Compare commits

..

18 commits

Author SHA1 Message Date
Michal Ambroz
4a0c8ff63c Merge remote-tracking branch 'origin/rawhide' into epel7 2021-11-10 16:04:17 +00:00
Michal Ambroz
b8b6a6be98 Merge remote-tracking branch 'origin/rawhide' into epel7 2021-04-27 02:53:42 +02:00
Michal Ambroz
0e73646cf9 Merge remote-tracking branch 'origin/rawhide' into epel7 2021-04-25 09:50:35 +02:00
Michal Ambroz
a8f70ac5d6 Merge remote-tracking branch 'origin/rawhide' into epel7 2021-02-11 01:57:11 +00:00
Michal Ambroz
2a138ce159 Merge remote-tracking branch 'origin/master' into epel7 2020-07-19 18:38:02 +00:00
Michal Ambroz
9e0291b2fe Merge remote-tracking branch 'origin/master' into epel7 2020-07-17 21:18:32 +00:00
Michal Ambroz
27b3b412a8 Merge remote-tracking branch 'origin/master' into epel7
Bump to bugfix release 3.11.0
2019-10-11 14:37:33 +00:00
Michal Ambroz
0ff5b3a1a6 Bugfix - bump to 3.10.0 2019-09-27 22:44:05 +00:00
Michal Ambroz
b937874674 Merge remote-tracking branch 'origin/master' into epel7 2019-05-03 15:26:14 +00:00
Michal Ambroz
ee638c446e Merge remote-tracking branch 'origin/master' into epel7 2019-03-18 18:03:25 +00:00
Michal Ambroz
fb71740395 bump to 3.8.1
fix CVE-2018-12034 CVE-2018-12035
2018-08-27 19:31:01 +00:00
Michal Ambroz
507808d28a Merge remote-tracking branch 'origin/master' into epel7
Bugfix release 3.7.1
2018-02-05 18:45:36 +00:00
Michal Ambroz
06c15ebd10 Merge remote-tracking branch 'origin/master' into epel7 2017-11-15 19:31:52 +00:00
Michal Ambroz
f460595610 bugfix release - CVE-2017-11328 2017-07-16 18:57:37 +02:00
h3x2b
90161e5be0 bump to 3.6.2 bigfix release 2017-07-03 17:25:55 +00:00
Michal Ambroz
35c5bbdbbc Merge remote-tracking branch 'origin/master' into epel7
Bugfixes for security issues
2017-05-24 11:38:28 +02:00
h3x2b
ebe07e2401 Merge remote-tracking branch 'origin/master' into epel7 2017-04-13 16:25:26 +00:00
Michal Ambroz
35482f1613 building epel7 without cuckoo support due to old version of jansson 2016-08-11 02:34:44 +02:00
7 changed files with 12599 additions and 544 deletions

28
.gitignore vendored
View file

@ -1,2 +1,26 @@
/androguard-yara-*.tar.gz
/yara-*.tar.gz
/androguard-yara-3.5.0-fc14c0f.tar.gz
/androguard-yara-3.6.0-e4cf5fa.tar.gz
/androguard-yara-3.6.2-e4cf5fa.tar.gz
/androguard-yara-3.6.3-e4cf5fa.tar.gz
/androguard-yara-e4cf5fa.tar.gz
/androguard-yara-fa11a84.tar.gz
/androguard-yara-3eea86a.tar.gz
/androguard-yara-2020-04-22-3eea86a.tar.gz
/yara-3.5.0-7473441.tar.gz
/yara-3.6.0.tar.gz
/yara-3.6.2.tar.gz
/yara-3.6.3.tar.gz
/yara-3.7.0.tar.gz
/yara-3.7.1.tar.gz
/yara-3.8.1.tar.gz
/yara-3.9.0.tar.gz
/yara-3.10.0.tar.gz
/yara-3.11.0.tar.gz
/yara-4.0.0.tar.gz
/yara-4.0.1.tar.gz
/yara-4.0.2.tar.gz
/yara-4.0.4.tar.gz
/yara-4.0.5.tar.gz
/yara-4.1.0.tar.gz
/yara-4.1.1.tar.gz
/yara-4.1.3.tar.gz

