* [OE-core][scarthgap][PATCH v2 2/5] libsoup: Fix CVE-2025-32909
2025-04-17 10:42 [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910 vanusuri
@ 2025-04-17 10:42 ` vanusuri
2025-04-17 10:42 ` [OE-core][scarthgap][PATCH v2 3/5] libsoup: Fix CVE-2025-32911 & CVE-2025-32913 vanusuri
` (3 subsequent siblings)
4 siblings, 0 replies; 10+ messages in thread
From: vanusuri @ 2025-04-17 10:42 UTC (permalink / raw)
To: openembedded-core; +Cc: Vijay Anusuri
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/ba4c3a6f988beff59e45801ab36067293d24ce92
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
.../libsoup-3.4.4/CVE-2025-32909.patch | 36 +++++++++++++++++++
meta/recipes-support/libsoup/libsoup_3.4.4.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32909.patch
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32909.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32909.patch
new file mode 100644
index 0000000000..8982da58f1
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32909.patch
@@ -0,0 +1,36 @@
+From ba4c3a6f988beff59e45801ab36067293d24ce92 Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Wed, 8 Jan 2025 16:30:17 -0600
+Subject: [PATCH] content-sniffer: Handle sniffing resource shorter than 4
+ bytes
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/ba4c3a6f988beff59e45801ab36067293d24ce92]
+CVE: CVE-2025-32909
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/content-sniffer/soup-content-sniffer.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/libsoup/content-sniffer/soup-content-sniffer.c b/libsoup/content-sniffer/soup-content-sniffer.c
+index 5a181ff1..aeee2e25 100644
+--- a/libsoup/content-sniffer/soup-content-sniffer.c
++++ b/libsoup/content-sniffer/soup-content-sniffer.c
+@@ -243,9 +243,14 @@ sniff_mp4 (SoupContentSniffer *sniffer, GBytes *buffer)
+ gsize resource_length;
+ const char *resource = g_bytes_get_data (buffer, &resource_length);
+ resource_length = MIN (512, resource_length);
+- guint32 box_size = *((guint32*)resource);
++ guint32 box_size;
+ guint i;
+
++ if (resource_length < sizeof (guint32))
++ return FALSE;
++
++ box_size = *((guint32*)resource);
++
+ #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+ box_size = ((box_size >> 24) |
+ ((box_size << 8) & 0x00FF0000) |
+--
+GitLab
+
diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
index 757e6432f7..ec3305aed7 100644
--- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
@@ -19,6 +19,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2024-52531-2.patch \
file://CVE-2024-52531-3.patch \
file://CVE-2025-32910.patch \
+ file://CVE-2025-32909.patch \
"
SRC_URI[sha256sum] = "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"
--
2.25.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* [OE-core][scarthgap][PATCH v2 3/5] libsoup: Fix CVE-2025-32911 & CVE-2025-32913
2025-04-17 10:42 [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910 vanusuri
2025-04-17 10:42 ` [OE-core][scarthgap][PATCH v2 2/5] libsoup: Fix CVE-2025-32909 vanusuri
@ 2025-04-17 10:42 ` vanusuri
2025-04-17 10:42 ` [OE-core][scarthgap][PATCH v2 4/5] libsoup: Fix CVE-2025-32912 vanusuri
` (2 subsequent siblings)
4 siblings, 0 replies; 10+ messages in thread
From: vanusuri @ 2025-04-17 10:42 UTC (permalink / raw)
To: openembedded-core; +Cc: Vijay Anusuri
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from
https://gitlab.gnome.org/GNOME/libsoup/-/commit/7b4ef0e004ece3a308ccfaa714c284f4c96ade34
& https://gitlab.gnome.org/GNOME/libsoup/-/commit/f4a761fb66512fff59798765e8ac5b9e57dceef0
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
.../CVE-2025-32911_CVE-2025-32913-1.patch | 72 +++++++++++++++++++
.../CVE-2025-32911_CVE-2025-32913-2.patch | 44 ++++++++++++
meta/recipes-support/libsoup/libsoup_3.4.4.bb | 2 +
3 files changed, 118 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-1.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-2.patch
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-1.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-1.patch
new file mode 100644
index 0000000000..4e1d8212f5
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-1.patch
@@ -0,0 +1,72 @@
+From 7b4ef0e004ece3a308ccfaa714c284f4c96ade34 Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Fri, 27 Dec 2024 17:53:50 -0600
+Subject: [PATCH] soup_message_headers_get_content_disposition: Fix NULL deref
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/7b4ef0e004ece3a308ccfaa714c284f4c96ade34]
+CVE: CVE-2025-32911 CVE-2025-32913 #Dependency Patch
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/soup-message-headers.c | 13 +++++++++----
+ tests/header-parsing-test.c | 14 ++++++++++++++
+ 2 files changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
+index 56cc1e9d..04f4c302 100644
+--- a/libsoup/soup-message-headers.c
++++ b/libsoup/soup-message-headers.c
+@@ -1660,10 +1660,15 @@ soup_message_headers_get_content_disposition (SoupMessageHeaders *hdrs,
+ */
+ if (params && g_hash_table_lookup_extended (*params, "filename",
+ &orig_key, &orig_value)) {
+- char *filename = strrchr (orig_value, '/');
+-
+- if (filename)
+- g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
++ if (orig_value) {
++ char *filename = strrchr (orig_value, '/');
++
++ if (filename)
++ g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
++ } else {
++ /* filename with no value isn't valid. */
++ g_hash_table_remove (*params, "filename");
++ }
+ }
+ return TRUE;
+ }
+diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
+index 5e423d2b..d0b360c8 100644
+--- a/tests/header-parsing-test.c
++++ b/tests/header-parsing-test.c
+@@ -1039,6 +1039,7 @@ do_param_list_tests (void)
+ #define RFC5987_TEST_HEADER_FALLBACK "attachment; filename*=Unknown''t%FF%FF%FFst.txt; filename=\"test.txt\""
+ #define RFC5987_TEST_HEADER_NO_TYPE "filename=\"test.txt\""
+ #define RFC5987_TEST_HEADER_NO_TYPE_2 "filename=\"test.txt\"; foo=bar"
++#define RFC5987_TEST_HEADER_EMPTY_FILENAME ";filename"
+
+ static void
+ do_content_disposition_tests (void)
+@@ -1139,6 +1140,19 @@ do_content_disposition_tests (void)
+ g_assert_cmpstr (parameter2, ==, "bar");
+ g_hash_table_destroy (params);
+
++ /* Empty filename */
++ soup_message_headers_clear (hdrs);
++ soup_message_headers_append (hdrs, "Content-Disposition",
++ RFC5987_TEST_HEADER_EMPTY_FILENAME);
++ if (!soup_message_headers_get_content_disposition (hdrs,
++ &disposition,
++ ¶ms)) {
++ soup_test_assert (FALSE, "empty filename decoding FAILED");
++ return;
++ }
++ g_assert_false (g_hash_table_contains (params, "filename"));
++ g_hash_table_destroy (params);
++
+ soup_message_headers_unref (hdrs);
+
+ /* Ensure that soup-multipart always quotes filename */
+--
+GitLab
+
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-2.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-2.patch
new file mode 100644
index 0000000000..5d9f33c736
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32911_CVE-2025-32913-2.patch
@@ -0,0 +1,44 @@
+From f4a761fb66512fff59798765e8ac5b9e57dceef0 Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Fri, 27 Dec 2024 18:00:39 -0600
+Subject: [PATCH] soup_message_headers_get_content_disposition: strdup
+ truncated filenames
+
+This table frees the strings it contains.
