wireshark crash in managed interfaces

Fix for rhbz #2148308
Fix for CVE-2022-3725

rpminspect.yaml

@@ -0,0 +1,8 @@
+---
+ownership:
+  #dumpcap is the only binary that has group wireshark
+  ignore:
+    - /usr/bin/dumpcap
+
+inspections:
+  xml: off

sources

@@ -1,2 +1,2 @@
-SHA512 (wireshark-3.6.7.tar.xz) = caf087ee467bf934f28d096869ea3d9d7c5a3c83e51c4df447700096943a92abf5cf29f4956b9a549e0708bcb3515b55c4660a7ced2cb9dbc582b87550026fac
-SHA512 (SIGNATURES-3.6.7.txt) = f7f826d4665cbf89088dd12a1e732a9a451b2566e2b4fad0924e443c811bb158a9276cf0221c79414f9020c6e5f8f0ec25513b56cbaf82d304c2a7ac3f06ef5d
+SHA512 (wireshark-4.0.8.tar.xz) = f6de0f86bb1eac82f7ed2d98d7f4fe3189107b1f0da441abd9077593f8e624989c33aaf8b4ef4b3c460fe787c64c4b8fdb3168de9f5661802fed6b06d71c5c65
+SHA512 (SIGNATURES-4.0.8.txt) = 7da9141c6b0768121245df9e19eebb4976e2f5f16811730cd03f4088efae5fe21ec43563ff9cc68c5089722c1e4d2d90817dbd5b0c55e36a4851c0b3184d5249

wireshark-0002-Customize-permission-denied-error.patch

@@ -8,10 +8,10 @@ because of permissions.
 Signed-off-by: Jan Safranek <jsafrane@redhat.com>
 
 diff --git a/capture/capture_sync.c b/capture/capture_sync.c
-index 2f9d2cc..b18e47f 100644
+index 47a30a70c4..84d19568b0 100644
 --- a/capture/capture_sync.c
 +++ b/capture/capture_sync.c
-@@ -375,6 +375,7 @@ sync_pipe_start(capture_options *capture_opts, capture_session *cap_session, voi
+@@ -336,6 +336,7 @@ sync_pipe_start(capture_options *capture_opts, GPtrArray *capture_comments,
      gchar *signal_pipe_name;
  #else
      char errmsg[1024+1];
@@ -19,21 +19,20 @@ index 2f9d2cc..b18e47f 100644
      int sync_pipe[2];                       /* pipe used to send messages from child to parent */
      enum PIPES { PIPE_READ, PIPE_WRITE };   /* Constants 0 and 1 for PIPE_READ and PIPE_WRITE */
  #endif
-@@ -728,8 +729,11 @@ sync_pipe_start(capture_options *capture_opts, capture_session *cap_session, voi
+@@ -741,8 +742,10 @@ sync_pipe_start(capture_options *capture_opts, GPtrArray *capture_comments,
          dup2(sync_pipe[PIPE_WRITE], 2);
          ws_close(sync_pipe[PIPE_READ]);
          execv(argv[0], argv);
--        g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
+-        snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
 -                   argv[0], g_strerror(errno));
 +        if (errno == EPERM || errno == EACCES)
-+          securitymsg = "\nAre you a member of the 'wireshark' group? Try running\n'usermod -a -G wireshark _your_username_' as root.";
-+        g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s%s",
-+                argv[0], g_strerror(errno), securitymsg);
-+
++            securitymsg = "\nAre you a member of the 'wireshark' group? Try running\n'usermod -a -G wireshark _your_username_' as root.";
++        snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s%s",
++                   argv[0], g_strerror(errno), securitymsg);
          sync_pipe_errmsg_to_parent(2, errmsg, "");
  
          /* Exit with "_exit()", so that we don't close the connection
-@@ -826,6 +830,7 @@ sync_pipe_open_command(char** argv, int *data_read_fd,
+@@ -846,6 +849,7 @@ sync_pipe_open_command(char* const argv[], int *data_read_fd,
      int i;
  #else
      char errmsg[1024+1];
@@ -41,16 +40,15 @@ index 2f9d2cc..b18e47f 100644
      int sync_pipe[2];                       /* pipe used to send messages from child to parent */
      int data_pipe[2];                       /* pipe used to send data from child to parent */
  #endif
-@@ -1003,8 +1008,11 @@ sync_pipe_open_command(char** argv, int *data_read_fd,
+@@ -994,8 +998,10 @@ sync_pipe_open_command(char* const argv[], int *data_read_fd,
          ws_close(sync_pipe[PIPE_READ]);
          ws_close(sync_pipe[PIPE_WRITE]);
          execv(argv[0], argv);
--        g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
+-        snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
 -                   argv[0], g_strerror(errno));
-+        execv(argv[0], (gpointer)argv);
-+	if (errno == EPERM || errno == EACCES)
-+		securitymsg = "\nAre you a member of the 'wireshark' group? Try running\n'usermod -a -G wireshark _your_username_' as root.";
-+        g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s%s",
++        if (errno == EPERM || errno == EACCES)
++            securitymsg = "\nAre you a member of the 'wireshark' group? Try running\n'usermod -a -G wireshark _your_username_' as root.";
++        snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s%s",
 +                   argv[0], g_strerror(errno), securitymsg);
          sync_pipe_errmsg_to_parent(2, errmsg, "");
  