View file

@ -1,235 +0,0 @@
From 05a1e87e77226c8dd7e2228d26e3aa462e968dc7 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Thu, 23 Apr 2026 17:55:01 -0400
Subject: [PATCH] Use OpenSSL accessor functions for ASN1_STRING
Directly accessing the `data` and `length` fields of `ASN1_STRING` structures
is incompatible with newer versions of OpenSSL, where these structures are
opaque. This change replaces direct field access with the standard
`ASN1_STRING_get0_data` and `ASN1_STRING_length` accessor functions to ensure
compatibility. Additionally, an `X509_NAME_ENTRY` pointer is made `const` to
align with modern OpenSSL API signatures.
Co-authored-by: Gemini <gemini@google.com>
Signed-off-by: rpm-build <rpm-build>
---
.../pe/authenticode-parser/authenticode.c | 32 +++++++++----------
.../pe/authenticode-parser/certificate.c | 4 +--
.../pe/authenticode-parser/countersignature.c | 28 ++++++++--------
3 files changed, 32 insertions(+), 32 deletions(-)
diff --git a/libyara/modules/pe/authenticode-parser/authenticode.c b/libyara/modules/pe/authenticode-parser/authenticode.c
index f385860..a2f7f74 100644
--- a/libyara/modules/pe/authenticode-parser/authenticode.c
+++ b/libyara/modules/pe/authenticode-parser/authenticode.c
@@ -78,8 +78,8 @@ static SpcIndirectDataContent* get_content(PKCS7* content)
if (!spcContent)
return NULL;
- int len = content->d.other->value.sequence->length;
- const uint8_t* data = content->d.other->value.sequence->data;
+ int len = ASN1_STRING_length(content->d.other->value.sequence);
+ const uint8_t* data = ASN1_STRING_get0_data(content->d.other->value.sequence);
d2i_SpcIndirectDataContent(&spcContent, &data, len);
@@ -88,8 +88,8 @@ static SpcIndirectDataContent* get_content(PKCS7* content)
static char* parse_program_name(ASN1_TYPE* spcAttr)
{
- const uint8_t* spcData = spcAttr->value.sequence->data;
- int spcLen = spcAttr->value.sequence->length;
+ const uint8_t* spcData = ASN1_STRING_get0_data(spcAttr->value.sequence);
+ int spcLen = ASN1_STRING_length(spcAttr->value.sequence);
SpcSpOpusInfo* spcInfo = d2i_SpcSpOpusInfo(NULL, &spcData, spcLen);
if (!spcInfo)
return NULL;
@@ -131,8 +131,8 @@ static void parse_nested_authenticode(PKCS7_SIGNER_INFO* si, AuthenticodeArray*
ASN1_TYPE* nested = X509_ATTRIBUTE_get0_type(attr, i);
if (nested == NULL)
break;
- int len = nested->value.sequence->length;
- const uint8_t* data = nested->value.sequence->data;
+ int len = ASN1_STRING_length(nested->value.sequence);
+ const uint8_t* data = ASN1_STRING_get0_data(nested->value.sequence);
AuthenticodeArray* auth = authenticode_new(data, len);
if (!auth)
continue;
@@ -162,8 +162,8 @@ static void parse_pkcs9_countersig(PKCS7* p7, Authenticode* auth)
ASN1_TYPE* nested = X509_ATTRIBUTE_get0_type(attr, i);
if (nested == NULL)
break;
- int len = nested->value.sequence->length;
- const uint8_t* data = nested->value.sequence->data;
+ int len = ASN1_STRING_length(nested->value.sequence);
+ const uint8_t* data = ASN1_STRING_get0_data(nested->value.sequence);
Countersignature* sig = pkcs9_countersig_new(data, len, p7->d.sign->cert, si->enc_digest);
if (!sig)
@@ -193,8 +193,8 @@ static void parse_ms_countersig(PKCS7* p7, Authenticode* auth)
ASN1_TYPE* nested = X509_ATTRIBUTE_get0_type(attr, i);
if (nested == NULL)
break;
- int len = nested->value.sequence->length;
- const uint8_t* data = nested->value.sequence->data;
+ int len = ASN1_STRING_length(nested->value.sequence);
+ const uint8_t* data = ASN1_STRING_get0_data(nested->value.sequence);
Countersignature* csig = ms_countersig_new(data, len, si->enc_digest);
if (!csig)
@@ -209,8 +209,8 @@ static void parse_ms_countersig(PKCS7* p7, Authenticode* auth)
static bool authenticode_verify(PKCS7* p7, PKCS7_SIGNER_INFO* si, X509* signCert)
{
- const uint8_t* contentData = p7->d.sign->contents->d.other->value.sequence->data;
- long contentLen = p7->d.sign->contents->d.other->value.sequence->length;
+ const uint8_t* contentData = ASN1_STRING_get0_data(p7->d.sign->contents->d.other->value.sequence);
+ long contentLen = ASN1_STRING_length(p7->d.sign->contents->d.other->value.sequence);
uint64_t version = 0;
ASN1_INTEGER_get_uint64(&version, p7->d.sign->version);
@@ -315,8 +315,8 @@ AuthenticodeArray* authenticode_new(const uint8_t* data, int32_t len)
int digestnid = OBJ_obj2nid(messageDigest->digestAlgorithm->algorithm);
auth->digest_alg = strdup(OBJ_nid2ln(digestnid));
- int digestLen = messageDigest->digest->length;
- const uint8_t* digestData = messageDigest->digest->data;
+ int digestLen = ASN1_STRING_length(messageDigest->digest);
+ const uint8_t* digestData = ASN1_STRING_get0_data(messageDigest->digest);
byte_array_init(&auth->digest, digestData, digestLen);
SpcIndirectDataContent_free(dataContent);
@@ -372,8 +372,8 @@ AuthenticodeArray* authenticode_new(const uint8_t* data, int32_t len)
digestnid = OBJ_obj2nid(si->digest_alg->algorithm);
signer->digest_alg = strdup(OBJ_nid2ln(digestnid));
- digestLen = digest->value.asn1_string->length;
- digestData = digest->value.asn1_string->data;
+ digestLen = ASN1_STRING_length(digest->value.asn1_string);
+ digestData = ASN1_STRING_get0_data(digest->value.asn1_string);
byte_array_init(&signer->digest, digestData, digestLen);