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/f4a761fb66512fff59798765e8ac5b9e57dceef0]
+CVE: CVE-2025-32911 CVE-2025-32913
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/soup-message-headers.c | 2 +-
+ tests/header-parsing-test.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/libsoup/soup-message-headers.c b/libsoup/soup-message-headers.c
+index 04f4c302..ee7a3cb1 100644
+--- a/libsoup/soup-message-headers.c
++++ b/libsoup/soup-message-headers.c
+@@ -1664,7 +1664,7 @@ soup_message_headers_get_content_disposition (SoupMessageHeaders *hdrs,
+ char *filename = strrchr (orig_value, '/');
+
+ if (filename)
+- g_hash_table_insert (*params, g_strdup (orig_key), filename + 1);
++ g_hash_table_insert (*params, g_strdup (orig_key), g_strdup (filename + 1));
+ } else {
+ /* filename with no value isn't valid. */
+ g_hash_table_remove (*params, "filename");
+diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
+index d0b360c8..07ea2866 100644
+--- a/tests/header-parsing-test.c
++++ b/tests/header-parsing-test.c
+@@ -1150,6 +1150,7 @@ do_content_disposition_tests (void)
+ soup_test_assert (FALSE, "empty filename decoding FAILED");
+ return;
+ }
++ g_free (disposition);
+ g_assert_false (g_hash_table_contains (params, "filename"));
+ g_hash_table_destroy (params);
+
+--
+GitLab
+
diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
index ec3305aed7..a70ef87ee0 100644
--- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
@@ -20,6 +20,8 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2024-52531-3.patch \
file://CVE-2025-32910.patch \
file://CVE-2025-32909.patch \
+ file://CVE-2025-32911_CVE-2025-32913-1.patch \
+ file://CVE-2025-32911_CVE-2025-32913-2.patch \
"
SRC_URI[sha256sum] = "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"
--
2.25.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* [OE-core][scarthgap][PATCH v2 4/5] libsoup: Fix CVE-2025-32912
2025-04-17 10:42 [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910 vanusuri
2025-04-17 10:42 ` [OE-core][scarthgap][PATCH v2 2/5] libsoup: Fix CVE-2025-32909 vanusuri
2025-04-17 10:42 ` [OE-core][scarthgap][PATCH v2 3/5] libsoup: Fix CVE-2025-32911 & CVE-2025-32913 vanusuri
@ 2025-04-17 10:42 ` vanusuri
2025-04-17 10:42 ` [OE-core][scarthgap][PATCH v2 5/5] libsoup: Fix CVE-2025-32906 vanusuri
2025-04-17 11:15 ` [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910 Gyorgy Sarvari
4 siblings, 0 replies; 10+ messages in thread
From: vanusuri @ 2025-04-17 10:42 UTC (permalink / raw)
To: openembedded-core; +Cc: Vijay Anusuri
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from
https://gitlab.gnome.org/GNOME/libsoup/-/commit/e40df6d48a1cbab56f5d15016cc861a503423cfe
&
https://gitlab.gnome.org/GNOME/libsoup/-/commit/405a8a34597a44bd58c4759e7d5e23f02c3b556a
&
https://gitlab.gnome.org/GNOME/libsoup/-/commit/cd077513f267e43ce4b659eb18a1734d8a369992
& https://gitlab.gnome.org/GNOME/libsoup/-/commit/910ebdcd3dd82386717a201c13c834f3a63eed7f
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
.../libsoup-3.4.4/CVE-2025-32912-1.patch | 98 ++++++++++++
.../libsoup-3.4.4/CVE-2025-32912-2.patch | 149 ++++++++++++++++++
.../libsoup-3.4.4/CVE-2025-32912-3.patch | 41 +++++
.../libsoup-3.4.4/CVE-2025-32912-4.patch | 30 ++++
meta/recipes-support/libsoup/libsoup_3.4.4.bb | 4 +
5 files changed, 322 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-1.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-2.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-3.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-4.patch
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-1.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-1.patch
new file mode 100644
index 0000000000..311f3020b8
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-1.patch
@@ -0,0 +1,98 @@
+From e40df6d48a1cbab56f5d15016cc861a503423cfe Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Sun, 8 Dec 2024 20:00:35 -0600
+Subject: [PATCH] auth-digest: Handle missing realm in authenticate header
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/e40df6d48a1cbab56f5d15016cc861a503423cfe]
+CVE: CVE-2025-32912 #Dependency Patch1
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/auth/soup-auth-digest.c | 3 ++
+ tests/auth-test.c | 50 +++++++++++++++++++++++++++++++++
+ 2 files changed, 53 insertions(+)
+
+diff --git a/libsoup/auth/soup-auth-digest.c b/libsoup/auth/soup-auth-digest.c
+index 2e81849af..4f12e87a5 100644
+--- a/libsoup/auth/soup-auth-digest.c
++++ b/libsoup/auth/soup-auth-digest.c
+@@ -148,6 +148,9 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
+ guint qop_options;
+ gboolean ok = TRUE;
+
++ if (!soup_auth_get_realm (auth))
++ return FALSE;
++
+ g_free (priv->domain);
+ g_free (priv->nonce);
+ g_free (priv->opaque);
+diff --git a/tests/auth-test.c b/tests/auth-test.c
+index 158fdac10..3066e904a 100644
+--- a/tests/auth-test.c
++++ b/tests/auth-test.c
+@@ -1866,6 +1866,55 @@ do_multiple_digest_algorithms (void)
+ soup_test_server_quit_unref (server);
+ }
+
++static void
++on_request_read_for_missing_realm (SoupServer *server,
++ SoupServerMessage *msg,
++ gpointer user_data)
++{
++ SoupMessageHeaders *response_headers = soup_server_message_get_response_headers (msg);
++ soup_message_headers_replace (response_headers, "WWW-Authenticate", "Digest qop=\"auth\"");
++}
++
++static void
++do_missing_realm_test (void)
++{
++ SoupSession *session;
++ SoupMessage *msg;
++ SoupServer *server;
++ SoupAuthDomain *digest_auth_domain;
++ gint status;
++ GUri *uri;
++
++ server = soup_test_server_new (SOUP_TEST_SERVER_IN_THREAD);
++ soup_server_add_handler (server, NULL,
++ server_callback, NULL, NULL);
++ uri = soup_test_server_get_uri (server, "http", NULL);
++
++ digest_auth_domain = soup_auth_domain_digest_new (
++ "realm", "auth-test",
++ "auth-callback", server_digest_auth_callback,
++ NULL);
++ soup_auth_domain_add_path (digest_auth_domain, "/");
++ soup_server_add_auth_domain (server, digest_auth_domain);
++ g_object_unref (digest_auth_domain);
