New version 3.4.9

Fix for CVE-2021-22207

sources

@@ -1,2 +1,2 @@
-SHA512 (wireshark-3.2.5.tar.xz) = 3dc785a6e857f66a9ae3c172bf6a09c2199fe914646ade7b81f0ee18bd3addae57facad898f57675ea4d7177a4315d6a6cdac46e2da063727a83f9bee6994277
-SHA512 (SIGNATURES-3.2.5.txt) = 2289e522601c4ea3359368ebe3e4b5fa2b8cafad08798f2cd8378db1d69f816c2175fcfa1bce675c197caac6d3218e30ebb8c9f2f7f459326ac102985a1a9364
+SHA512 (wireshark-3.4.9.tar.xz) = 479abcf7b44504a269b73201da5aabac0d7770cd779a325df3214b6df5dc37e175f2889165a933c2902001a06c8141768f35cd8ca35cc55fc6cf30a482ea27eb
+SHA512 (SIGNATURES-3.4.9.txt) = 989192fa4d2c3377ae1b349cda2b7fdff6b9decfc28a59ee73b175a9c1c7eeb1bd5261360f98c1751991f35e4bf698e75b80b47a043ca4c115b1b10e41729d66

wireshark-0006-Move-tmp-to-var-tmp.patch

@@ -111,43 +111,50 @@ index fde66c8..b9531d2 100644
      tempfile_->open();
  
 diff --git a/wsutil/tempfile.c b/wsutil/tempfile.c
-index 8e1f8dc..dcf2f78 100644
+index 5082452..f751a7c 100644
 --- a/wsutil/tempfile.c
 +++ b/wsutil/tempfile.c
-@@ -36,6 +36,7 @@
- 
+@@ -12,10 +12,12 @@
+
+ #include <glib.h>
  #include "tempfile.h"
- #include <wsutil/file_util.h>
++#include <wsutil/file_util.h>
 +#include <wsutil/wstmpdir.h> /* for get_tmp_dir() */
- 
- #ifndef __set_errno
- #define __set_errno(x) errno=(x)
-@@ -83,13 +83,14 @@ mkstemps(char *path_template, int suffixlen)
-  */
- char *get_tempfile_path(const char *filename)
- {
--  return g_strdup_printf("%s" G_DIR_SEPARATOR_S "%s", g_get_tmp_dir(), filename);
-+  return g_strdup_printf("%s" G_DIR_SEPARATOR_S "%s", get_tmp_dir(), filename);
- }
- 
- #define MAX_TEMPFILES   3
- 
- /**
-- * Create a tempfile with the given prefix (e.g. "wireshark").
-+ * Create a tempfile with the given prefix (e.g. "wireshark"). The path
-+ * is created using get_tmp_dir and mkdtemp
+
+  /**
+  * Create a tempfile with the given prefix (e.g. "wireshark"). The path
+- * is created using g_file_open_tmp.
++ * is created using get_tmp_dir.
   *
-  * @param namebuf If not NULL, receives the full path of the temp file.
-  *                Should NOT be freed.
-@@ -199,7 +200,7 @@ create_tempfile(char **namebuf, const char *pfx, const char *sfx)
-     tf[idx].path = (char *)g_malloc(tf[idx].len);
-   }
- 
--  tmp_dir = g_get_tmp_dir();
+  * @param namebuf [in,out] If not NULL, receives the full path of the temp file.
+  *                Must be freed.
+@@ -30,6 +31,9 @@ create_tempfile(gchar **namebuf, const char *pfx, const char *sfx, GError **err)
+ {
+   int fd;
+   gchar *safe_pfx = NULL;
++  gchar *tmp_file;
++  const char *tmp_dir;
++  int old_mask;
+
+   if (pfx) {
+     /* The characters in "delimiters" come from:
+@@ -49,7 +53,15 @@ create_tempfile(gchar **namebuf, const char *pfx, const char *sfx, GError **err)
+   gchar* filetmpl = g_strdup_printf("%sXXXXXX%s", safe_pfx ? safe_pfx : "", sfx ? sfx : "");
+   g_free(safe_pfx);
+
+-  fd = g_file_open_tmp(filetmpl, namebuf, err);
 +  tmp_dir = get_tmp_dir();
- 
- #ifdef _WIN32
-   _tzset();
++  tmp_file = g_strconcat(tmp_dir, "/", filetmpl, NULL);
++
++  if (namebuf)
++    *namebuf = tmp_file;
++
++  old_mask = ws_umask(0077);
++  fd = mkstemps(tmp_file, sfx ? (int) strlen(sfx) : 0);
++  ws_umask(old_mask);
+
+   g_free(filetmpl);
+   return fd;
 diff --git a/wsutil/tempfile.h b/wsutil/tempfile.h
 index 1dca2df..bb3160c 100644
 --- a/wsutil/tempfile.h
@@ -156,17 +163,17 @@ index 1dca2df..bb3160c 100644
  