/* Authenticode stores optional programName in non-optional SpcSpOpusInfo attribute */
diff --git a/libyara/modules/pe/authenticode-parser/certificate.c b/libyara/modules/pe/authenticode-parser/certificate.c
index fc754e4..97c7e3e 100644
--- a/libyara/modules/pe/authenticode-parser/certificate.c
+++ b/libyara/modules/pe/authenticode-parser/certificate.c
@@ -59,13 +59,13 @@ static void parse_name_attributes(X509_NAME* raw, Attributes* attr)
int entryCount = X509_NAME_entry_count(raw);
for (int i = entryCount - 1; i >= 0; --i) {
- X509_NAME_ENTRY* entryName = X509_NAME_get_entry(raw, i);
+ const X509_NAME_ENTRY* entryName = X509_NAME_get_entry(raw, i);
ASN1_STRING* asn1String = X509_NAME_ENTRY_get_data(entryName);
const char* key = OBJ_nid2sn(OBJ_obj2nid(X509_NAME_ENTRY_get_object(entryName)));
ByteArray array = {0};
- if (byte_array_init(&array, asn1String->data, asn1String->length) == -1)
+ if (byte_array_init(&array, ASN1_STRING_get0_data(asn1String), ASN1_STRING_length(asn1String)) == -1)
break;
if (strcmp(key, "C") == 0 && !attr->country.data)
diff --git a/libyara/modules/pe/authenticode-parser/countersignature.c b/libyara/modules/pe/authenticode-parser/countersignature.c
index 0fb4576..6cb5eed 100644
--- a/libyara/modules/pe/authenticode-parser/countersignature.c
+++ b/libyara/modules/pe/authenticode-parser/countersignature.c
@@ -141,13 +141,13 @@ Countersignature* pkcs9_countersig_new(
result->chain = parse_signer_chain(signCert, certs);
/* Get digest that corresponds to decrypted encrypted digest in signature */
- ASN1_TYPE* messageDigest = PKCS7_get_signed_attribute(si, NID_pkcs9_messageDigest);
+ const ASN1_TYPE* messageDigest = PKCS7_get_signed_attribute(si, NID_pkcs9_messageDigest);
if (!messageDigest) {
result->verify_flags = COUNTERSIGNATURE_VFY_DIGEST_MISSING;
goto end;
}
- size_t digestLen = messageDigest->value.octet_string->length;
+ size_t digestLen = ASN1_STRING_length(messageDigest->value.octet_string);
if (!digestLen) {
result->verify_flags = COUNTERSIGNATURE_VFY_DIGEST_MISSING;
@@ -160,7 +160,7 @@ Countersignature* pkcs9_countersig_new(
goto end;
}
- const uint8_t* digestData = messageDigest->value.octet_string->data;
+ const uint8_t* digestData = ASN1_STRING_get0_data(messageDigest->value.octet_string);
byte_array_init(&result->digest, digestData, digestLen);
/* By this point we all necessary things for verification
@@ -187,8 +187,8 @@ Countersignature* pkcs9_countersig_new(
goto end;
}
- uint8_t* encData = si->enc_digest->data;
- size_t encLen = si->enc_digest->length;
+ const uint8_t* encData = ASN1_STRING_get0_data(si->enc_digest);
+ size_t encLen = ASN1_STRING_length(si->enc_digest);
/* Decrypt the encrypted digest */
EVP_PKEY_verify_recover_init(ctx);
@@ -220,7 +220,7 @@ Countersignature* pkcs9_countersig_new(
const uint8_t* data_ptr = decData;
DigestInfo* digest_info = d2i_DigestInfo(NULL, &data_ptr, decLen);
if (digest_info) {
- isValid = !memcmp(digest_info->digest->data, calc_digest, mdLen);
+ isValid = !memcmp(ASN1_STRING_get0_data(digest_info->digest), calc_digest, mdLen);
DigestInfo_free(digest_info);
} else {
isValid = false;
@@ -235,7 +235,7 @@ Countersignature* pkcs9_countersig_new(
/* Now check the countersignature message-digest that should correspond
* to Signatures encrypted digest it countersigns */
- calculate_digest(md, enc_digest->data, enc_digest->length, calc_digest);
+ calculate_digest(md, ASN1_STRING_get0_data(enc_digest), ASN1_STRING_length(enc_digest), calc_digest);
/* Check if calculated one matches the stored one */
if (digestLen != mdLen || memcmp(calc_digest, digestData, mdLen) != 0) {
@@ -269,8 +269,8 @@ TS_TST_INFO* IMPL_FUNC_NAME(get_ts_tst_info, cms)(CountersignatureImpl* impl)
return NULL;
}
- const uint8_t* data = (*content)->data;
- TS_TST_INFO* ts_tst_info = d2i_TS_TST_INFO(NULL, &data, (*content)->length);
+ const uint8_t* data = ASN1_STRING_get0_data(*content);
+ TS_TST_INFO* ts_tst_info = d2i_TS_TST_INFO(NULL, &data, ASN1_STRING_length(*content));
if (!ts_tst_info) {
return NULL;
}
@@ -400,8 +400,8 @@ int IMPL_FUNC_NAME(verify_digest, cms)(
return 0;
}
- if (ts_imprint_digest->length != (int)digest_size ||
- memcmp(ts_imprint_digest->data, digest, digest_size) != 0) {
+ if (ASN1_STRING_length(ts_imprint_digest) != (int)digest_size ||
+ memcmp(ASN1_STRING_get0_data(ts_imprint_digest), digest, digest_size) != 0) {
TS_TST_INFO_free(ts_tst_info);
return 0;
}
@@ -554,8 +554,8 @@ Countersignature* ms_countersig_new(const uint8_t* data, long size, ASN1_STRING*
ASN1_STRING* rawDigest = TS_MSG_IMPRINT_get_msg(imprint);
- int digestLen = rawDigest->length;
- uint8_t* digestData = rawDigest->data;
+ int digestLen = ASN1_STRING_length(rawDigest);
+ const uint8_t* digestData = ASN1_STRING_get0_data(rawDigest);
byte_array_init(&result->digest, digestData, digestLen);
@@ -571,7 +571,7 @@ Countersignature* ms_countersig_new(const uint8_t* data, long size, ASN1_STRING*
}
uint8_t calc_digest[EVP_MAX_MD_SIZE];
- calculate_digest(md, enc_digest->data, enc_digest->length, calc_digest);
+ calculate_digest(md, ASN1_STRING_get0_data(enc_digest), ASN1_STRING_length(enc_digest), calc_digest);
#if OPENSSL_VERSION_NUMBER >= 0x3000000fL
int mdLen = EVP_MD_get_size(md);
--
2.53.0