++
++ g_signal_connect (server, "request-read",
++ G_CALLBACK (on_request_read_for_missing_realm),
++ NULL);
++
++ session = soup_test_session_new (NULL);
++ msg = soup_message_new_from_uri ("GET", uri);
++ g_signal_connect (msg, "authenticate",
++ G_CALLBACK (on_digest_authenticate),
++ NULL);
++
++ status = soup_test_session_send_message (session, msg);
++
++ g_assert_cmpint (status, ==, SOUP_STATUS_UNAUTHORIZED);
++ g_uri_unref (uri);
++ soup_test_server_quit_unref (server);
++}
++
+ int
+ main (int argc, char **argv)
+ {
+@@ -1899,6 +1948,7 @@ main (int argc, char **argv)
+ g_test_add_func ("/auth/auth-uri", do_auth_uri_test);
+ g_test_add_func ("/auth/cancel-request-on-authenticate", do_cancel_request_on_authenticate);
+ g_test_add_func ("/auth/multiple-algorithms", do_multiple_digest_algorithms);
++ g_test_add_func ("/auth/missing-realm", do_missing_realm_test);
+
+ ret = g_test_run ();
+
+--
+GitLab
+
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-2.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-2.patch
new file mode 100644
index 0000000000..5809e178d1
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-2.patch
@@ -0,0 +1,149 @@
+From 405a8a34597a44bd58c4759e7d5e23f02c3b556a Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Thu, 26 Dec 2024 18:18:35 -0600
+Subject: [PATCH] auth-digest: Handle missing nonce
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/405a8a34597a44bd58c4759e7d5e23f02c3b556a]
+CVE: CVE-2025-32912 #Dependency Patch2
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/auth/soup-auth-digest.c | 45 +++++++++++++++++++++++++--------
+ tests/auth-test.c | 19 ++++++++------
+ 2 files changed, 46 insertions(+), 18 deletions(-)
+
+diff --git a/libsoup/auth/soup-auth-digest.c b/libsoup/auth/soup-auth-digest.c
+index 4f12e87a..350bfde6 100644
+--- a/libsoup/auth/soup-auth-digest.c
++++ b/libsoup/auth/soup-auth-digest.c
+@@ -138,6 +138,19 @@ soup_auth_digest_get_qop (SoupAuthDigestQop qop)
+ return g_string_free (out, FALSE);
+ }
+
++static gboolean
++validate_params (SoupAuthDigest *auth_digest)
++{
++ SoupAuthDigestPrivate *priv = soup_auth_digest_get_instance_private (auth_digest);
++
++ if (priv->qop || priv->algorithm == SOUP_AUTH_DIGEST_ALGORITHM_MD5_SESS) {
++ if (!priv->nonce)
++ return FALSE;
++ }
++
++ return TRUE;
++}
++
+ static gboolean
+ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
+ GHashTable *auth_params)
+@@ -175,16 +188,21 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
+ if (priv->algorithm == -1)
+ ok = FALSE;
+
+- stale = g_hash_table_lookup (auth_params, "stale");
+- if (stale && !g_ascii_strcasecmp (stale, "TRUE") && *priv->hex_urp)
+- recompute_hex_a1 (priv);
+- else {
+- g_free (priv->user);
+- priv->user = NULL;
+- g_free (priv->cnonce);
+- priv->cnonce = NULL;
+- memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
+- memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
++ if (!validate_params (auth_digest))
++ ok = FALSE;
++
++ if (ok) {
++ stale = g_hash_table_lookup (auth_params, "stale");
++ if (stale && !g_ascii_strcasecmp (stale, "TRUE") && *priv->hex_urp)
++ recompute_hex_a1 (priv);
++ else {
++ g_free (priv->user);
++ priv->user = NULL;
++ g_free (priv->cnonce);
++ priv->cnonce = NULL;
++ memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
++ memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
++ }
+ }
+
+ return ok;
+@@ -276,6 +294,8 @@ soup_auth_digest_compute_hex_a1 (const char *hex_urp,
+
+ /* In MD5-sess, A1 is hex_urp:nonce:cnonce */
+
++ g_assert (nonce && cnonce);
++
+ checksum = g_checksum_new (G_CHECKSUM_MD5);
+ g_checksum_update (checksum, (guchar *)hex_urp, strlen (hex_urp));
+ g_checksum_update (checksum, (guchar *)":", 1);
+@@ -366,6 +386,8 @@ soup_auth_digest_compute_response (const char *method,
+ if (qop) {
+ char tmp[9];
+
++ g_assert (cnonce);
++
+ g_snprintf (tmp, 9, "%.8x", nc);
+ g_checksum_update (checksum, (guchar *)tmp, strlen (tmp));
+ g_checksum_update (checksum, (guchar *)":", 1);
+@@ -429,6 +451,9 @@ soup_auth_digest_get_authorization (SoupAuth *auth, SoupMessage *msg)
+ g_return_val_if_fail (uri != NULL, NULL);
+ url = soup_uri_get_path_and_query (uri);
+
++ g_assert (priv->nonce);
++ g_assert (!priv->qop || priv->cnonce);
++
+ soup_auth_digest_compute_response (soup_message_get_method (msg), url, priv->hex_a1,
+ priv->qop, priv->nonce,
+ priv->cnonce, priv->nc,
+diff --git a/tests/auth-test.c b/tests/auth-test.c
+index 3066e904..c651c7cd 100644
+--- a/tests/auth-test.c
++++ b/tests/auth-test.c
+@@ -1867,16 +1867,17 @@ do_multiple_digest_algorithms (void)
+ }
+
+ static void
+-on_request_read_for_missing_realm (SoupServer *server,
+- SoupServerMessage *msg,
+- gpointer user_data)
++on_request_read_for_missing_params (SoupServer *server,
++ SoupServerMessage *msg,
++ gpointer user_data)
+ {
++ const char *auth_header = user_data;
+ SoupMessageHeaders *response_headers = soup_server_message_get_response_headers (msg);
+- soup_message_headers_replace (response_headers, "WWW-Authenticate", "Digest qop=\"auth\"");
++ soup_message_headers_replace (response_headers, "WWW-Authenticate", auth_header);
+ }
+
+ static void
+-do_missing_realm_test (void)
++do_missing_params_test (gconstpointer auth_header)
+ {
+ SoupSession *session;
+ SoupMessage *msg;
+@@ -1899,8 +1900,8 @@ do_missing_realm_test (void)
+ g_object_unref (digest_auth_domain);
+
+ g_signal_connect (server, "request-read",
+- G_CALLBACK (on_request_read_for_missing_realm),
+- NULL);
++ G_CALLBACK (on_request_read_for_missing_params),
++ (gpointer)auth_header);
+
+ session = soup_test_session_new (NULL);
+ msg = soup_message_new_from_uri ("GET", uri);
+@@ -1948,7 +1949,9 @@ main (int argc, char **argv)
+ g_test_add_func ("/auth/auth-uri", do_auth_uri_test);
+ g_test_add_func ("/auth/cancel-request-on-authenticate", do_cancel_request_on_authenticate);
+ g_test_add_func ("/auth/multiple-algorithms", do_multiple_digest_algorithms);
+- g_test_add_func ("/auth/missing-realm", do_missing_realm_test);