  /**
   * Create a tempfile with the given prefix (e.g. "wireshark"). The path
-- * is created using g_get_tmp_dir and mkstemp.
+- * is created using g_file_open_tmp.
 + * is created using get_tmp_dir and mkstemp.
   *
   * @param namebuf [in,out] If not NULL, receives the full path of the temp file.
-  *                Must NOT be freed.
+  *                Must be freed.
 diff --git a/wsutil/wstmpdir.c b/wsutil/wstmpdir.c
 new file mode 100644
 index 0000000..d8b733b
 --- /dev/null
 +++ b/wsutil/wstmpdir.c
-@@ -0,0 +1,70 @@
+@@ -0,0 +1,71 @@
 +/* wstmpdir.c
 + *
 + * Copyright (C) 2013 Red Hat, Inc. All right reserved.
@@ -224,6 +231,7 @@ index 0000000..d8b733b
 +            k = strlen(tmp);
 +            if (k > 1 && G_IS_DIR_SEPARATOR(tmp[k - 1]))
 +                tmp[k - 1] = '\0';
++            fprintf(stderr, "Using P_tmpdir: %s\n", P_tmpdir);
 +        }
 +#endif /* P_tmpdir */
 +

wireshark.spec

@@ -1,12 +1,14 @@
 %undefine __cmake_in_source_build
 %global with_lua 1
 %global with_maxminddb 1
-%global plugins_version 3.2
+%global plugins_version 3.4
+# added temporarily due to errors in libqt5core
+%define _lto_cflags %{nil}
 
 Summary:	Network traffic analyzer
 Name:		wireshark
-Version:	3.2.5
-Release:	3%{?dist}
+Version:	3.4.9
+Release:	1%{?dist}
 Epoch:		1
 License:	GPL+
 Url:		http://www.wireshark.org/
@@ -14,6 +16,7 @@ Url:		http://www.wireshark.org/
 Source0:	https://wireshark.org/download/src/%{name}-%{version}.tar.xz
 Source1:        https://www.wireshark.org/download/src/all-versions/SIGNATURES-%{version}.txt
 Source2:	90-wireshark-usbmon.rules
+Source3:	wireshark.sysusers
 
 # Fedora-specific
 Patch2:		wireshark-0002-Customize-permission-denied-error.patch
@@ -58,7 +61,8 @@ BuildRequires:	flex
 BuildRequires:	pcre-devel
 BuildRequires:	perl(Pod::Html)
 BuildRequires:	perl(Pod::Man)
-Buildrequires:  libssh-devel
+BuildRequires:	perl(open)
+Buildrequires:	libssh-devel
 BuildRequires:	qt5-linguist
 BuildRequires:	qt5-qtbase-devel
 BuildRequires:	qt5-qtmultimedia-devel
@@ -70,7 +74,7 @@ BuildRequires:	libmaxminddb-devel
 %if %{with_lua} && 0%{?fedora}
 BuildRequires:	compat-lua-devel
 %endif
-Buildrequires: git
+Buildrequires: git-core
 %if 0%{?fedora}
 Buildrequires: python3-devel
 %endif
@@ -78,6 +82,7 @@ Buildrequires: cmake
 #needed for sdjournal external capture interface
 BuildRequires: systemd-devel
 BuildRequires: libnghttp2-devel
+BuildRequires: systemd-rpm-macros
 