231
changelog
View file

@ -1,231 +0,0 @@
* Mon Sep 16 2024 Michal Ambroz <rebus _AT seznam.cz> - 4.5.2-1
- bump to 4.5.2
* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Mon May 27 2024 Michal Ambroz <rebus _AT seznam.cz> - 4.5.1-1
- bump to 4.5.1
* Wed Feb 14 2024 Michal Ambroz <rebus _AT seznam.cz> - 4.5.0-1
- bump to 4.5.0
* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Sun Sep 17 2023 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 4.4.0-1
- bump to 4.4.0
* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.3.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Wed Jun 14 2023 Michal Ambroz <rebus _AT seznam.cz> - 4.3.2-1
- bump to 4.3.2
* Wed Apr 26 2023 Michal Ambroz <rebus _AT seznam.cz> - 4.3.1-1
- bump to 4.3.1
* Thu Mar 30 2023 Michal Ambroz <rebus _AT seznam.cz> - 4.3.0-1
- bump to 4.3.0
* Tue Jan 24 2023 Michal Ambroz <rebus _AT seznam.cz> - 4.3.0-0.rc1.3
- fix EPEL9 build = reenable the SHA1 certificate validation in OpenSSL for make check
* Sat Jan 21 2023 Michal Ambroz <rebus _AT seznam.cz> - 4.3.0-0.rc1.2
- fix EPEL7 build
* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.3.0-0.rc1.1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Tue Jan 03 2023 Michal Ambroz <rebus _AT seznam.cz> - 4.3.0-0.rc1.1
- bump to 4.3.0 rc1
- remove the androguard module which is no longer available from github
* Tue Aug 09 2022 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 4.2.3-1
- Update to 4.2.3 (#2116594)
* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.2.2-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
* Mon Jul 18 2022 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 4.2.2-1
- Update to 4.2.2 (#2103444)
- BUGFIX: Fix buffer overrun in "dex" module (#1728).
- BUGFIX: Wrong offset used when checking Version string of .net metadata (#1708).
- BUGFIX: YARA doesn't compile if --with-debug-verbose flag is enabled (#1719).
- BUGFIX: Null-pointer dereferences while loading corrupted compiled rules (#1727).
* Mon May 23 2022 Michal Ambroz <rebus _AT seznam.cz> - 4.2.1-1
- bump to 4.2.1
- adding changes based on proposal of Mikel Olasagasti Uranga:
- change to BSD license as yara was relicensed in 2016
- minor changes to spec, like using https for URL
- remove old patches
- enable checks
* Sat Mar 12 2022 Michal Ambroz <rebus _AT seznam.cz> - 4.2.0-1
- bump to 4.2.0
* Thu Feb 17 2022 Michal Ambroz <rebus _AT seznam.cz> - 4.2.0-0.rc1.1
- bump to 4.2.0-rc1
* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.1.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
* Wed Nov 10 2021 Michal Ambroz <rebus _AT seznam.cz> - 4.1.3-1
- bump to 4.1.3
* Sat Nov 06 2021 Adrian Reber <adrian@lisas.de> - 4.1.1-5
- Rebuilt for protobuf 3.19.0
* Mon Oct 25 2021 Adrian Reber <adrian@lisas.de> - 4.1.1-4
- Rebuilt for protobuf 3.18.1
* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 4.1.1-3
- Rebuilt with OpenSSL 3.0.0
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.1.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Mon May 24 2021 Michal Ambroz <rebus _AT seznam.cz> - 4.1.1-1
- bump to 4.1.1
* Mon Apr 26 2021 Michal Ambroz <rebus _AT seznam.cz> - 4.1.0-1
- bump to 4.1.0
* Sun Apr 25 2021 Michal Ambroz <rebus _AT seznam.cz> - 4.0.5-2
- rebuild for epel
* Fri Feb 5 2021 Michal Ambroz <rebus _AT seznam.cz> - 4.0.5-1
- bump to yara bugfix 4.0.5 release
* Wed Feb 3 2021 Michal Ambroz <rebus _AT seznam.cz> - 4.0.4-1
- bump to yara bugfix 4.0.4 release
* Thu Jul 16 2020 Michal Ambroz <rebus _AT seznam.cz> - 4.0.2-1
- bump to yara bugfix 4.0.2 release
- fix build on epel7
* Sun Jun 14 2020 Adrian Reber <adrian@lisas.de> - 4.0.1-2
- Rebuilt for protobuf 3.12
* Tue Jun 2 2020 Michal Ambroz <rebus _AT seznam.cz> - 4.0.1-1
- bump to yara bugfix 4.0.1 release
* Tue Apr 28 2020 Michal Ambroz <rebus _AT seznam.cz> - 4.0.0-1
- bump to yara 4.0.0 release
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Oct 11 2019 Michal Ambroz <rebus _AT seznam.cz> - 3.11.0-1
- bump to 3.11.0 release (#1760678)
- BUGFIX: Some regexp character classes not matching correctly when used with “nocase” modifier (upstream #1117)
- BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors for certain hex pattern containing large jumps (upstream #1107)
- BUGFIX: Buffer overrun in “dotnet” module (upstream #1108)
- BUGFIX: Memory leak while attaching to a process fails (upstream #1070)