wireshark-0003-fix-string-overrun-in-plugins-profinet.patch

@@ -4,10 +4,10 @@ Subject: [PATCH] fix string overrun in plugins/profinet
 
 
 diff --git a/plugins/epan/profinet/packet-dcom-cba.c b/plugins/epan/profinet/packet-dcom-cba.c
-index 0f1658a..f7fd322 100644
+index 52c5017e1f..fb980269db 100644
 --- a/plugins/epan/profinet/packet-dcom-cba.c
 +++ b/plugins/epan/profinet/packet-dcom-cba.c
-@@ -555,7 +555,7 @@ dissect_ICBAPhysicalDevice_get_LogicalDevice_rqst(tvbuff_t *tvb, int offset,
+@@ -543,7 +543,7 @@ dissect_ICBAPhysicalDevice_get_LogicalDevice_rqst(tvbuff_t *tvb, int offset,
      packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
  {
      guint32      u32Pointer;

wireshark-0004-Restore-Fedora-specific-groups.patch

@@ -3,10 +3,10 @@ Date: Fri, 13 Sep 2013 14:36:55 +0400
 Subject: [PATCH] Restore Fedora-specific groups
 
 Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
-diff --git a/org.wireshark.Wireshark.desktop b/org.wireshark.Wireshark.desktop
-index 334db48..669c6f1 100644
---- a/org.wireshark.Wireshark.desktop
-+++ b/org.wireshark.Wireshark.desktop
+diff --git a/resources/freedesktop/org.wireshark.Wireshark.desktop b/resources/freedesktop/org.wireshark.Wireshark.desktop
+index a880a50a33..a25d67d99b 100644
+--- a/resources/freedesktop/org.wireshark.Wireshark.desktop
++++ b/resources/freedesktop/org.wireshark.Wireshark.desktop
 @@ -108,4 +108,4 @@ Terminal=false
  MimeType=application/vnd.tcpdump.pcap;application/x-pcapng;application/x-snoop;application/x-iptrace;application/x-lanalyzer;application/x-nettl;application/x-radcom;application/x-etherpeek;application/x-visualnetworks;application/x-netinstobserver;application/x-5view;application/x-tektronix-rf5;application/x-micropross-mplog;application/x-apple-packetlogger;application/x-endace-erf;application/ipfix;application/x-ixia-vwr;
  # Category entry according to:

wireshark-0005-Fix-paths-in-a-wireshark.desktop-file.patch

@@ -3,10 +3,10 @@ Date: Wed, 29 Jan 2014 16:04:12 +0400
 Subject: [PATCH] Fix paths in a org.wireshark.Wireshark.desktop file
 
 
-diff --git a/org.wireshark.Wireshark.desktop b/org.wireshark.Wireshark.desktop
-index 669c6f1..f7df1f3 100644
---- a/org.wireshark.Wireshark.desktop
-+++ b/org.wireshark.Wireshark.desktop
+diff --git a/resources/freedesktop/org.wireshark.Wireshark.desktop b/resources/freedesktop/org.wireshark.Wireshark.desktop
+index a880a50a33..54b3595d55 100644
+--- a/resources/freedesktop/org.wireshark.Wireshark.desktop
++++ b/resources/freedesktop/org.wireshark.Wireshark.desktop
 @@ -102,8 +102,8 @@ Comment[tr]=Ağ trafiği çözümleyicisi
  Comment[vi]=Trình phân tích giao thông mạng
  Comment[uk]=Аналізатор мережевого трафіку

wireshark-0006-Move-tmp-to-var-tmp.patch

@@ -5,45 +5,45 @@ Subject: [PATCH] Move /tmp to /var/tmp
 
 Fedora is using tmpfs which is limited by the size of RAM, thus we need
 to use different directory on different filesystem.
+
 ---
  ui/qt/about_dialog.cpp         |  3 +-
- ui/qt/iax2_analysis_dialog.cpp |  5 +--
- ui/qt/rtp_analysis_dialog.cpp  |  5 +--
- ui/qt/rtp_audio_stream.cpp     |  3 +-
- wsutil/tempfile.c              |  9 +++---
- wsutil/tempfile.h              |  4 +--
- wsutil/wstmpdir.c              | 70 ++++++++++++++++++++++++++++++++++++++++++
- wsutil/wstmpdir.h              | 39 +++++++++++++++++++++++
- 8 files changed, 132 insertions(+), 11 deletions(-)
+ ui/qt/iax2_analysis_dialog.cpp |  5 ++-
+ ui/qt/utils/rtp_audio_file.cpp |  3 +-
+ wsutil/tempfile.c              | 18 +++++++-
+ wsutil/tempfile.h              |  2 +-
+ wsutil/wstmpdir.c              | 71 ++++++++++++++++++++++++++++++++++
+ wsutil/wstmpdir.h              | 39 +++++++++++++++++++
+ 7 files changed, 134 insertions(+), 7 deletions(-)
  create mode 100644 wsutil/wstmpdir.c
  create mode 100644 wsutil/wstmpdir.h
 
 diff --git a/ui/qt/about_dialog.cpp b/ui/qt/about_dialog.cpp
-index 31dc581..2f74285 100644
+index 752b669ac4..42c2be0fca 100644
 --- a/ui/qt/about_dialog.cpp
 +++ b/ui/qt/about_dialog.cpp
-@@ -26,6 +26,7 @@
+@@ -14,6 +14,7 @@
  
