..1e50c8b 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 10%{?dist} +Release: 11%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -234,6 +234,9 @@ fi %changelog +* Tue Sep 14 2021 Sahana Prasad - 1.0.49-11 +- Rebuilt with OpenSSL 3.0.0 + * Fri Jul 23 2021 Fedora Release Engineering - 1.0.49-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 9f2939929d7336b928682af0181071b218b2f411 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jan 2022 09:39:46 +0000 Subject: [PATCH 11/24] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 1e50c8b..f680985 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.49 -Release: 11%{?dist} +Release: 12%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -234,6 +234,9 @@ fi %changelog +* Fri Jan 21 2022 Fedora Release Engineering - 1.0.49-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Tue Sep 14 2021 Sahana Prasad - 1.0.49-11 - Rebuilt with OpenSSL 3.0.0 From 0afeb1b790e6a3005500ca605859cd53f8606182 Mon Sep 17 00:00:00 2001 From: jonathanspw Date: Thu, 21 Jul 2022 11:19:13 -0500 Subject: [PATCH 12/24] New version 1.0.51 --- .gitignore | 1 + ...ays-set-the-tail-of-the-list-to-NULL.patch | 34 --------- ...single-buffer-to-store-every-file-na.patch | 70 ------------------- 0001-pure_strcmp-len-s2-can-be-len-s1.patch | 28 -------- pure-ftpd.spec | 14 ++-- 5 files changed, 7 insertions(+), 140 deletions(-) delete mode 100644 0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch delete mode 100644 0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch delete mode 100644 0001-pure_strcmp-len-s2-can-be-len-s1.patch diff --git a/.gitignore b/.gitignore index 5710765..f418bc6 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ pure-ftpd-1.0.29.tar.bz2 /pure-ftpd-1.0.47.tar.bz2 /pure-ftpd-1.0.48.tar.bz2 /pure-ftpd-1.0.49.tar.bz2 +/pure-ftpd-1.0.51.tar.bz2 diff --git a/0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch b/0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch deleted file mode 100644 index d5b2523..0000000 --- a/0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa Mon Sep 17 00:00:00 2001 -From: Frank Denis -Date: Tue, 18 Feb 2020 18:36:58 +0100 -Subject: [PATCH] diraliases: always set the tail of the list to NULL - -Spotted and reported by Antonio Norales from GitHub Security Labs. -Thanks! ---- - src/diraliases.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/diraliases.c b/src/diraliases.c -index 4002a36..fb70273 100644 ---- a/src/diraliases.c -+++ b/src/diraliases.c -@@ -93,7 +93,6 @@ int init_aliases(void) - (tail->dir = strdup(dir)) == NULL) { - die_mem(); - } -- tail->next = NULL; - } else { - DirAlias *curr; - -@@ -105,6 +104,7 @@ int init_aliases(void) - tail->next = curr; - tail = curr; - } -+ tail->next = NULL; - } - fclose(fp); - aliases_up++; --- -2.25.4 - diff --git a/0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch b/0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch deleted file mode 100644 index efed2f3..0000000 --- a/0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch +++ /dev/null @@ -1,70 +0,0 @@ -From aea56f4bcb9948d456f3fae4d044fd3fa2e19706 Mon Sep 17 00:00:00 2001 -From: Frank Denis -Date: Mon, 30 Dec 2019 17:40:04 +0100 -Subject: [PATCH] listdir(): reuse a single buffer to store every file name to - display - -Allocating a new buffer for each entry is useless. - -And as these buffers are allocated on the stack, on systems with a -small stack size, with many entries, the limit can easily be reached, -causing a stack exhaustion and aborting the user session. - -Reported by Antonio Morales from the GitHub Security Lab team, thanks! ---- - src/ls.c | 15 ++++++++------- - 1 file changed, 8 insertions(+), 7 deletions(-) - -diff --git a/src/ls.c b/src/ls.c -index cf804c7..f8a588f 100644 ---- a/src/ls.c -+++ b/src/ls.c -@@ -661,6 +661,8 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, - char *names; - PureFileInfo *s; - PureFileInfo *r; -+ char *alloca_subdir; -+ size_t sizeof_subdir; - int d; - - if (depth >= max_ls_depth || matches >= max_ls_files) { -@@ -690,14 +692,12 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, - } - outputfiles(f, tls_fd); - r = dir; -+ sizeof_subdir = PATH_MAX + 1U; -+ if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) { -+ goto toomany; -+ } - while (opt_R && r != s) { - if (r->name_offset != (size_t) -1 && !chdir(FI_NAME(r))) { -- char *alloca_subdir; -- const size_t sizeof_subdir = PATH_MAX + 1U; -- -- if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) { -- goto toomany; -- } - if (SNCHECK(snprintf(alloca_subdir, sizeof_subdir, "%s/%s", - name, FI_NAME(r)), sizeof_subdir)) { - goto nolist; -@@ -706,8 +706,8 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, - wrstr(f, tls_fd, alloca_subdir); - wrstr(f, tls_fd, ":\r\n\r\n"); - listdir(depth + 1U, f, tls_fd, alloca_subdir); -+ - nolist: -- ALLOCA_FREE(alloca_subdir); - if (matches >= max_ls_files) { - goto toomany; - } -@@ -720,6 +720,7 @@ static void listdir(unsigned int depth, int f, void * const tls_fd, - r++; - } - toomany: -+ ALLOCA_FREE(alloca_subdir); - free(names); - free(dir); - names = NULL; --- -2.20.1 - diff --git a/0001-pure_strcmp-len-s2-can-be-len-s1.patch b/0001-pure_strcmp-len-s2-can-be-len-s1.patch deleted file mode 100644 index 375b970..0000000 --- a/0001-pure_strcmp-len-s2-can-be-len-s1.patch +++ /dev/null @@ -1,28 +0,0 @@ -From bf6fcd4935e95128cf22af5924cdc8fe5c0579da Mon Sep 17 00:00:00 2001 -From: Frank Denis -Date: Mon, 24 Feb 2020 15:19:43 +0100 -Subject: [PATCH] pure_strcmp(): len(s2) can be > len(s1) - -Reported by Antonio Morales from GitHub Security Labs, thanks! ---- - src/utils.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/src/utils.c b/src/utils.c -index f41492d..5e88104 100644 ---- a/src/utils.c -+++ b/src/utils.c -@@ -45,5 +45,9 @@ int pure_memcmp(const void * const b1_, const void * const b2_, size_t len) - - int pure_strcmp(const char * const s1, const char * const s2) - { -- return pure_memcmp(s1, s2, strlen(s1) + 1U); -+ const size_t s1_len = strlen(s1); -+ const size_t s2_len = strlen(s2); -+ const size_t len = (s1_len < s2_len) ? s1_len : s2_len; -+ -+ return pure_memcmp(s1, s2, len + 1); - } --- -2.25.4 - diff --git a/pure-ftpd.spec b/pure-ftpd.spec index f680985..6fe714f 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd -Version: 1.0.49 -Release: 12%{?dist} +Version: 1.0.51 +Release: 1%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -16,12 +16,6 @@ Source8: pure-ftpd-with-tls-init.service Source9: pure-ftpd-with-tls.service Patch0: 0001-modify-pam.patch Patch1: 0002-fedora-specific-config-file.patch -# Upstream patch: -Patch2: 0001-listdir-reuse-a-single-buffer-to-store-every-file-na.patch -# Upstream patch: -Patch3: 0001-diraliases-always-set-the-tail-of-the-list-to-NULL.patch -# Upstream patch: -Patch4: 0001-pure_strcmp-len-s2-can-be-len-s1.patch Provides: ftpserver BuildRequires: make @@ -234,6 +228,10 @@ fi %changelog +* Thu Jul 21 2022 Jonathan Wright - 1.0.51-1 +- New version +- Resolves: rhbz#2026153 + * Fri Jan 21 2022 Fedora Release Engineering - 1.0.49-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From c0f1b9f8469391349dd73e6169c257aee55ad84d Mon Sep 17 00:00:00 2001 From: jonathanspw Date: Thu, 21 Jul 2022 11:54:40 -0500 Subject: [PATCH 13/24] remove usermode/consolehelper --- pure-ftpd.pure-ftpwho.consoleapp | 3 --- pure-ftpd.pure-ftpwho.pam | 4 ---- pure-ftpd.spec | 14 +++----------- 3 files changed, 3 insertions(+), 18 deletions(-) delete mode 100644 pure-ftpd.pure-ftpwho.consoleapp delete mode 100644 