* Sat Sep 28 2019 Michal Ambroz <rebus _AT seznam.cz> - 3.10.0-3
- change the sphinx build dependency
* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Fri May 03 2019 Michal Ambroz <rebus _AT seznam.cz> - 3.10.0-1
- bump to 3.10.0 release (#1680204)
- Harden virtual machine against malicious code.
- BUGFIX: Regression bug in hex strings containing wildcards (upstream #1025).
- BUGFIX: Buffer overrun in “elf” module.
- BUGFIX: Buffer overrun in “dotnet” module.
* Sat Mar 16 2019 Michal Ambroz <rebus _AT seznam.cz> - 3.9.0-1
- bump to 3.9.0 release (#1680203)
- switch from python-sphinx to python3-sphinx for generating the documentation for fc31+
- should fix also #1660398 (CVE-2018-19974 CVE-2018-19975 CVE-2018-19976),
but by design it might be always dangerous to run yara signatures compiled by 3rd party,
so it is advised to re-compile yara rules instead
- BUGFIX: Denial of service when using "dex" module. Found by the Cisco Talos team. (upstream #1023, CVE-2019-5020)
- BUGFIX: Buffer overflow in "dotnet" module.
- BUGFIX: Regexp regression when using nested quantifiers {x,y} for certain values of x and y. (#1018)
* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.8.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Mon Aug 27 2018 Michal Ambroz <rebus _AT seznam.cz> - 3.8.1-1
- bump to 3.8.1 release (#1613093)
* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.7.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.7.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Mon Feb 05 2018 Michal Ambroz <rebus _AT seznam.cz> - 3.7.1-1
- bump to 3.7.1 release (#1534993)
* Wed Nov 15 2017 Michal Ambroz <rebus _AT seznam.cz> - 3.7.0-1
- bump to 3.7.0 release (#1511921)
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Sun Jul 16 2017 Michal Ambroz <rebus _AT seznam.cz> - 3.6.3-1
- bump to 3.6.3 release - bugfix CVE-2017-11328
* Mon Jul 03 2017 Michal Ambroz <rebus _AT seznam.cz> - 3.6.2-1
- bump to 3.6.2 release - bugfix CVE-2017-9304, CVE-2017-9465
* Wed May 24 2017 Michal Ambroz <rebus _AT seznam.cz> - 3.6.0-1
- bump to 3.6.0 release
- update the androguard-yara with bugfixes
* Thu Apr 13 2017 Michal Ambroz <rebus _AT seznam.cz> - 3.5.0-7
- Adding patch from pull request 627 until 3.5.1 is released
- https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch
- Fixes CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924
* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.5.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Tue Aug 09 2016 Michal Ambroz <rebus _AT seznam.cz> - 3.5.0-5
- import package to Fedora
- remove unnecessary .buildinfo tag from doc package
* Fri Aug 05 2016 Michal Ambroz <rebus _AT seznam.cz> - 3.5.0-4
- package review - bugzilla #1362265
- cosmetics of the changelog
- using default spinx theme to remove the static fonts
* Fri Aug 05 2016 Michal Ambroz <rebus _AT seznam.cz> - 3.5.0-3
- package review - bugzilla #1362265
- dropped Buildroot, pkgconfig, zlib-devel, defattr
- added buildrequires gcc
- change license back to ASL 2.0 only
* Thu Aug 04 2016 Michal Ambroz <rebus _AT seznam.cz> - 3.5.0-2
- package review - bugzilla #1362265
- changed packaging of doc sub-package
* Thu Aug 04 2016 Michal Ambroz <rebus _AT seznam.cz> - 3.5.0-1
- bump to new 3.5.0
* Wed Aug 03 2016 Michal Ambroz <rebus _AT seznam.cz> - 3.4.0-6
- package review - bugzilla #1362265
- dropped dependency of python-tools
* Mon Aug 01 2016 Michal Ambroz <rebus _AT seznam.cz> - 3.4.0-4
- compile with the androguard module
* Wed Jun 08 2016 Michal Ambroz <rebus _AT seznam.cz> - 3.4.0-2
- jansson dependency >= 2.5
* Wed Jun 08 2016 Michal Ambroz <rebus _AT seznam.cz> - 3.4.0-1
- python3 stuff
* Mon Jun 22 2015 Michal Ambroz <rebus _AT seznam.cz> - 3.4.0-0.git20150618
- initial build for Fedora Project

View file

@ -1 +1,2 @@
SHA512 (yara-4.5.8.tar.gz) = 12bbe1bebb6d51f7ae90ad6a725bdb096f3e884b757913e9ba37bfa1557bced32ef56895eb358af5f3165890336be57dc51e9fe2ad672c1e523cb30e00483c86
SHA512 (yara-4.1.3.tar.gz) = 1bfa1787c62dfd9a87fa8db5e8c2fa68f082ae66b16b5373bdcc6bc66b32016fcaffd4baa7e59a7c1f6d3426c972eca9cc22f70d475067d7557b1014a4ab65fc
SHA512 (androguard-yara-2020-04-22-3eea86a.tar.gz) = 827962b3c6f46cb9106e40156c85ec5a99fd0d4fa3584434b5ba60adbd8265df9c85d03172df36cc15a2a0983bad0297317b27e25372aa09121411e01c1d29be