- #include "wireshark_application.h"
+ #include "main_application.h"
  #include <wsutil/filesystem.h>
 +#include <wsutil/wstmpdir.h> /* for get_tmp_dir() */
  
  #include <QDesktopServices>
  #include <QUrl>
-@@ -206,7 +206,7 @@ FolderListModel::FolderListModel(QObject * parent):
+@@ -185,7 +186,7 @@ FolderListModel::FolderListModel(QObject * parent):
      appendRow(QStringList() << tr("\"File\" dialogs") << get_last_open_dir() << tr("capture files"));
  
      /* temp */
--    appendRow(QStringList() << tr("Temp") << g_get_tmp_dir() << tr("untitled capture files"));
-+    appendRow(QStringList() << tr("Temp") << get_tmp_dir() << tr("untitled capture files"));
+-    appendRow(QStringList() << tr("Temp") << (global_capture_opts.temp_dir && global_capture_opts.temp_dir[0] ? global_capture_opts.temp_dir : g_get_tmp_dir()) << tr("untitled capture files"));
++    appendRow(QStringList() << tr("Temp") << (global_capture_opts.temp_dir && global_capture_opts.temp_dir[0] ? global_capture_opts.temp_dir : get_tmp_dir()) << tr("untitled capture files"));
  
      /* pers conf */
      appendRow(QStringList() << tr("Personal configuration")
 diff --git a/ui/qt/iax2_analysis_dialog.cpp b/ui/qt/iax2_analysis_dialog.cpp
-index ee4e5fd..fe17a95 100644
+index 07b9b42e01..fb09de989b 100644
 --- a/ui/qt/iax2_analysis_dialog.cpp
 +++ b/ui/qt/iax2_analysis_dialog.cpp
-@@ -37,6 +37,7 @@
+@@ -25,6 +25,7 @@
  #include "ui/rtp_stream.h"
  #endif
  #include <wsutil/utf8_entities.h>
@@ -51,7 +51,7 @@ index ee4e5fd..fe17a95 100644
  
  #include <wsutil/g711.h>
  #include <wsutil/pint.h>
-@@ -271,10 +272,10 @@ Iax2AnalysisDialog::Iax2AnalysisDialog(QWidget &parent, CaptureFile &cf) :
+@@ -255,10 +256,10 @@ Iax2AnalysisDialog::Iax2AnalysisDialog(QWidget &parent, CaptureFile &cf) :
  
      // We keep our temp files open for the lifetime of the dialog. The GTK+
      // UI opens and closes at various points.
@@ -65,7 +65,7 @@ index ee4e5fd..fe17a95 100644
      rev_tempfile_->open();
  
 diff --git a/ui/qt/utils/rtp_audio_file.cpp b/ui/qt/utils/rtp_audio_file.cpp
-index 591a63b..203f5c5 100644
+index 591a63bbf3..203f5c5286 100644
 --- a/ui/qt/utils/rtp_audio_file.cpp
 +++ b/ui/qt/utils/rtp_audio_file.cpp
 @@ -31,6 +31,7 @@
@@ -86,66 +86,67 @@ index 591a63b..203f5c5 100644
      } else {
          sample_file_ = new QBuffer(this);
 diff --git a/wsutil/tempfile.c b/wsutil/tempfile.c
-index 5082452..f751a7c 100644
+index f93f96d538..73964a1def 100644
 --- a/wsutil/tempfile.c
 +++ b/wsutil/tempfile.c
-@@ -12,10 +12,12 @@
-
- #include <glib.h>
+@@ -14,10 +14,12 @@
+ 
  #include "tempfile.h"
+ #include "file_util.h"
 +#include <wsutil/file_util.h>
 +#include <wsutil/wstmpdir.h> /* for get_tmp_dir() */
-
+ 
   /**
   * Create a tempfile with the given prefix (e.g. "wireshark"). The path
 - * is created using g_file_open_tmp.
 + * is created using get_tmp_dir.
   *
+  * @param tempdir [in] If not NULL, the directory in which to create the file.
   * @param namebuf [in,out] If not NULL, receives the full path of the temp file.
-  *                Must be freed.
-@@ -30,6 +31,9 @@ create_tempfile(gchar **namebuf, const char *pfx, const char *sfx, GError **err)
+@@ -33,6 +33,9 @@ create_tempfile(const char *tempdir, gchar **namebuf, const char *pfx, const cha
  {
    int fd;
    gchar *safe_pfx = NULL;
 +  gchar *tmp_file;
 +  const char *tmp_dir;
 +  int old_mask;
-
+ 
    if (pfx) {
      /* The characters in "delimiters" come from:
-@@ -49,7 +53,15 @@ create_tempfile(gchar **namebuf, const char *pfx, const char *sfx, GError **err)
-   gchar* filetmpl = g_strdup_printf("%sXXXXXX%s", safe_pfx ? safe_pfx : "", sfx ? sfx : "");
-   g_free(safe_pfx);
-
--  fd = g_file_open_tmp(filetmpl, namebuf, err);
-+  tmp_dir = get_tmp_dir();
-+  tmp_file = g_strconcat(tmp_dir, "/", filetmpl, NULL);
+@@ -54,7 +57,16 @@ create_tempfile(const char *tempdir, gchar **namebuf, const char *pfx, const cha
+     gchar* filetmpl = ws_strdup_printf("%sXXXXXX%s", safe_pfx ? safe_pfx : "", sfx ? sfx : "");
+     g_free(safe_pfx);
+ 
+-    fd = g_file_open_tmp(filetmpl, namebuf, err);
++    tmp_dir = get_tmp_dir();
++    tmp_file = g_strconcat(tmp_dir, "/", filetmpl, NULL);
 +
-+  if (namebuf)
-+    *namebuf = tmp_file;
++    if (namebuf)
++      *namebuf = tmp_file;
 +
-+  old_mask = ws_umask(0077);
-+  fd = mkstemps(tmp_file, sfx ? (int) strlen(sfx) : 0);
-+  ws_umask(old_mask);
-
-   g_free(filetmpl);
-   return fd;
++    old_mask = ws_umask(0077);
++    fd = mkstemps(tmp_file, sfx ? (int) strlen(sfx) : 0);
++    ws_umask(old_mask);
++
+     g_free(filetmpl);
+   }
+   else {
 diff --git a/wsutil/tempfile.h b/wsutil/tempfile.h
-index 1dca2df..bb3160c 100644
+index 70031b5419..72011e265a 100644
 --- a/wsutil/tempfile.h
 +++ b/wsutil/tempfile.h
-@@ -45,7 +45,7 @@ WS_DLL_PUBLIC char *get_tempfile_path(const char *filename);
+@@ -23,7 +23,7 @@ extern "C" {
  