++ g_test_add_data_func ("/auth/missing-params/realm", "Digest qop=\"auth\"", do_missing_params_test);
++ g_test_add_data_func ("/auth/missing-params/nonce", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\"", do_missing_params_test);
++ g_test_add_data_func ("/auth/missing-params/nonce-md5-sess", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\" algorithm=\"MD5-sess\"", do_missing_params_test);
+
+ ret = g_test_run ();
+
+--
+GitLab
+
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-3.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-3.patch
new file mode 100644
index 0000000000..c35c599502
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-3.patch
@@ -0,0 +1,41 @@
+From cd077513f267e43ce4b659eb18a1734d8a369992 Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Wed, 5 Feb 2025 14:03:05 -0600
+Subject: [PATCH] auth-digest: Handle missing nonce
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/cd077513f267e43ce4b659eb18a1734d8a369992]
+CVE: CVE-2025-32912
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/auth/soup-auth-digest.c | 2 +-
+ tests/auth-test.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/libsoup/auth/soup-auth-digest.c b/libsoup/auth/soup-auth-digest.c
+index 9eb7fa0e..d69a4013 100644
+--- a/libsoup/auth/soup-auth-digest.c
++++ b/libsoup/auth/soup-auth-digest.c
+@@ -162,7 +162,7 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
+ guint qop_options;
+ gboolean ok = TRUE;
+
+- if (!soup_auth_get_realm (auth))
++ if (!soup_auth_get_realm (auth) || !g_hash_table_contains (auth_params, "nonce"))
+ return FALSE;
+
+ g_free (priv->domain);
+diff --git a/tests/auth-test.c b/tests/auth-test.c
+index c651c7cd..484097f1 100644
+--- a/tests/auth-test.c
++++ b/tests/auth-test.c
+@@ -1952,6 +1952,7 @@ main (int argc, char **argv)
+ g_test_add_data_func ("/auth/missing-params/realm", "Digest qop=\"auth\"", do_missing_params_test);
+ g_test_add_data_func ("/auth/missing-params/nonce", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\"", do_missing_params_test);
+ g_test_add_data_func ("/auth/missing-params/nonce-md5-sess", "Digest realm=\"auth-test\", qop=\"auth,auth-int\", opaque=\"5ccc069c403ebaf9f0171e9517f40e41\" algorithm=\"MD5-sess\"", do_missing_params_test);
++ g_test_add_data_func ("/auth/missing-params/nonce-and-qop", "Digest realm=\"auth-test\"", do_missing_params_test);
+
+ ret = g_test_run ();
+
+--
+GitLab
+
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-4.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-4.patch
new file mode 100644
index 0000000000..ad6f3a8028
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32912-4.patch
@@ -0,0 +1,30 @@
+From 910ebdcd3dd82386717a201c13c834f3a63eed7f Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Sat, 8 Feb 2025 12:30:13 -0600
+Subject: [PATCH] digest-auth: Handle NULL nonce
+
+`contains` only handles a missing nonce, `lookup` handles both missing and empty.
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/910ebdcd3dd82386717a201c13c834f3a63eed7f]
+CVE: CVE-2025-32912
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/auth/soup-auth-digest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libsoup/auth/soup-auth-digest.c b/libsoup/auth/soup-auth-digest.c
+index d69a4013..dc4dbfc5 100644
+--- a/libsoup/auth/soup-auth-digest.c
++++ b/libsoup/auth/soup-auth-digest.c
+@@ -162,7 +162,7 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg,
+ guint qop_options;
+ gboolean ok = TRUE;
+
+- if (!soup_auth_get_realm (auth) || !g_hash_table_contains (auth_params, "nonce"))
++ if (!soup_auth_get_realm (auth) || !g_hash_table_lookup (auth_params, "nonce"))
+ return FALSE;
+
+ g_free (priv->domain);
+--
+GitLab
+
diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
index a70ef87ee0..2db854baa4 100644
--- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
@@ -22,6 +22,10 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32909.patch \
file://CVE-2025-32911_CVE-2025-32913-1.patch \
file://CVE-2025-32911_CVE-2025-32913-2.patch \
+ file://CVE-2025-32912-1.patch \
+ file://CVE-2025-32912-2.patch \
+ file://CVE-2025-32912-3.patch \
+ file://CVE-2025-32912-4.patch \
"
SRC_URI[sha256sum] = "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"
--
2.25.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* [OE-core][scarthgap][PATCH v2 5/5] libsoup: Fix CVE-2025-32906
2025-04-17 10:42 [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910 vanusuri
` (2 preceding siblings ...)
2025-04-17 10:42 ` [OE-core][scarthgap][PATCH v2 4/5] libsoup: Fix CVE-2025-32912 vanusuri
@ 2025-04-17 10:42 ` vanusuri
2025-04-17 11:15 ` [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910 Gyorgy Sarvari
4 siblings, 0 replies; 10+ messages in thread
From: vanusuri @ 2025-04-17 10:42 UTC (permalink / raw)
To: openembedded-core; +Cc: Vijay Anusuri
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from
https://gitlab.gnome.org/GNOME/libsoup/-/commit/1f509f31b6f8420a3661c3f990424ab7b9164931
& https://gitlab.gnome.org/GNOME/libsoup/-/commit/af5b9a4a3945c52b940d5ac181ef51bb12011f1f
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
.../libsoup-3.4.4/CVE-2025-32906-1.patch | 61 ++++++++++++++
.../libsoup-3.4.4/CVE-2025-32906-2.patch | 83 +++++++++++++++++++
meta/recipes-support/libsoup/libsoup_3.4.4.bb | 2 +
3 files changed, 146 insertions(+)
create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32906-1.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32906-2.patch
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32906-1.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32906-1.patch
new file mode 100644
index 0000000000..916a41a71f
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32906-1.patch
@@ -0,0 +1,61 @@
+From 1f509f31b6f8420a3661c3f990424ab7b9164931 Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Tue, 11 Feb 2025 14:36:26 -0600
+Subject: [PATCH] headers: Handle parsing edge case
+
+This version number is specifically crafted to pass sanity checks allowing it to go one byte out of bounds.