24
yara-androguard.patch Normal file
View file

@ -0,0 +1,24 @@
diff --git a/libyara/Makefile.am b/libyara/Makefile.am
index 4fa363a..a9242b2 100644
--- a/libyara/Makefile.am
+++ b/libyara/Makefile.am
@@ -48,6 +48,7 @@ MODULES += modules/pe/pe_utils.c
if CUCKOO_MODULE
MODULES += modules/cuckoo/cuckoo.c
+MODULES += modules/androguard/androguard.c
endif
if MAGIC_MODULE
diff --git a/libyara/modules/module_list b/libyara/modules/module_list
index d81b8f3..ba43609 100644
--- a/libyara/modules/module_list
+++ b/libyara/modules/module_list
@@ -10,6 +10,7 @@ MODULE(dotnet)
#ifdef CUCKOO_MODULE
MODULE(cuckoo)
+MODULE(androguard)
#endif
#ifdef MAGIC_MODULE

12323
yara-pull627.patch Normal file

File diff suppressed because it is too large Load diff

299
yara.spec
View file

@ -1,49 +1,57 @@
Name: yara
Version: 4.5.8
Version: 4.1.3
Release: 1%{?dist}
Summary: Pattern matching Swiss knife for malware researchers
URL: https://VirusTotal.github.io/yara/
VCS: git:https://github.com/VirusTotal/yara/
# https://github.com/VirusTotal/yara/releases
# yara package itself is licensed with BSD 3 clause license
# bison grammar parsers in libyara/* are licensed with GPLv3+ license with exception from FSF alloving usage in larger work
# resulting binary package licensed as BSD
License: BSD-3-Clause
%global common_description %{expand:
YARA is a tool aimed at (but not limited to) helping malware researchers to
identify and classify malware samples. With YARA you can create descriptions
of malware families (or whatever you want to describe) based on textual or
binary patterns. Each description, a.k.a rule, consists of a set of strings
and a Boolean expression which determine its logic.}
# yara package itself is licensed as ASL 2.0
# bison grammar parsers in libyara/* are dual licensed under ASL 2.0 and GPLv3+ license.
# resulting binary package licensed as ASL 2.0
License: ASL 2.0
VCS: http://github.com/VirusTotal/yara/
# http://github.com/VirusTotal/yara/releases
URL: http://VirusTotal.github.io/yara/
%global gituser VirusTotal
%global gitname yara
# Commit of version 4.5.8
%global gitdate 20260728
%global commit 84b0e3cc0e42f8f8e6b84d19c97ec3ac6ff8aee8
# Commit of version 4.1.1
%global commit 8206dc6f728fe50e21af92cb40e454b68ef6af05
%global shortcommit %(c=%{commit}; echo ${c:0:7})
%bcond_without release
# additional module for yara
%global androguard_gituser Koodous
%global androguard_gitname androguard-yara
# Commit from 2020-04-22
%global androguard_commit 3eea86ae2c4ee6ad3cc1cb3c2711b03db078831a
%global androguard_shortcommit %(c=%{androguard_commit}; echo ${c:0:7})
%global androguard_gitdate 2020-04-22
# Build from git release version
%if %{with release}
Release: %autorelease
# Source0: https://github.com/%%{gituser}/%%{gitname}/archive/v%%{upversion}.tar.gz#/%%{name}-%%{upversion}.tar.gz
Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
%else
# Build from git commit baseline
Release: %autorelease -s %{gitdate}git%{shortcommit}
Source0: https://github.com/%{gituser}/%{gitname}/archive/%{commit}/%{name}-%{version}-git%{gitdate}-%{shortcommit}.tar.gz
%endif
#Source0: https://github.com/%%{gituser}/%%{gitname}/archive/%%{commit}/%%{name}-%%{version}-%%{shortcommit}.tar.gz
# Build from git release version
Source0: https://github.com/%{gituser}/%{gitname}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
# http://github.com/Koodous/androguard-yara/
Source1: https://github.com/%{androguard_gituser}/%{androguard_gitname}/archive/%{androguard_commit}/%{androguard_gitname}-%{androguard_gitdate}-%{androguard_shortcommit}.tar.gz
# Patch based on the androguard-yara installation guide to enable the androguard module
Patch0: yara-androguard.patch
# Use default sphix theme to generate documentation rather than sphinx_rtd_theme
# to avoid static installation of font files on fedora >= 24
Patch1: yara-docs-theme.patch
# OpenSSL 4 build fixes
Patch2: 0001-Use-OpenSSL-accessor-functions-for-ASN1_STRING.patch
# Fixed in 3.6.0 upstream
# Patch https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch
# Fixes: CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924
# Patch2: %%{name}-pull627.patch
# API of yr_re_match changed, fix needed for Androguard
# https://github.com/Koodous/androguard-yara/issues/8
# merged in https://github.com/Koodous/androguard-yara/commit/034f0a49e58d798abcaa28c9864451da9da29413
# Patch3: yara-androguard-matchapi.patch
BuildRequires: git
BuildRequires: gcc
@ -54,29 +62,30 @@ BuildRequires: binutils
BuildRequires: coreutils
BuildRequires: sharutils
BuildRequires: file
BuildRequires: sed
BuildRequires: gawk
BuildRequires: gzip
BuildRequires: xz