  /**
   * Create a tempfile with the given prefix (e.g. "wireshark"). The path
 - * is created using g_file_open_tmp.
 + * is created using get_tmp_dir and mkstemp.
   *
+  * @param tempdir [in] If not NULL, the directory in which to create the file.
   * @param namebuf [in,out] If not NULL, receives the full path of the temp file.
-  *                Must be freed.
 diff --git a/wsutil/wstmpdir.c b/wsutil/wstmpdir.c
 new file mode 100644
-index 0000000..d8b733b
+index 0000000000..9128d354ce
 --- /dev/null
 +++ b/wsutil/wstmpdir.c
 @@ -0,0 +1,71 @@
@@ -222,7 +223,7 @@ index 0000000..d8b733b
 +}
 diff --git a/wsutil/wstmpdir.h b/wsutil/wstmpdir.h
 new file mode 100644
-index 0000000..07ac583
+index 0000000000..07ac5837ac
 --- /dev/null
 +++ b/wsutil/wstmpdir.h
 @@ -0,0 +1,39 @@
@@ -266,4 +267,5 @@ index 0000000..07ac583
 +
 +#endif
 -- 
-2.13.0
+2.37.3
+

wireshark-0007-cmakelists.patch

@@ -1,20 +1,20 @@
 diff --git a/wsutil/CMakeLists.txt b/wsutil/CMakeLists.txt
-index 0367cd1..6382a2c 100644
+index a55086c..0149801 100644
 --- a/wsutil/CMakeLists.txt
 +++ b/wsutil/CMakeLists.txt
-@@ -69,6 +69,7 @@ set(WSUTIL_PUBLIC_HEADERS
- 	ws_mempbrk_int.h
- 	ws_pipe.h
+@@ -80,6 +80,7 @@ set(WSUTIL_PUBLIC_HEADERS
  	ws_roundup.h
+ 	ws_return.h
+ 	wsgcrypt.h
 +	wstmpdir.h
  	wsjson.h
  	wslog.h
  	xtea.h
-@@ -118,6 +118,7 @@ set(WSUTIL_COMMON_FILES
- 	ws_getopt.c
+@@ -135,6 +136,7 @@ set(WSUTIL_COMMON_FILES
  	ws_mempbrk.c
  	ws_pipe.c
-+	wstmpdir.c
  	wsgcrypt.c
++	wstmpdir.c
  	wsjson.c
  	wslog.c
+ 	xtea.c

wireshark-0008-glib2-g_strdup-build.patch

@@ -0,0 +1,13 @@
+diff --git a/ui/qt/wireshark_main_window_slots.cpp b/ui/qt/wireshark_main_window_slots.cpp
+index 0594ff6..3068797 100644
+--- a/ui/qt/wireshark_main_window_slots.cpp
++++ b/ui/qt/wireshark_main_window_slots.cpp
+@@ -2513,7 +2513,7 @@ void WiresharkMainWindow::showHideMainWidgets(QAction *action)
+             if (widget == toolbar) {
+                 GList *entry = g_list_find_custom(recent.interface_toolbars, action->text().toUtf8(), (GCompareFunc)strcmp);
+                 if (show && !entry) {
+-                    recent.interface_toolbars = g_list_append(recent.interface_toolbars, g_strdup(action->text().toUtf8()));
++                    recent.interface_toolbars = g_list_append(recent.interface_toolbars, g_strdup(action->text().toUtf8().constData()));
+                 } else if (!show && entry) {
+                     recent.interface_toolbars = g_list_remove(recent.interface_toolbars, entry->data);
+                 }