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/1f509f31b6f8420a3661c3f990424ab7b9164931]
+CVE: CVE-2025-32906 #Dependency Patch
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/soup-headers.c | 2 +-
+ tests/header-parsing-test.c | 12 ++++++++++++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
+index 85385cea..9d6d00a3 100644
+--- a/libsoup/soup-headers.c
++++ b/libsoup/soup-headers.c
+@@ -225,7 +225,7 @@ soup_headers_parse_request (const char *str,
+ !g_ascii_isdigit (version[5]))
+ return SOUP_STATUS_BAD_REQUEST;
+ major_version = strtoul (version + 5, &p, 10);
+- if (*p != '.' || !g_ascii_isdigit (p[1]))
++ if (p + 1 >= str + len || *p != '.' || !g_ascii_isdigit (p[1]))
+ return SOUP_STATUS_BAD_REQUEST;
+ minor_version = strtoul (p + 1, &p, 10);
+ version_end = p;
+diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
+index 07ea2866..10ddb684 100644
+--- a/tests/header-parsing-test.c
++++ b/tests/header-parsing-test.c
+@@ -6,6 +6,10 @@ typedef struct {
+ const char *name, *value;
+ } Header;
+
++static char unterminated_http_version[] = {
++ 'G','E','T',' ','/',' ','H','T','T','P','/','1', '0', '0', '.'
++};
++
+ static struct RequestTest {
+ const char *description;
+ const char *bugref;
+@@ -383,6 +387,14 @@ static struct RequestTest {
+ { { NULL } }
+ },
+
++ /* This couldn't be a C string as going one byte over would have been safe. */
++ { "Long HTTP version terminating at missing minor version", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404",
++ unterminated_http_version, sizeof (unterminated_http_version),
++ SOUP_STATUS_BAD_REQUEST,
++ NULL, NULL, -1,
++ { { NULL } }
++ },
++
+ { "Non-HTTP request", NULL,
+ "GET / SOUP/1.1\r\nHost: example.com\r\n", -1,
+ SOUP_STATUS_BAD_REQUEST,
+--
+GitLab
+
diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32906-2.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32906-2.patch
new file mode 100644
index 0000000000..5baad15648
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32906-2.patch
@@ -0,0 +1,83 @@
+From af5b9a4a3945c52b940d5ac181ef51bb12011f1f Mon Sep 17 00:00:00 2001
+From: Patrick Griffis <pgriffis@igalia.com>
+Date: Wed, 12 Feb 2025 11:30:02 -0600
+Subject: [PATCH] headers: Handle parsing only newlines
+
+Closes #404
+Closes #407
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/af5b9a4a3945c52b940d5ac181ef51bb12011f1f]
+CVE: CVE-2025-32906
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ libsoup/soup-headers.c | 4 ++--
+ tests/header-parsing-test.c | 13 ++++++++++++-
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/libsoup/soup-headers.c b/libsoup/soup-headers.c
+index 9d6d00a3..52ef2ece 100644
+--- a/libsoup/soup-headers.c
++++ b/libsoup/soup-headers.c
+@@ -186,7 +186,7 @@ soup_headers_parse_request (const char *str,
+ /* RFC 2616 4.1 "servers SHOULD ignore any empty line(s)
+ * received where a Request-Line is expected."
+ */
+- while ((*str == '\r' || *str == '\n') && len > 0) {
++ while (len > 0 && (*str == '\r' || *str == '\n')) {
+ str++;
+ len--;
+ }
+@@ -371,7 +371,7 @@ soup_headers_parse_response (const char *str,
+ * after a response, which we then see prepended to the next
+ * response on that connection.
+ */
+- while ((*str == '\r' || *str == '\n') && len > 0) {
++ while (len > 0 && (*str == '\r' || *str == '\n')) {
+ str++;
+ len--;
+ }
+diff --git a/tests/header-parsing-test.c b/tests/header-parsing-test.c
+index 10ddb684..4faafbd6 100644
+--- a/tests/header-parsing-test.c
++++ b/tests/header-parsing-test.c
+@@ -6,10 +6,15 @@ typedef struct {
+ const char *name, *value;
+ } Header;
+
++/* These are not C strings to ensure going one byte over is not safe. */
+ static char unterminated_http_version[] = {
+ 'G','E','T',' ','/',' ','H','T','T','P','/','1', '0', '0', '.'
+ };
+
++static char only_newlines[] = {
++ '\n', '\n', '\n', '\n'
++};
++
+ static struct RequestTest {
+ const char *description;
+ const char *bugref;
+@@ -387,7 +392,6 @@ static struct RequestTest {
+ { { NULL } }
+ },
+
+- /* This couldn't be a C string as going one byte over would have been safe. */
+ { "Long HTTP version terminating at missing minor version", "https://gitlab.gnome.org/GNOME/libsoup/-/issues/404",
+ unterminated_http_version, sizeof (unterminated_http_version),
+ SOUP_STATUS_BAD_REQUEST,
+@@ -457,6 +461,13 @@ static struct RequestTest {
+ SOUP_STATUS_BAD_REQUEST,
+ NULL, NULL, -1,
+ { { NULL } }
++ },
++
++ { "Only newlines", NULL,
++ only_newlines, sizeof (only_newlines),
++ SOUP_STATUS_BAD_REQUEST,
++ NULL, NULL, -1,
++ { { NULL } }
+ }
+ };
+ static const int num_reqtests = G_N_ELEMENTS (reqtests);
+--
+GitLab
+
diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
index 2db854baa4..3a5758a1cc 100644
--- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
+++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
@@ -26,6 +26,8 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
file://CVE-2025-32912-2.patch \
file://CVE-2025-32912-3.patch \
file://CVE-2025-32912-4.patch \
+ file://CVE-2025-32906-1.patch \
+ file://CVE-2025-32906-2.patch \
"
SRC_URI[sha256sum] = "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"
--
2.25.1
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910
2025-04-17 10:42 [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910 vanusuri
` (3 preceding siblings ...)
2025-04-17 10:42 ` [OE-core][scarthgap][PATCH v2 5/5] libsoup: Fix CVE-2025-32906 vanusuri
@ 2025-04-17 11:15 ` Gyorgy Sarvari
2025-04-17 11:21 ` Vijay Anusuri
4 siblings, 1 reply; 10+ messages in thread
From: Gyorgy Sarvari @ 2025-04-17 11:15 UTC (permalink / raw)
To: vanusuri, openembedded-core
This seems to be identical to v1.