BuildRequires: pcre
BuildRequires: bison
BuildRequires: flex
BuildRequires: libtool
BuildRequires: file-devel
BuildRequires: jansson-devel >= 2.5
#jansson is in version 2.4 in epel
#BuildRequires: jansson-devel >= 2.5
BuildRequires: openssl-devel
BuildRequires: protobuf-c-devel
BuildRequires: protobuf-compiler
%if 0%{?rhel} && 0%{?rhel} == 7
BuildRequires: openssl11-devel
%else
BuildRequires: openssl-devel
%endif
# html doc generation
BuildRequires: /usr/bin/sphinx-build
%description
%{common_description}
YARA is a tool aimed at (but not limited to) helping malware researchers to
identify and classify malware samples. With YARA you can create descriptions
of malware families (or whatever you want to describe) based on textual or
binary patterns. Each description, a.k.a rule, consists of a set of strings
and a Boolean expression which determine its logic.
%package doc
Summary: Documentation for %{name}
@ -84,7 +93,6 @@ BuildArch: noarch
%description doc
This package contains documentation for %{name}.
%{common_description}
%package devel
@ -95,27 +103,36 @@ Requires: %{name}%{?_isa} = %{version}-%{release}
%description devel
The %{name}-devel package contains libraries and header files for
developing applications that use %{name}.
%{common_description}
%prep
%if %{with release}
%autosetup -n %{gitname}-%{version} -p 1 -S git
%else
%autosetup -n %{gitname}-%{commit} -p 1 -S git
%endif
# autosetup -n %%{gitname}-%%{commit} -p 1 -S git
%autosetup -p 1 -S git
# Add the Androguard module
# %%setup -qn %%{gitname}-%%{commit} -a 1 -D -T
%setup -q -a 1 -D -T
pushd %{androguard_gitname}-%{androguard_commit}
mkdir -p ../libyara/modules/androguard
cp -p androguard.c ../libyara/modules/androguard/
popd
autoreconf --force --install
%build
# Add missing protobuf definition on RHEL7, and also configure for the libcrypto11/openssl11 from EPEL
# Add missing definition on RHEL7
%if 0%{?rhel} && 0%{?rhel} == 7
export CFLAGS="%{optflags} -D PROTOBUF_C_FIELD_FLAG_ONEOF=4 $(pkg-config --cflags libcrypto11)"
export LDFLAGS="$LDFLAGS $(pkg-config --libs libcrypto11)"
export CFLAGS="$CFLAGS -D PROTOBUF_C_FIELD_FLAG_ONEOF=4"
%endif
# macro %%configure already does use CFLAGS="%%{optflags}" and yara build
# macro %%configure already does use CFLAGS="\{optflags}" and yara build
# scripts configure/make already honors that CFLAGS
%configure --enable-magic --enable-cuckoo --enable-debug --enable-dotnet \
# jansson >= 2.5 not available in EPEL7 thus building without cuckoo support
%configure --enable-magic --enable-debug --enable-dotnet \
--enable-macho --enable-dex --enable-pb-tests \
--with-crypto \
--htmldir=%{_datadir}/doc/%{name}/html
@ -142,28 +159,6 @@ rm -f %{buildroot}%{_datadir}/doc/%{name}/html/.buildinfo
%ldconfig_scriptlets
%endif
%check
# reenable the validation of SHA1 certificates in OPENSSL (RHEL9 disabled that by default)
export OPENSSL_ENABLE_SHA1_SIGNATURES=yes
make check || (
# print more verbose info in case the test(s) fail
echo "===== ./test-suite.log"
[ -f ./test-suite.log ] && cat ./test-suite.log
# Build in COPR lacking the hwinfo.log
echo "===== /proc/cpu"
head -n 35 /proc/cpuinfo
echo "===== /etc/os-release"
cat /etc/os-release
echo "===== uname -a"
uname -a
%ifarch s390x
# test-pe and test-dotnet fails for x390x at this point - ignored for rc1
true
%else
false
%endif
)
%files
%license COPYING
@ -188,4 +183,158 @@ make check || (
%changelog
%autochangelog
* Wed Nov 10 2021 Michal Ambroz <rebus at, seznam.cz> - 4.1.3-1
- bump to 4.1.3
* Sat Nov 06 2021 Adrian Reber <adrian@lisas.de> - 4.1.1-5
- Rebuilt for protobuf 3.19.0
* Mon Oct 25 2021 Adrian Reber <adrian@lisas.de> - 4.1.1-4
- Rebuilt for protobuf 3.18.1
* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 4.1.1-3
- Rebuilt with OpenSSL 3.0.0
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.1.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
* Mon May 24 2021 Michal Ambroz <rebus at, seznam.cz> - 4.1.1-1
- bump to 4.1.1
* Mon Apr 26 2021 Michal Ambroz <rebus at, seznam.cz> - 4.1.0-1
- bump to 4.1.0
* Sun Apr 25 2021 Michal Ambroz <rebus at, seznam.cz> - 4.0.5-2
- rebuild for epel
* Fri Feb 5 2021 Michal Ambroz <rebus at, seznam.cz> - 4.0.5-1
- bump to yara bugfix 4.0.5 release
* Wed Feb 3 2021 Michal Ambroz <rebus at, seznam.cz> - 4.0.4-1
- bump to yara bugfix 4.0.4 release
* Thu Jul 16 2020 Michal Ambroz <rebus at, seznam.cz> - 4.0.2-1
- bump to yara bugfix 4.0.2 release
- fix build on epel7
* Sun Jun 14 2020 Adrian Reber <adrian@lisas.de> - 4.0.1-2
- Rebuilt for protobuf 3.12
* Tue Jun 2 2020 Michal Ambroz <rebus at, seznam.cz> - 4.0.1-1
- bump to yara bugfix 4.0.1 release