pure-ftpd.pure-ftpwho.pam diff --git a/pure-ftpd.pure-ftpwho.consoleapp b/pure-ftpd.pure-ftpwho.consoleapp deleted file mode 100644 index 8452f88..0000000 --- a/pure-ftpd.pure-ftpwho.consoleapp +++ /dev/null @@ -1,3 +0,0 @@ -USER=root -PROGRAM=/usr/sbin/pure-ftpwho -GUI=no diff --git a/pure-ftpd.pure-ftpwho.pam b/pure-ftpd.pure-ftpwho.pam deleted file mode 100644 index 268cc92..0000000 --- a/pure-ftpd.pure-ftpwho.pam +++ /dev/null @@ -1,4 +0,0 @@ -#%PAM-1.0 -auth sufficient pam_rootok.so -auth required pam_localuser.so -account required pam_permit.so diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 6fe714f..b02106c 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -8,8 +8,6 @@ URL: http://www.pureftpd.org Source0: http://download.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-%{version}.tar.bz2 Source1: pure-ftpd.service Source2: pure-ftpd.logrotate -Source4: pure-ftpd.pure-ftpwho.pam -Source5: pure-ftpd.pure-ftpwho.consoleapp Source6: pure-ftpd.README.SELinux Source7: pure-ftpd.pureftpd.te Source8: pure-ftpd-with-tls-init.service @@ -31,7 +29,7 @@ BuildRequires: gcc Requires(post): systemd Requires(preun): systemd Requires(postun): systemd -Requires: logrotate, usermode +Requires: logrotate %{!?_without_tls:Requires: sscg} @@ -147,12 +145,6 @@ install -p -m 644 pam/pure-ftpd $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/ install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d install -p -m 644 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/logrotate.d/%{name} -# pure-ftpwho and non-root users -install -d -m 755 $RPM_BUILD_ROOT%{_sysconfdir}/security/console.apps -install -p -m 644 %{SOURCE4} $RPM_BUILD_ROOT%{_sysconfdir}/pam.d/pure-ftpwho -install -p -m 644 %{SOURCE5} $RPM_BUILD_ROOT%{_sysconfdir}/security/console.apps/pure-ftpwho -ln -s consolehelper $RPM_BUILD_ROOT%{_bindir}/pure-ftpwho - # SELinux support pushd selinux echo "%{_sbindir}/pure-ftpd system_u:object_r:ftpd_exec_t:s0" > pureftpd.fc @@ -215,8 +207,6 @@ fi %config(noreplace) %{_sysconfdir}/%{name} %config(noreplace) %{_sysconfdir}/pam.d/%{name} %config(noreplace) %{_sysconfdir}/logrotate.d/%{name} -%config(noreplace) %{_sysconfdir}/pam.d/pure-ftpwho -%config(noreplace) %{_sysconfdir}/security/console.apps/pure-ftpwho %{!?_without_tls:%{_sysconfdir}/pki/%{name}} %{_mandir}/man8/* %dir /var/ftp/ @@ -231,6 +221,8 @@ fi * Thu Jul 21 2022 Jonathan Wright - 1.0.51-1 - New version - Resolves: rhbz#2026153 +- Remove usermode dependency and non-root "ftpwho" +- Resolves: rhbz#502754 * Fri Jan 21 2022 Fedora Release Engineering - 1.0.49-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From f430a125ef87f22dafe60b2d624de7922c46cb59 Mon Sep 17 00:00:00 2001 From: jonathanspw Date: Thu, 21 Jul 2022 12:32:06 -0500 Subject: [PATCH 14/24] Update sources for 1.0.51 --- sources | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sources b/sources index 0709f30..37f9178 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (pure-ftpd-1.0.49.tar.bz2) = b44896d6fe2cda9169b1db93c5260bb892af14a173f2d25e60dd6530afe85d8e9156985609e35da7e5550dc123afb42bc5012beb9fca9011054cf0ed8b2eddef +SHA512 (pure-ftpd-1.0.51.tar.bz2) = 3615ac1ec42813855f3328dde200f60025e1f2ca7d1e17ea042967fd4164079260d058f3e2586acd778334660f387a280b35850a9e2091dd913fb84ef929bdca From 7f021a55262c2951a002d81e5bc65212bd505932 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 20 Jan 2023 10:30:05 +0000 Subject: [PATCH 15/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index b02106c..d0fefc6 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.51 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -218,6 +218,9 @@ fi %changelog +* Fri Jan 20 2023 Fedora Release Engineering - 1.0.51-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Thu Jul 21 2022 Jonathan