wireshark-0009-ripemd-fips-core-dump.patch

@@ -0,0 +1,164 @@
+diff --git a/capinfos.c b/capinfos.c
+index 3c7866befd..da576f88c5 100644
+--- a/capinfos.c
++++ b/capinfos.c
+@@ -141,7 +141,6 @@ static gboolean cap_file_hashes    = TRUE;  /* Calculate file hashes */
+ 
+ // Strongest to weakest
+ #define HASH_SIZE_SHA256 32
+-#define HASH_SIZE_RMD160 20
+ #define HASH_SIZE_SHA1   20
+ 
+ #define HASH_STR_SIZE (65) /* Max hash size * 2 + '\0' */
+@@ -743,7 +742,6 @@ print_stats(const gchar *filename, capture_info *cf_info)
+     }
+     if (cap_file_hashes) {
+         printf     ("SHA256:              %s\n", file_sha256);
+-        printf     ("RIPEMD160:           %s\n", file_rmd160);
+         printf     ("SHA1:                %s\n", file_sha1);
+     }
+     if (cap_order)          printf     ("Strict time order:   %s\n", order_string(cf_info->order));
+@@ -857,7 +855,6 @@ print_stats_table_header(void)
+     if (cap_packet_rate)    print_stats_table_header_label("Average packet rate (packets/sec)");
+     if (cap_file_hashes) {
+         print_stats_table_header_label("SHA256");
+-        print_stats_table_header_label("RIPEMD160");
+         print_stats_table_header_label("SHA1");
+     }
+     if (cap_order)          print_stats_table_header_label("Strict time order");
+@@ -1182,7 +1179,6 @@ calculate_hashes(const char *filename)
+             }
+             gcry_md_final(hd);
+             hash_to_str(gcry_md_read(hd, GCRY_MD_SHA256), HASH_SIZE_SHA256, file_sha256);
+-            hash_to_str(gcry_md_read(hd, GCRY_MD_RMD160), HASH_SIZE_RMD160, file_rmd160);
+             hash_to_str(gcry_md_read(hd, GCRY_MD_SHA1), HASH_SIZE_SHA1, file_sha1);
+         }
+         if (fh) fclose(fh);
+@@ -1489,7 +1485,7 @@ print_usage(FILE *output)
+     fprintf(output, "  -E display the capture file encapsulation\n");
+     fprintf(output, "  -I display the capture file interface information\n");
+     fprintf(output, "  -F display additional capture file information\n");
+-    fprintf(output, "  -H display the SHA256, RIPEMD160, and SHA1 hashes of the file\n");
++    fprintf(output, "  -H display the SHA256 and SHA1 hashes of the file\n");
+     fprintf(output, "  -k display the capture comment\n");
+     fprintf(output, "\n");
+     fprintf(output, "Size infos:\n");
+@@ -1842,10 +1838,9 @@ main(int argc, char *argv[])
+     if (cap_file_hashes) {
+         gcry_check_version(NULL);
+         gcry_md_open(&hd, GCRY_MD_SHA256, 0);
+-        if (hd) {
+-            gcry_md_enable(hd, GCRY_MD_RMD160);
++        if (hd)
+             gcry_md_enable(hd, GCRY_MD_SHA1);
+-        }
++
+         hash_buf = (char *)g_malloc(HASH_BUF_SIZE);
+     }
+ 
+diff --git a/doc/capinfos.adoc b/doc/capinfos.adoc
+index 16ed2e300a..124fb56694 100644
+--- a/doc/capinfos.adoc
++++ b/doc/capinfos.adoc
+@@ -200,7 +200,7 @@ Prints the help listing and exits.
+ -H::
+ +
+ --
+-Displays the SHA256, RIPEMD160, and SHA1 hashes for the file.
++Displays the SHA256 and SHA1 hashes for the file.
+ SHA1 output may be removed in the future.
+ --
+ 
+diff --git a/capinfos.c b/capinfos.c
+index f0059f4e54..e153097219 100644
+--- a/capinfos.c
++++ b/capinfos.c
+@@ -148,7 +148,6 @@ static gboolean cap_file_hashes    = TRUE;  /* Calculate file hashes */
+ 
+ 
+ static gchar file_sha256[HASH_STR_SIZE];
+-static gchar file_rmd160[HASH_STR_SIZE];
+ static gchar file_sha1[HASH_STR_SIZE];