* Tue Apr 28 2020 Michal Ambroz <rebus at, seznam.cz> - 4.0.0-1
- bump to yara 4.0.0 release
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.11.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Oct 11 2019 Michal Ambroz <rebus at, seznam.cz> - 3.11.0-1
- bump to 3.11.0 release (#1760678)
- BUGFIX: Some regexp character classes not matching correctly when used with “nocase” modifier (upstream #1117)
- BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors for certain hex pattern containing large jumps (upstream #1107)
- BUGFIX: Buffer overrun in “dotnet” module (upstream #1108)
- BUGFIX: Memory leak while attaching to a process fails (upstream #1070)
* Sat Sep 28 2019 Michal Ambroz <rebus at, seznam.cz> - 3.10.0-3
- change the sphinx build dependency
* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.10.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Fri May 03 2019 Michal Ambroz <rebus at, seznam.cz> - 3.10.0-1
- bump to 3.10.0 release (#1680204)
- Harden virtual machine against malicious code.
- BUGFIX: Regression bug in hex strings containing wildcards (upstream #1025).
- BUGFIX: Buffer overrun in “elf” module.
- BUGFIX: Buffer overrun in “dotnet” module.
* Sat Mar 16 2019 Michal Ambroz <rebus at, seznam.cz> - 3.9.0-1
- bump to 3.9.0 release (#1680203)
- switch from python-sphinx to python3-sphinx for generating the documentation for fc31+
- should fix also #1660398 (CVE-2018-19974 CVE-2018-19975 CVE-2018-19976),
but by design it might be always dangerous to run yara signatures compiled by 3rd party,
so it is advised to re-compile yara rules instead
- BUGFIX: Denial of service when using "dex" module. Found by the Cisco Talos team. (upstream #1023, CVE-2019-5020)
- BUGFIX: Buffer overflow in "dotnet" module.
- BUGFIX: Regexp regression when using nested quantifiers {x,y} for certain values of x and y. (#1018)
* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.8.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Mon Aug 27 2018 Michal Ambroz <rebus at, seznam.cz> - 3.8.1-1
- bump to 3.8.1 release (#1613093)
* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.7.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.7.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Mon Feb 05 2018 Michal Ambroz <rebus at, seznam.cz> - 3.7.1-1
- bump to 3.7.1 release (#1534993)
* Wed Nov 15 2017 Michal Ambroz <rebus at, seznam.cz> - 3.7.0-1
- bump to 3.7.0 release (#1511921)
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.3-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.3-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Sun Jul 16 2017 Michal Ambroz <rebus at, seznam.cz> - 3.6.3-1
- bump to 3.6.3 release - bugfix CVE-2017-11328
* Mon Jul 03 2017 Michal Ambroz <rebus at, seznam.cz> - 3.6.2-1
- bump to 3.6.2 release - bugfix CVE-2017-9304, CVE-2017-9465
* Wed May 24 2017 Michal Ambroz <rebus at, seznam.cz> - 3.6.0-1
- bump to 3.6.0 release
- update the androguard-yara with bugfixes
* Thu Apr 13 2017 Michal Ambroz <rebus at, seznam.cz> - 3.5.0-7
- Adding patch from pull request 627 until 3.5.1 is released
- https://patch-diff.githubusercontent.com/raw/VirusTotal/yara/pull/627.patch
- Fixes CVE-2016-10210 CVE-2016-10211 CVE-2017-5923 CVE-2017-5924
* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.5.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Tue Aug 09 2016 Michal Ambroz <rebus at, seznam.cz> - 3.5.0-5
- import package to Fedora
- remove unnecessary .buildinfo tag from doc package
* Fri Aug 05 2016 Michal Ambroz <rebus at, seznam.cz> - 3.5.0-4
- package review - bugzilla #1362265
- cosmetics of the changelog
- using default spinx theme to remove the static fonts
* Fri Aug 05 2016 Michal Ambroz <rebus at, seznam.cz> - 3.5.0-3
- package review - bugzilla #1362265
- dropped Buildroot, pkgconfig, zlib-devel, defattr
- added buildrequires gcc
- change license back to ASL 2.0 only
* Thu Aug 04 2016 Michal Ambroz <rebus at, seznam.cz> - 3.5.0-2
- package review - bugzilla #1362265
- changed packaging of doc sub-package
* Thu Aug 04 2016 Michal Ambroz <rebus at, seznam.cz> - 3.5.0-1
- bump to new 3.5.0
* Wed Aug 03 2016 Michal Ambroz <rebus at, seznam.cz> - 3.4.0-6
- package review - bugzilla #1362265
- dropped dependency of python-tools
* Mon Aug 01 2016 Michal Ambroz <rebus at, seznam.cz> - 3.4.0-4
- compile with the androguard module
* Wed Jun 08 2016 Michal Ambroz <rebus at, seznam.cz> - 3.4.0-2
- jansson dependency >= 2.5
* Wed Jun 08 2016 Michal Ambroz <rebus at, seznam.cz> - 3.4.0-1
- python3 stuff
* Mon Jun 22 2015 Michal Ambroz <rebus at, seznam.cz> - 3.4.0-0.git20150618
- initial build for Fedora Project