 Obsoletes: wireshark-qt, wireshark-gtk
 
@@ -169,6 +174,7 @@ install -m 644 wiretap/*.h		"${IDIR}/wiretap"
 install -m 644 wsutil/*.h		"${IDIR}/wsutil"
 install -m 644 ws_diag_control.h	"${IDIR}/"
 install -m 644 %{SOURCE2}		%{buildroot}%{_udevrulesdir}
+install -Dpm 644 %{SOURCE3}		%{buildroot}%{_sysusersdir}/%{name}.conf
 
 touch %{buildroot}%{_bindir}/%{name}
 
@@ -176,12 +182,15 @@ touch %{buildroot}%{_bindir}/%{name}
 find %{buildroot} -type f -name "*.la" -delete
 
 %pre cli
-getent group wireshark >/dev/null || groupadd -r wireshark
-getent group usbmon >/dev/null || groupadd -r usbmon
+%sysusers_create_compat %{SOURCE3}
 
 %post cli
 %{?ldconfig}
-/usr/bin/udevadm trigger --subsystem-match=usbmon
+# skip triggering if udevd isn't even accessible, e.g. containers or
+# rpm-ostree-based systems
+if [ -S /run/udev/control ]; then
+	/usr/bin/udevadm trigger --subsystem-match=usbmon
+fi
 
 %ldconfig_postun cli
 
@@ -193,6 +202,7 @@ getent group usbmon >/dev/null || groupadd -r usbmon
 %{_datadir}/mime/packages/wireshark.xml
 %{_bindir}/wireshark
 %{_mandir}/man1/wireshark.*
+%{_sysusersdir}/%{name}.conf
 
 %files cli
 %license COPYING
@@ -266,13 +276,60 @@ getent group usbmon >/dev/null || groupadd -r usbmon
 %{_libdir}/pkgconfig/%{name}.pc
 
 %changelog
-* Thu Jul 30 2020 Michal Ruprich <michalruprich@gmail.com> - 1:3.2.5-3
+* Wed Oct 13 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.9-1
+- New version
+
+* Wed Sep 22 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.8-2
+- Use system sysusers config to create groups
+
+* Tue Aug 31 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.8-1
+- New version 3.4.8
+
+* Thu Jul 15 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.7-1
+- New version 3.4.7
+
+* Thu Jun 10 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.6-1
+- New version 3.4.6
+- Fix for CVE-2021-22207
+
+* Thu May 27 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.5-1
+- New version 3.4.5
+- Fix for CVE-2021-22207
+
+* Tue Mar 16 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.4-1
+- New version 3.4.4
+- Fix for CVE-2021-22191
+
+* Tue Feb 16 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.3-1
+- New version 3.4.3
+- Fix for CVE-2021-22173, CVE-2021-22174
+
+* Fri Jan 29 2021 Michal Ruprich <mruprich@redhat.com> - 1:3.4.2-1
+- New version 3.4.2
+- Fix for CVE-2020-26418, CVE-2020-26419, CVE-2020-26420, CVE-2020-26421
+
+* Thu Dec 03 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.4.0-1
+- New version 3.4.0
+- Fix for CVE-2020-26575, CVE-2020-28030
+
+* Fri Oct 09 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.7-1
+- New version 3.2.7
+- Fix for CVE-2020-25862, CVE-2020-25863, CVE-2020-25866
+
+* Thu Sep 10 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.6-2
+- Temporarily disabling LTO due to errors in libqt5core
+
+* Wed Aug 19 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.6-1
+- New version 3.2.6
+- Fix for CVE-2020-17498
+
+* Thu Jul 30 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.5-3
 - Adding ownership for dirs created by wireshark (rhbz#1860650)
 
 * Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1:3.2.5-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 
-* Thu Jul 02 2020 Michal Ruprich <michalruprich@gmail.com> - 1:3.2.5-1
+* Thu Jul 02 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.5-1
 - New version 3.2.5
 
 * Fri May 22 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.4-1
@@ -282,7 +339,7 @@ getent group usbmon >/dev/null || groupadd -r usbmon
 * Mon Apr 13 2020 Gwyn Ciesla <gwync@protonmail.com> - 1:3.2.3-1
 - 3.2.3
 
-* Fri Apr 03 2020 Michal Ruprich <michalruprich@gmail.com> - 1:3.2.2-1
+* Fri Apr 03 2020 Michal Ruprich <mruprich@redhat.com> - 1:3.2.2-1
 - New version 3.2.2
 
 * Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1:3.2.0-2

wireshark.sysusers

@@ -0,0 +1,2 @@
+g wireshark - -
+g usbmon    - -