+ 
+ static char  *hash_buf = NULL;
+@@ -1024,11 +1023,6 @@ print_stats_table(const gchar *filename, capture_info *cf_info)
+         printf("%s", file_sha256);
+         putquote();
+ 
+-        putsep();
+-        putquote();
+-        printf("%s", file_rmd160);
+-        putquote();
+-
+         putsep();
+         putquote();
+         printf("%s", file_sha1);
+@@ -1168,7 +1162,6 @@ calculate_hashes(const char *filename)
+     size_t hash_bytes;
+ 
+     (void) g_strlcpy(file_sha256, "<unknown>", HASH_STR_SIZE);
+-    (void) g_strlcpy(file_rmd160, "<unknown>", HASH_STR_SIZE);
+     (void) g_strlcpy(file_sha1, "<unknown>", HASH_STR_SIZE);
+ 
+     if (cap_file_hashes) {
+diff --git a/ui/qt/capture_file_properties_dialog.cpp b/ui/qt/capture_file_properties_dialog.cpp
+index 9e5b86a7fd..c77056818c 100644
+--- a/ui/qt/capture_file_properties_dialog.cpp
++++ b/ui/qt/capture_file_properties_dialog.cpp
+@@ -175,11 +175,6 @@ QString CaptureFilePropertiesDialog::summaryToHtml()
+         << table_data_tmpl.arg(summary.file_sha256)
+         << table_row_end;
+ 
+-    out << table_row_begin
+-        << table_vheader_tmpl.arg(tr("Hash (RIPEMD160)"))
+-        << table_data_tmpl.arg(summary.file_rmd160)
+-        << table_row_end;
+-
+     out << table_row_begin
+         << table_vheader_tmpl.arg(tr("Hash (SHA1)"))
+         << table_data_tmpl.arg(summary.file_sha1)
+diff --git a/ui/summary.c b/ui/summary.c
+index 127698fd5c..58c7cd68a4 100644
+--- a/ui/summary.c
++++ b/ui/summary.c
+@@ -21,7 +21,6 @@
+ 
+ // Strongest to weakest
+ #define HASH_SIZE_SHA256 32
+-#define HASH_SIZE_RMD160 20
+ #define HASH_SIZE_SHA1   20
+ 
+ #define HASH_BUF_SIZE (1024 * 1024)
+@@ -213,12 +212,10 @@ summary_fill_in(capture_file *cf, summary_tally *st)
+     g_free(idb_info);
+ 
+     (void) g_strlcpy(st->file_sha256, "<unknown>", HASH_STR_SIZE);
+-    (void) g_strlcpy(st->file_rmd160, "<unknown>", HASH_STR_SIZE);
+     (void) g_strlcpy(st->file_sha1, "<unknown>", HASH_STR_SIZE);
+ 
+     gcry_md_open(&hd, GCRY_MD_SHA256, 0);
+     if (hd) {
+-        gcry_md_enable(hd, GCRY_MD_RMD160);
+         gcry_md_enable(hd, GCRY_MD_SHA1);
+     }
+     hash_buf = (char *)g_malloc(HASH_BUF_SIZE);
+@@ -230,7 +227,6 @@ summary_fill_in(capture_file *cf, summary_tally *st)
+         }
+         gcry_md_final(hd);
+         hash_to_str(gcry_md_read(hd, GCRY_MD_SHA256), HASH_SIZE_SHA256, st->file_sha256);
+-        hash_to_str(gcry_md_read(hd, GCRY_MD_RMD160), HASH_SIZE_RMD160, st->file_rmd160);
+         hash_to_str(gcry_md_read(hd, GCRY_MD_SHA1), HASH_SIZE_SHA1, st->file_sha1);
+     }
+     if (fh) fclose(fh);
+diff --git a/ui/summary.h b/ui/summary.h
+index 9063b99b77..95a51a38c0 100644
+--- a/ui/summary.h
++++ b/ui/summary.h
+@@ -56,7 +56,6 @@ typedef struct _summary_tally {
+     const char           *filename;           /**< path of capture file */
+     gint64                file_length;        /**< file length in bytes */
+     gchar                 file_sha256[HASH_STR_SIZE];  /**< SHA256 hash of capture file */
+-    gchar                 file_rmd160[HASH_STR_SIZE];  /**< RIPEMD160 hash of capture file */
+     gchar                 file_sha1[HASH_STR_SIZE];    /**< SHA1 hash of capture file */
+     int                   file_type;          /**< wiretap file type */
+     wtap_compression_type compression_type;   /**< compression type of file, or uncompressed */

