rpms/zarafa
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Backported patch from Debian to fix CVE-2022-26562 (#2192126)

Browse source
This commit is contained in:
Robert Scheck 2023-04-30 00:02:38 +02:00
commit a5a8366ccf
2 changed files with 47 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

41
zarafa-7.1.14-pam_acct_mgmt.patch Normal file
View file

@ -0,0 +1,41 @@
Patch by Robert Scheck <robert@fedoraproject.org> for Zarafa <= 7.1.14 which backports the security fix
by Andreas Rönnquist <gusnan@librem.one> for Kopano Core <= 11.0.2.51 (for Debian). It fixes a security
issue which allows attackers to authenticate even if the user account or password is expired. See also:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26562
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1016973
- https://jira.kopano.io/browse/KC-2021
- https://github.com/Kopano-dev/kopano-core/blob/master/provider/libserver/ECKrbAuth.cpp#L137
- https://bugzilla.redhat.com/show_bug.cgi?id=2192126
The security flaw was introduced between Zarafa 6.30.0 RC 1e (Subversion Revision 14802) and 6.30.8 Final
(Subversion Revision 18345) in provider/libserver/ECPamAuth.cpp and also affects Kopano Core <= 11.0.2.51
in provider/libserver/ECKrbAuth.cpp.
--- zarafa-7.1.14/provider/libserver/ECPamAuth.cpp 2015-10-20 11:13:45.000000000 +0200
+++ zarafa-7.1.14/provider/libserver/ECPamAuth.cpp.pam_acct_mgmt 2023-02-09 19:53:11.843375272 +0200
@@ -111,14 +111,21 @@
}
res = pam_authenticate(pamh, PAM_SILENT);
-
- pam_end(pamh, res);
-
if (res != PAM_SUCCESS) {
*lpstrError = pam_strerror(NULL, res);
+ pam_end(pamh, res);
er = ZARAFA_E_LOGON_FAILED;
}
+ res = pam_acct_mgmt(pamh, PAM_SILENT);
+ if (res != PAM_SUCCESS) {
+ *lpstrError = pam_strerror(NULL, res);
+ pam_end(pamh, res);
+ er = ZARAFA_E_LOGON_FAILED;
+ }
+
+ pam_end(pamh, res);
+
exit:
pthread_mutex_unlock(&cPAMLock.m_mPAMAuthLock);

7
zarafa.spec
View file

@ -1,5 +1,5 @@
%global beta_or_rc 0
%global actual_release 5
%global actual_release 6
%global svnrevision 51822
%global with_search 1
%global with_ldap 1
@ -76,6 +76,7 @@ Patch19: https://raw.githubusercontent.com/robert-scheck/zarafa-patch
Patch20: https://raw.githubusercontent.com/robert-scheck/zarafa-patches/main/zarafa-7.1.14-libical3.patch
Patch21: https://raw.githubusercontent.com/robert-scheck/zarafa-patches/main/zarafa-7.1.14-ical-remote-dos.patch
Patch22: https://raw.githubusercontent.com/robert-scheck/zarafa-patches/main/zarafa-7.1.14-ical-remote-dos2.patch
Patch23: https://raw.githubusercontent.com/robert-scheck/zarafa-patches/main/zarafa-7.1.14-pam_acct_mgmt.patch
BuildRequires: bison
BuildRequires: gcc-c++
@ -428,6 +429,7 @@ rm -f php-webclient-ajax/{.,*,*/*,*/*/*/*}/*.webaccess-*
%patch20 -p1 -b .libical3
%patch21 -p1 -b .ical-remote-dos
%patch22 -p1 -b .ical-remote-dos2
%patch23 -p1 -b .pam_acct_mgmt
%build
%if 0%{?rhel}%{?fedora} < 6
@ -971,6 +973,9 @@ fi
%{python_sitearch}/*
%changelog
* Sun Apr 30 2023 Robert Scheck <robert@fedoraproject.org> 7.1.14-6
- Backported patch from Debian to fix CVE-2022-26562 (#2192126)
* Sun Apr 25 2021 Robert Scheck <robert@fedoraproject.org> 7.1.14-5
- Added upstream patch to fix remote DoS in zarafa-ical (#1953242)