Wright - 1.0.51-1 - New version - Resolves: rhbz#2026153 From bc7a24037ec1eb9c0b7c90aa350d8b87db1c532d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jul 2023 06:31:42 +0000 Subject: [PATCH 16/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index d0fefc6..d35a4aa 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.51 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -218,6 +218,9 @@ fi %changelog +* Fri Jul 21 2023 Fedora Release Engineering - 1.0.51-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Fri Jan 20 2023 Fedora Release Engineering - 1.0.51-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From c205926cb97ee590f76f7ac6ece24f10594a4b19 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 21 Jan 2024 22:36:02 +0000 Subject: [PATCH 17/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index d35a4aa..80b5fb0 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.51 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -218,6 +218,9 @@ fi %changelog +* Sun Jan 21 2024 Fedora Release Engineering - 1.0.51-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Fri Jul 21 2023 Fedora Release Engineering - 1.0.51-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From c7a2892b46ee2212fd460e36a7b55e4d5a90932a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jan 2024 00:22:09 +0000 Subject: [PATCH 18/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 80b5fb0..1067166 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.51 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -218,6 +218,9 @@ fi %changelog +* Fri Jan 26 2024 Fedora Release Engineering - 1.0.51-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sun Jan 21 2024 Fedora Release Engineering - 1.0.51-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From ce04bd4e302cbd2f3bdf0a006357dc41a11cc5a7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 08:44:33 +0000 Subject: [PATCH 19/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 1067166..339dc80 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.51 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Lightweight, fast and secure FTP server License: BSD URL: http://www.pureftpd.org @@ -218,6 +218,9 @@ fi %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 1.0.51-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Fri Jan 26 2024 Fedora Release Engineering - 1.0.51-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 6bf60785e9bf5c882ce5c5e1ea8a6298c1cd9bc1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Wed, 4 Sep 2024 19:20:19 +0200 Subject: [PATCH 20/24] convert license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 --- pure-ftpd.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 339dc80..f2d62ee 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,8 +1,9 @@ Name: pure-ftpd Version: 1.0.51 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Lightweight, fast and secure FTP server -License: BSD +# Automatically converted from old format: BSD - review is highly recommended. +License: LicenseRef-Callaway-BSD URL: http://www.pureftpd.org Source0: http://download.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-%{version}.tar.bz2 @@ -218,6 +219,9 @@ fi %changelog +* Wed Sep 04 2024 Miroslav Suchý - 1.0.51-7 +- convert license to SPDX + * Fri Jul 19 2024 Fedora Release Engineering - 1.0.51-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From e8cfc944a0223f648925708e1f3dd0939b680ec8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 11:05:16 +0000 Subject: [PATCH 21/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index f2d62ee..014c803 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.51 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Lightweight, fast and secure FTP server # Automatically converted from old format: BSD - review is highly recommended. License: LicenseRef-Callaway-BSD @@ -219,6 +219,9 @@ fi %changelog +* Sat Jan 18 2025 Fedora Release Engineering - 1.0.51-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Wed Sep 04 2024 Miroslav Suchý - 1.0.51-7 - convert license to SPDX From 3c73e2bc6fcae9b66141db52811a93b1fbb429df Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Esser?