wireshark-0010-manage-interfaces-crash.patch

@@ -0,0 +1,74 @@
+From 2d55e5672b07a8a102024e0af66e821bba51213b Mon Sep 17 00:00:00 2001
+From: Gerald Combs <gerald@wireshark.org>
+Date: Sun, 27 Aug 2023 14:47:52 -0700
+Subject: [PATCH] Qt: Fix ManageInterfacesDialog cleanup
+
+Handle our ManageInterfacesDialog cleanup tasks inside our destructor.
+If we try to handle them in on_buttonBox_accepted we run into a race
+condition with WA_DeleteOnClose.
+
+Fixes #19287
+---
+ ui/qt/manage_interfaces_dialog.cpp | 25 ++++++++++++-------------
+ ui/qt/manage_interfaces_dialog.h   |  2 --
+ 2 files changed, 12 insertions(+), 15 deletions(-)
+
+diff --git a/ui/qt/manage_interfaces_dialog.cpp b/ui/qt/manage_interfaces_dialog.cpp
+index cb9da8697b5..a8529e265a9 100644
+--- a/ui/qt/manage_interfaces_dialog.cpp
++++ b/ui/qt/manage_interfaces_dialog.cpp
+@@ -209,6 +209,18 @@ ManageInterfacesDialog::ManageInterfacesDialog(QWidget *parent) :
+ 
+ ManageInterfacesDialog::~ManageInterfacesDialog()
+ {
++    if (result() == QDialog::Accepted) {
++#ifdef HAVE_LIBPCAP
++        sourceModel->save();
++#endif
++#ifdef HAVE_PCAP_REMOTE
++        remoteAccepted();
++#endif
++        prefs_main_write();
++        mainApp->refreshLocalInterfaces();
++        emit ifsChanged();
++    }
++
+     delete ui;
+ }
+ 
+@@ -252,19 +264,6 @@ void ManageInterfacesDialog::updateWidgets()
+     ui->hintLabel->setText(hint);
+ }
+ 
+-void ManageInterfacesDialog::on_buttonBox_accepted()
+-{
+-#ifdef HAVE_LIBPCAP
+-    sourceModel->save();
+-#endif
+-#ifdef HAVE_PCAP_REMOTE
+-    remoteAccepted();
+-#endif
+-    prefs_main_write();
+-    mainApp->refreshLocalInterfaces();
+-    emit ifsChanged();
+-}
+-
+ #ifdef HAVE_LIBPCAP
+ void ManageInterfacesDialog::on_addPipe_clicked()
+ {
+diff --git a/ui/qt/manage_interfaces_dialog.h b/ui/qt/manage_interfaces_dialog.h
+index 80b78afbe7a..79e9d0d9bfa 100644
+--- a/ui/qt/manage_interfaces_dialog.h
++++ b/ui/qt/manage_interfaces_dialog.h
+@@ -59,8 +59,6 @@ signals:
+ private slots:
+     void updateWidgets();
+ 
+-    void on_buttonBox_accepted();
+-
+ #ifdef HAVE_LIBPCAP
+     void on_addPipe_clicked();
+     void on_delPipe_clicked();
+-- 
+GitLab
+

wireshark.spec

@@ -1,13 +1,11 @@
 %undefine __cmake_in_source_build
 %global with_lua 1
 %global with_maxminddb 1
-%global plugins_version 3.6
-# added temporarily due to errors in libqt5core
-%define _lto_cflags %{nil}
+%global plugins_version 4.0
 
 Summary:	Network traffic analyzer
 Name:		wireshark
-Version:	3.6.7
+Version:	4.0.8
 Release:	2%{?dist}
 Epoch:		1
 License:	GPL+
@@ -29,6 +27,9 @@ Patch5:		wireshark-0005-Fix-paths-in-a-wireshark.desktop-file.patch
 # Fedora-specific
 Patch6:		wireshark-0006-Move-tmp-to-var-tmp.patch
 Patch7:		wireshark-0007-cmakelists.patch
+Patch8:		wireshark-0008-glib2-g_strdup-build.patch
+Patch9:		wireshark-0009-ripemd-fips-core-dump.patch
+Patch10:	wireshark-0010-manage-interfaces-crash.patch
 
 #install tshark together with wireshark GUI
 Requires:	%{name}-cli = %{epoch}:%{version}-%{release}
@@ -58,21 +59,23 @@ BuildRequires:	desktop-file-utils
 BuildRequires:	xdg-utils
 BuildRequires:	bison
 BuildRequires:	flex
-BuildRequires:	pcre-devel
 BuildRequires:	perl(Pod::Html)
 BuildRequires:	perl(Pod::Man)
 BuildRequires:	perl(open)
+BuildRequires:	pcre2-devel
 Buildrequires:	libssh-devel
-BuildRequires:	qt5-linguist
-BuildRequires:	qt5-qtbase-devel
-BuildRequires:	qt5-qtmultimedia-devel
-BuildRequires:	qt5-qtsvg-devel
+BuildRequires:  qt6-qttools-devel
+BuildRequires:  qt6-linguist
+BuildRequires:  qt6-qtbase-devel
+BuildRequires:  qt6-qt5compat-devel
+BuildRequires:  qt6-qtmultimedia-devel
+BuildRequires:  qt6-qtsvg-devel
 BuildRequires:	zlib-devel
 BuildRequires:	asciidoctor
 %if %{with_maxminddb} && 0%{?fedora}
 BuildRequires:	libmaxminddb-devel
 %endif
-%if %{with_lua} && 0%{?fedora}
+%if %{with_lua}
 BuildRequires:	compat-lua-devel
 %endif
 Buildrequires: git-core
@@ -83,8 +86,6 @@ BuildRequires: systemd-devel
 BuildRequires: libnghttp2-devel
 BuildRequires: systemd-rpm-macros
 
-Obsoletes: wireshark-qt, wireshark-gtk
-
 %description
 Wireshark allows you to examine protocol data stored in files or as it is
 captured from wired or wireless (WiFi or Bluetooth) networks, USB devices,
@@ -107,7 +108,10 @@ Wireshark.
 