On 4/17/25 12:42, Vijay Anusuri via lists.openembedded.org wrote:
> From: Vijay Anusuri <vanusuri@mvista.com>
>
> Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832
>
> Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> ---
> .../libsoup-3.4.4/CVE-2025-32910.patch | 27 +++++++++++++++++++
> meta/recipes-support/libsoup/libsoup_3.4.4.bb | 1 +
> 2 files changed, 28 insertions(+)
> create mode 100644 meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
>
> diff --git a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> new file mode 100644
> index 0000000000..32e0c86e62
> --- /dev/null
> +++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> @@ -0,0 +1,27 @@
> +From ea16eeacb052e423eb5c3b0b705e5eab34b13832 Mon Sep 17 00:00:00 2001
> +From: Patrick Griffis <pgriffis@igalia.com>
> +Date: Fri, 27 Dec 2024 13:52:52 -0600
> +Subject: [PATCH] auth-digest: Fix leak
> +
> +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832]
> +CVE: CVE-2025-32910
> +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> +---
> + libsoup/auth/soup-auth-digest.c | 1 +
> + 1 file changed, 1 insertion(+)
> +
> +diff --git a/libsoup/auth/soup-auth-digest.c b/libsoup/auth/soup-auth-digest.c
> +index 350bfde6..9eb7fa0e 100644
> +--- a/libsoup/auth/soup-auth-digest.c
> ++++ b/libsoup/auth/soup-auth-digest.c
> +@@ -72,6 +72,7 @@ soup_auth_digest_finalize (GObject *object)
> + g_free (priv->nonce);
> + g_free (priv->domain);
> + g_free (priv->cnonce);
> ++ g_free (priv->opaque);
> +
> + memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
> + memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
> +--
> +GitLab
> +
> diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> index b2e32b892a..757e6432f7 100644
> --- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> +++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> @@ -18,6 +18,7 @@ SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
> file://CVE-2024-52531-1.patch \
> file://CVE-2024-52531-2.patch \
> file://CVE-2024-52531-3.patch \
> + file://CVE-2025-32910.patch \
> "
> SRC_URI[sha256sum] = "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#215059): https://lists.openembedded.org/g/openembedded-core/message/215059
> Mute This Topic: https://lists.openembedded.org/mt/112311177/6084445
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [skandigraun@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910
2025-04-17 11:15 ` [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910 Gyorgy Sarvari
@ 2025-04-17 11:21 ` Vijay Anusuri
2025-04-17 11:25 ` Gyorgy Sarvari
0 siblings, 1 reply; 10+ messages in thread
From: Vijay Anusuri @ 2025-04-17 11:21 UTC (permalink / raw)
To: Gyorgy Sarvari; +Cc: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 3399 bytes --]
I have renamed one of the patches in the v2 patch.
Thanks & Regards,
Vijay
On Thu, Apr 17, 2025 at 4:45 PM Gyorgy Sarvari <skandigraun@gmail.com>
wrote:
> This seems to be identical to v1.
>
> On 4/17/25 12:42, Vijay Anusuri via lists.openembedded.org wrote:
> > From: Vijay Anusuri <vanusuri@mvista.com>
> >
> > Upstream-Status: Backport from
> https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832
> >
> > Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > ---
> > .../libsoup-3.4.4/CVE-2025-32910.patch | 27 +++++++++++++++++++
> > meta/recipes-support/libsoup/libsoup_3.4.4.bb | 1 +
> > 2 files changed, 28 insertions(+)
> > create mode 100644
> meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> >
> > diff --git
> a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > new file mode 100644
> > index 0000000000..32e0c86e62
> > --- /dev/null
> > +++ b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > @@ -0,0 +1,27 @@
> > +From ea16eeacb052e423eb5c3b0b705e5eab34b13832 Mon Sep 17 00:00:00 2001
> > +From: Patrick Griffis <pgriffis@igalia.com>
> > +Date: Fri, 27 Dec 2024 13:52:52 -0600
> > +Subject: [PATCH] auth-digest: Fix leak
> > +
> > +Upstream-Status: Backport [
> https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832
> ]
> > +CVE: CVE-2025-32910
> > +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > +---
> > + libsoup/auth/soup-auth-digest.c | 1 +
> > + 1 file changed, 1 insertion(+)
> > +
> > +diff --git a/libsoup/auth/soup-auth-digest.c
> b/libsoup/auth/soup-auth-digest.c
> > +index 350bfde6..9eb7fa0e 100644
> > +--- a/libsoup/auth/soup-auth-digest.c
> > ++++ b/libsoup/auth/soup-auth-digest.c
> > +@@ -72,6 +72,7 @@ soup_auth_digest_finalize (GObject *object)
> > + g_free (priv->nonce);
> > + g_free (priv->domain);
> > + g_free (priv->cnonce);
> > ++ g_free (priv->opaque);
> > +
> > + memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
> > + memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
> > +--
> > +GitLab
> > +
> > diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> > index b2e32b892a..757e6432f7 100644
> > --- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> > +++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> > @@ -18,6 +18,7 @@ SRC_URI =
> "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
> > file://CVE-2024-52531-1.patch \
> > file://CVE-2024-52531-2.patch \
> > file://CVE-2024-52531-3.patch \
> > + file://CVE-2025-32910.patch \
> > "
> > SRC_URI[sha256sum] =
> "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"
> >
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#215059):
> https://lists.openembedded.org/g/openembedded-core/message/215059
> > Mute This Topic: https://lists.openembedded.org/mt/112311177/6084445
> > Group Owner: openembedded-core+owner@lists.openembedded.org
> > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> skandigraun@gmail.com]
> > -=-=-=-=-=-=-=-=-=-=-=-
> >
>
[-- Attachment #2: Type: text/html, Size: 5560 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910
2025-04-17 11:21 ` Vijay Anusuri
@ 2025-04-17 11:25 ` Gyorgy Sarvari
2025-04-17 11:45 ` Vijay Anusuri
0 siblings, 1 reply; 10+ messages in thread
From: Gyorgy Sarvari @ 2025-04-17 11:25 UTC (permalink / raw)
To: Vijay Anusuri; +Cc: openembedded-core
Your reply makes me wonder if my feedback from yesterday reached you:
https://lists.openembedded.org/g/openembedded-core/message/214981 -
don't know if you disagree with it, or maybe you just haven't seen it.
On 4/17/25 13:21, Vijay Anusuri wrote:
> I have renamed one of the patches in the v2 patch.
>
> Thanks & Regards,
> Vijay
>
>
> On Thu, Apr 17, 2025 at 4:45 PM Gyorgy Sarvari <skandigraun@gmail.com>
> wrote:
>
> This seems to be identical to v1.