= Date: Sat, 1 Feb 2025 19:56:51 +0100 Subject: [PATCH 22/24] Add explicit BR: libxcrypt-devel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Björn Esser --- pure-ftpd.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 014c803..7a1f6df 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.51 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Lightweight, fast and secure FTP server # Automatically converted from old format: BSD - review is highly recommended. License: LicenseRef-Callaway-BSD @@ -19,6 +19,7 @@ Patch1: 0002-fedora-specific-config-file.patch Provides: ftpserver BuildRequires: make BuildRequires: pam-devel, libcap-devel +BuildRequires: libxcrypt-devel %{!?_without_ldap:BuildRequires: openldap-devel} %{!?_without_mysql:BuildRequires: mariadb-connector-c-devel} %{!?_without_pgsql:BuildRequires: libpq-devel} @@ -219,6 +220,9 @@ fi %changelog +* Sat Feb 01 2025 Björn Esser - 1.0.51-9 +- Add explicit BR: libxcrypt-devel + * Sat Jan 18 2025 Fedora Release Engineering - 1.0.51-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 5104a55ce6835e72e5c4dcc11c3caf0504675bcb Mon Sep 17 00:00:00 2001 From: Jonathan Wright Date: Mon, 19 May 2025 19:36:21 -0500 Subject: [PATCH 23/24] update to 1.0.52 --- .gitignore | 1 + pure-ftpd.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index f418bc6..1b740aa 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ pure-ftpd-1.0.29.tar.bz2 /pure-ftpd-1.0.48.tar.bz2 /pure-ftpd-1.0.49.tar.bz2 /pure-ftpd-1.0.51.tar.bz2 +/pure-ftpd-1.0.52.tar.bz2 diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 7a1f6df..21e8abb 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd -Version: 1.0.51 -Release: 9%{?dist} +Version: 1.0.52 +Release: 1%{?dist} Summary: Lightweight, fast and secure FTP server # Automatically converted from old format: BSD - review is highly recommended. License: LicenseRef-Callaway-BSD @@ -220,6 +220,10 @@ fi %changelog +* Tue May 20 2025 Jonathan Wright - 1.0.52-1 +- update to 1.0.52 rhbz#2313435 +- Fixes CVE-2024-48208 rhbz#2343476 + * Sat Feb 01 2025 Björn Esser - 1.0.51-9 - Add explicit BR: libxcrypt-devel diff --git a/sources b/sources index 37f9178..920b4eb 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (pure-ftpd-1.0.51.tar.bz2) = 3615ac1ec42813855f3328dde200f60025e1f2ca7d1e17ea042967fd4164079260d058f3e2586acd778334660f387a280b35850a9e2091dd913fb84ef929bdca +SHA512 (pure-ftpd-1.0.52.tar.bz2) = c7b6f76c1429d2cbf9d740c3408464564e023716ebf8361231ba5021f81804575049910c9874970c83c98f927cd496899e5c30625e4dee6538497f9179632c23 From 6712c15acc5950c705d6b7bde3376c478222e7bf Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 06:17:07 +0000 Subject: [PATCH 24/24] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- pure-ftpd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pure-ftpd.spec b/pure-ftpd.spec index 21e8abb..9159c7b 100644 --- a/pure-ftpd.spec +++ b/pure-ftpd.spec @@ -1,6 +1,6 @@ Name: pure-ftpd Version: 1.0.52 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Lightweight, fast and secure FTP server # Automatically converted from old format: BSD - review is highly recommended. License: LicenseRef-Callaway-BSD @@ -220,6 +220,9 @@ fi %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 1.0.52-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue May 20 2025 Jonathan Wright - 1.0.52-1 - update to 1.0.52 rhbz#2313435 - Fixes CVE-2024-48208 rhbz#2343476