 %package devel
 Summary:	Development headers and libraries for wireshark
-Requires:	%{name} = %{epoch}:%{version}-%{release} glibc-devel glib2-devel
+Requires:	%{name} = %{epoch}:%{version}-%{release}
+Requires:	%{name}-cli = %{epoch}:%{version}-%{release}
+Requires:	glibc-devel
+Requires:	glib2-devel
 
 %description devel
 The wireshark-devel package contains the header files, developer
@@ -122,8 +126,9 @@ and plugins.
 %cmake -G "Unix Makefiles" \
   -DDISABLE_WERROR=ON \
   -DBUILD_wireshark=ON \
-%if %{with_lua} && 0%{?fedora}
+%if %{with_lua}
   -DENABLE_LUA=ON \
+  -DLUA_VERSION_NUM=5.1 \
 %else
   -DENABLE_LUA=OFF \
 %endif
@@ -135,11 +140,11 @@ and plugins.
   -DBUILD_randpktdump=OFF \
   -DBUILD_androiddump=ON \
   -DENABLE_SMI=ON \
+  -DUSE_qt6=ON \
   -DENABLE_PLUGINS=ON \
   -DENABLE_NETLINK=ON \
   -DBUILD_dcerpcidl2wrs=OFF \
-  -DBUILD_sdjournal=ON \
-  %{nil}
+  -DBUILD_sdjournal=ON
 
 %cmake_build
 
@@ -162,7 +167,6 @@ mkdir -p "${IDIR}/wsutil"
 mkdir -p %{buildroot}%{_udevrulesdir}
 install -m 644 %{_vpath_builddir}/config.h epan/register.h	"${IDIR}/"
 install -m 644 cfile.h file.h		"${IDIR}/"
-install -m 644 ws_symbol_export.h	"${IDIR}/"
 install -m 644 epan/*.h			"${IDIR}/epan/"
 install -m 644 epan/crypt/*.h		"${IDIR}/epan/crypt"
 install -m 644 epan/ftypes/*.h		"${IDIR}/epan/ftypes"
@@ -170,7 +174,8 @@ install -m 644 epan/dfilter/*.h		"${IDIR}/epan/dfilter"
 install -m 644 epan/dissectors/*.h	"${IDIR}/epan/dissectors"
 install -m 644 wiretap/*.h		"${IDIR}/wiretap"
 install -m 644 wsutil/*.h		"${IDIR}/wsutil"
-install -m 644 ws_diag_control.h	"${IDIR}/"
+install -m 644 include/ws_symbol_export.h	"${IDIR}/"
+install -m 644 include/ws_diag_control.h	"${IDIR}/"
 install -m 644 %{SOURCE2}		%{buildroot}%{_udevrulesdir}
 install -Dpm 644 %{SOURCE3}		%{buildroot}%{_sysusersdir}/%{name}.conf
 
@@ -200,7 +205,6 @@ fi
 %{_datadir}/icons/hicolor/*/mimetypes/*
 %{_bindir}/wireshark
 %{_mandir}/man1/wireshark.*
-%{_sysusersdir}/%{name}.conf
 
 %files cli
 %license COPYING
@@ -226,6 +230,7 @@ fi
 %dir %{_libdir}/wireshark/plugins
 %{_libdir}/wireshark/extcap/ciscodump
 %{_libdir}/wireshark/extcap/udpdump
+%{_libdir}/wireshark/extcap/wifidump
 %{_libdir}/wireshark/extcap/sshdump
 %{_libdir}/wireshark/extcap/sdjournal
 %{_libdir}/wireshark/extcap/dpauxmon
@@ -253,6 +258,7 @@ fi
 %{_mandir}/man1/reordercap.*
 %{_mandir}/man1/sshdump.*
 %{_mandir}/man1/udpdump.*
+%{_mandir}/man1/wifidump.*
 %{_mandir}/man1/androiddump.*
 %{_mandir}/man1/captype.*
 %{_mandir}/man1/ciscodump.*
@@ -266,6 +272,7 @@ fi
 %endif
 %dir %{_datadir}/wireshark
 %{_datadir}/wireshark/*
+%{_sysusersdir}/%{name}.conf
 
 %files devel
 %doc doc/README.* ChangeLog
@@ -274,6 +281,47 @@ fi
 %{_libdir}/pkgconfig/%{name}.pc
 
 %changelog
+* Thu Aug 31 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.8-2
+- Resolves: #2236246 - wireshark crash in managed interfaces
+
+* Tue Aug 29 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.8-1
+- New version 4.0.8
+- Resolves: #2235577 - possible Denial of Service via crafted package
+
+* Fri Jul 28 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.7-2
+- Resolves: #2227004 - capinfos aborts in FIPS
+
+* Fri Jul 14 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.7-1
+- New version 4.0.7
+
+* Thu May 25 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.6-1
+- New version 4.0.6
+
+* Thu Apr 13 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.5-1
+- New version 4.0.5
+- Fix for bug #2159392
+
+* Tue Mar 07 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.4-1
+- New version 4.0.4
+
+* Thu Feb 02 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.3-1
+- New version 4.0.3
+
+* Thu Dec 08 2022 Michal Ruprich <mruprich@redhat.com> - 1:4.0.2-1
+- New version 4.0.2
+
+* Fri Nov 25 2022 Michal Ruprich <mruprich@redhat.com> - 1:4.0.1-1
+- New version 4.0.1
+- Fix for rhbz #2148308
+- Fix for CVE-2022-3725
+
+* Fri Oct 14 2022 Michal Ruprich <mruprich@redhat.com> - 1:4.0.0-1
+- New version 4.0.0
+
+* Thu Sep 29 2022 Michal Ruprich <mruprich@redhat.com> - 1:3.6.8-1
+- New-version 3.6.8
+- Fix for CVE-2022-3190
+
 * Mon Aug 01 2022 Davide Cavalca <dcavalca@fedoraproject.org> - 1:3.6.7-2
 - Drop gating for python3-devel dependency