>
> On 4/17/25 12:42, Vijay Anusuri via lists.openembedded.org
> <http://lists.openembedded.org> wrote:
> > From: Vijay Anusuri <vanusuri@mvista.com>
> >
> > Upstream-Status: Backport from
> https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832
> >
> > Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > ---
> > .../libsoup-3.4.4/CVE-2025-32910.patch | 27
> +++++++++++++++++++
> > meta/recipes-support/libsoup/libsoup_3.4.4.bb
> <http://libsoup_3.4.4.bb> | 1 +
> > 2 files changed, 28 insertions(+)
> > create mode 100644
> meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> >
> > diff --git
> a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > new file mode 100644
> > index 0000000000..32e0c86e62
> > --- /dev/null
> > +++
> b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > @@ -0,0 +1,27 @@
> > +From ea16eeacb052e423eb5c3b0b705e5eab34b13832 Mon Sep 17
> 00:00:00 2001
> > +From: Patrick Griffis <pgriffis@igalia.com>
> > +Date: Fri, 27 Dec 2024 13:52:52 -0600
> > +Subject: [PATCH] auth-digest: Fix leak
> > +
> > +Upstream-Status: Backport
> [https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832]
> > +CVE: CVE-2025-32910
> > +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > +---
> > + libsoup/auth/soup-auth-digest.c | 1 +
> > + 1 file changed, 1 insertion(+)
> > +
> > +diff --git a/libsoup/auth/soup-auth-digest.c
> b/libsoup/auth/soup-auth-digest.c
> > +index 350bfde6..9eb7fa0e 100644
> > +--- a/libsoup/auth/soup-auth-digest.c
> > ++++ b/libsoup/auth/soup-auth-digest.c
> > +@@ -72,6 +72,7 @@ soup_auth_digest_finalize (GObject *object)
> > + g_free (priv->nonce);
> > + g_free (priv->domain);
> > + g_free (priv->cnonce);
> > ++ g_free (priv->opaque);
> > +
> > + memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
> > + memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
> > +--
> > +GitLab
> > +
> > diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> <http://libsoup_3.4.4.bb>
> b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> <http://libsoup_3.4.4.bb>
> > index b2e32b892a..757e6432f7 100644
> > --- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> <http://libsoup_3.4.4.bb>
> > +++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> <http://libsoup_3.4.4.bb>
> > @@ -18,6 +18,7 @@ SRC_URI =
> "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
> > file://CVE-2024-52531-1.patch \
> > file://CVE-2024-52531-2.patch \
> > file://CVE-2024-52531-3.patch \
> > + file://CVE-2025-32910.patch \
> > "
> > SRC_URI[sha256sum] =
> "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"
> >
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#215059):
> https://lists.openembedded.org/g/openembedded-core/message/215059
> > Mute This Topic: https://lists.openembedded.org/mt/112311177/6084445
> > Group Owner: openembedded-core+owner@lists.openembedded.org
> <mailto:openembedded-core%2Bowner@lists.openembedded.org>
> > Unsubscribe:
> https://lists.openembedded.org/g/openembedded-core/unsub
> [skandigraun@gmail.com]
> > -=-=-=-=-=-=-=-=-=-=-=-
> >
>
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910
2025-04-17 11:25 ` Gyorgy Sarvari
@ 2025-04-17 11:45 ` Vijay Anusuri
2025-04-17 11:49 ` Gyorgy Sarvari
0 siblings, 1 reply; 10+ messages in thread
From: Vijay Anusuri @ 2025-04-17 11:45 UTC (permalink / raw)
To: Gyorgy Sarvari; +Cc: openembedded-core
[-- Attachment #1: Type: text/plain, Size: 4873 bytes --]
I haven't seen your yesterday's message :
https://lists.openembedded.org/g/openembedded-core/message/214981
Those 2 missing commits were added as part of CVE-2025-32912 patch.
Thanks for letting me know. I will rename those patches and will send a v3
patch.
Thanks & Regards,
Vijay
On Thu, Apr 17, 2025 at 4:55 PM Gyorgy Sarvari <skandigraun@gmail.com>
wrote:
> Your reply makes me wonder if my feedback from yesterday reached you:
> https://lists.openembedded.org/g/openembedded-core/message/214981 -
> don't know if you disagree with it, or maybe you just haven't seen it.
>
> On 4/17/25 13:21, Vijay Anusuri wrote:
> > I have renamed one of the patches in the v2 patch.
> >
> > Thanks & Regards,
> > Vijay
> >
> >
> > On Thu, Apr 17, 2025 at 4:45 PM Gyorgy Sarvari <skandigraun@gmail.com>
> > wrote:
> >
> > This seems to be identical to v1.
> >
> > On 4/17/25 12:42, Vijay Anusuri via lists.openembedded.org
> > <http://lists.openembedded.org> wrote:
> > > From: Vijay Anusuri <vanusuri@mvista.com>
> > >
> > > Upstream-Status: Backport from
> >
> https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832
> > >
> > > Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > > ---
> > > .../libsoup-3.4.4/CVE-2025-32910.patch | 27
> > +++++++++++++++++++
> > > meta/recipes-support/libsoup/libsoup_3.4.4.bb
> > <http://libsoup_3.4.4.bb> | 1 +
> > > 2 files changed, 28 insertions(+)
> > > create mode 100644
> > meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > >
> > > diff --git
> > a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > > new file mode 100644
> > > index 0000000000..32e0c86e62
> > > --- /dev/null
> > > +++
> > b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > > @@ -0,0 +1,27 @@
> > > +From ea16eeacb052e423eb5c3b0b705e5eab34b13832 Mon Sep 17
> > 00:00:00 2001
> > > +From: Patrick Griffis <pgriffis@igalia.com>
> > > +Date: Fri, 27 Dec 2024 13:52:52 -0600
> > > +Subject: [PATCH] auth-digest: Fix leak
> > > +
> > > +Upstream-Status: Backport
> > [
> https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832
> ]
> > > +CVE: CVE-2025-32910
> > > +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > > +---
> > > + libsoup/auth/soup-auth-digest.c | 1 +
> > > + 1 file changed, 1 insertion(+)
> > > +
> > > +diff --git a/libsoup/auth/soup-auth-digest.c
> > b/libsoup/auth/soup-auth-digest.c
> > > +index 350bfde6..9eb7fa0e 100644
> > > +--- a/libsoup/auth/soup-auth-digest.c
> > > ++++ b/libsoup/auth/soup-auth-digest.c
> > > +@@ -72,6 +72,7 @@ soup_auth_digest_finalize (GObject *object)
> > > + g_free (priv->nonce);
> > > + g_free (priv->domain);
> > > + g_free (priv->cnonce);
> > > ++ g_free (priv->opaque);
> > > +
> > > + memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
> > > + memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
> > > +--
> > > +GitLab
> > > +
> > > diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> > <http://libsoup_3.4.4.bb>
> > b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> > <http://libsoup_3.4.4.bb>
> > > index b2e32b892a..757e6432f7 100644
> > > --- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> > <http://libsoup_3.4.4.bb>
> > > +++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> > <http://libsoup_3.4.4.bb>
> > > @@ -18,6 +18,7 @@ SRC_URI =
> > "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
> > > file://CVE-2024-52531-1.patch \
> > > file://CVE-2024-52531-2.patch \
> > > file://CVE-2024-52531-3.patch \
> > > + file://CVE-2025-32910.patch \
> > > "
> > > SRC_URI[sha256sum] =
> > "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"
> > >
> > >
> > > -=-=-=-=-=-=-=-=-=-=-=-
> > > Links: You receive all messages sent to this group.
> > > View/Reply Online (#215059):
> > https://lists.openembedded.org/g/openembedded-core/message/215059
> > > Mute This Topic:
> https://lists.openembedded.org/mt/112311177/6084445
> > > Group Owner: openembedded-core+owner@lists.openembedded.org
> > <mailto:openembedded-core%2Bowner@lists.openembedded.org>
> > > Unsubscribe:
> > https://lists.openembedded.org/g/openembedded-core/unsub
> > [skandigraun@gmail.com]
> > > -=-=-=-=-=-=-=-=-=-=-=-
> > >
> >
>
[-- Attachment #2: Type: text/html, Size: 8601 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [OE-core][scarthgap][PATCH v2 1/5] libsoup: Fix CVE-2025-32910
2025-04-17 11:45 ` Vijay Anusuri
@ 2025-04-17 11:49 ` Gyorgy Sarvari
0 siblings, 0 replies; 10+ messages in thread
From: Gyorgy Sarvari @ 2025-04-17 11:49 UTC (permalink / raw)
To: Vijay Anusuri; +Cc: openembedded-core
Ahh, so I was missing something, it fixes multiple CVEs... thanks for
the clarification.
On 4/17/25 13:45, Vijay Anusuri wrote:
> I haven't seen your yesterday's message :
> https://lists.openembedded.org/g/openembedded-core/message/214981
>
> Those 2 missing commits were added as part of CVE-2025-32912 patch.
>
> Thanks for letting me know. I will rename those patches and will send
> a v3 patch.
>
> Thanks & Regards,
> Vijay
>
> On Thu, Apr 17, 2025 at 4:55 PM Gyorgy Sarvari <skandigraun@gmail.com>
> wrote:
>
> Your reply makes me wonder if my feedback from yesterday reached you:
> https://lists.openembedded.org/g/openembedded-core/message/214981 -
> don't know if you disagree with it, or maybe you just haven't seen it.
>
> On 4/17/25 13:21, Vijay Anusuri wrote:
> > I have renamed one of the patches in the v2 patch.
> >
> > Thanks & Regards,
> > Vijay
> >
> >
> > On Thu, Apr 17, 2025 at 4:45 PM Gyorgy Sarvari
> <skandigraun@gmail.com>
> > wrote:
> >
> > This seems to be identical to v1.
> >
> > On 4/17/25 12:42, Vijay Anusuri via lists.openembedded.org
> <http://lists.openembedded.org>
> > <http://lists.openembedded.org> wrote:
> > > From: Vijay Anusuri <vanusuri@mvista.com>
> > >
> > > Upstream-Status: Backport from
> >
> https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832
> > >
> > > Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > > ---
> > > .../libsoup-3.4.4/CVE-2025-32910.patch | 27
> > +++++++++++++++++++
> > > meta/recipes-support/libsoup/libsoup_3.4.4.bb
> <http://libsoup_3.4.4.bb>
> > <http://libsoup_3.4.4.bb> | 1 +
> > > 2 files changed, 28 insertions(+)
> > > create mode 100644
> > meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > >
> > > diff --git
> >
> a/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> >
> b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > > new file mode 100644
> > > index 0000000000..32e0c86e62
> > > --- /dev/null
> > > +++
> >
> b/meta/recipes-support/libsoup/libsoup-3.4.4/CVE-2025-32910.patch
> > > @@ -0,0 +1,27 @@
> > > +From ea16eeacb052e423eb5c3b0b705e5eab34b13832 Mon Sep 17
> > 00:00:00 2001
> > > +From: Patrick Griffis <pgriffis@igalia.com>
> > > +Date: Fri, 27 Dec 2024 13:52:52 -0600
> > > +Subject: [PATCH] auth-digest: Fix leak
> > > +
> > > +Upstream-Status: Backport
> >
> [https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832]
> > > +CVE: CVE-2025-32910
> > > +Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
> > > +---
> > > + libsoup/auth/soup-auth-digest.c | 1 +
> > > + 1 file changed, 1 insertion(+)
> > > +
> > > +diff --git a/libsoup/auth/soup-auth-digest.c
> > b/libsoup/auth/soup-auth-digest.c
> > > +index 350bfde6..9eb7fa0e 100644
> > > +--- a/libsoup/auth/soup-auth-digest.c
> > > ++++ b/libsoup/auth/soup-auth-digest.c
> > > +@@ -72,6 +72,7 @@ soup_auth_digest_finalize (GObject *object)
> > > + g_free (priv->nonce);
> > > + g_free (priv->domain);
> > > + g_free (priv->cnonce);
> > > ++ g_free (priv->opaque);
> > > +
> > > + memset (priv->hex_urp, 0, sizeof (priv->hex_urp));
> > > + memset (priv->hex_a1, 0, sizeof (priv->hex_a1));
> > > +--
> > > +GitLab
> > > +
> > > diff --git a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> <http://libsoup_3.4.4.bb>
> > <http://libsoup_3.4.4.bb>
> > b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> <http://libsoup_3.4.4.bb>
> > <http://libsoup_3.4.4.bb>
> > > index b2e32b892a..757e6432f7 100644
> > > --- a/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> <http://libsoup_3.4.4.bb>
> > <http://libsoup_3.4.4.bb>
> > > +++ b/meta/recipes-support/libsoup/libsoup_3.4.4.bb
> <http://libsoup_3.4.4.bb>
> > <http://libsoup_3.4.4.bb>
> > > @@ -18,6 +18,7 @@ SRC_URI =
> > "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
> > > file://CVE-2024-52531-1.patch \
> > > file://CVE-2024-52531-2.patch \
> > > file://CVE-2024-52531-3.patch \
> > > + file://CVE-2025-32910.patch \
> > > "
> > > SRC_URI[sha256sum] =
> >
> "291c67725f36ed90ea43efff25064b69c5a2d1981488477c05c481a3b4b0c5aa"
> > >
> > >
> > > -=-=-=-=-=-=-=-=-=-=-=-
> > > Links: You receive all messages sent to this group.
> > > View/Reply Online (#215059):
> >
> https://lists.openembedded.org/g/openembedded-core/message/215059
> > > Mute This Topic:
> https://lists.openembedded.org/mt/112311177/6084445
> > > Group Owner:
> openembedded-core+owner@lists.openembedded.org
> <mailto:openembedded-core%2Bowner@lists.openembedded.org>
> > <mailto:openembedded-core%2Bowner@lists.openembedded.org
> <mailto:openembedded-core%252Bowner@lists.openembedded.org>>
> > > Unsubscribe:
> > https://lists.openembedded.org/g/openembedded-core/unsub
> > [skandigraun@gmail.com]
> > > -=-=-=-=-=-=-=-=-=-=-=-
> > >
> >
>
^ permalink raw reply [flat|nested] 10+ messages in thread