diff options
| -rw-r--r-- | gnu/local.mk | 2 | ||||
| -rw-r--r-- | gnu/packages/password-utils.scm | 22 | ||||
| -rw-r--r-- | gnu/packages/patches/cracklib-CVE-2016-6318.patch | 95 | ||||
| -rw-r--r-- | gnu/packages/patches/cracklib-fix-buffer-overflow.patch | 39 |
4 files changed, 10 insertions, 148 deletions
diff --git a/gnu/local.mk b/gnu/local.mk index 49537e19f8..0a7e9bbc67 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -706,8 +706,6 @@ dist_patch_DATA = \ %D%/packages/patches/combinatorial-blas-io-fix.patch \ %D%/packages/patches/cpio-CVE-2016-2037.patch \ %D%/packages/patches/cpufrequtils-fix-aclocal.patch \ - %D%/packages/patches/cracklib-CVE-2016-6318.patch \ - %D%/packages/patches/cracklib-fix-buffer-overflow.patch \ %D%/packages/patches/crawl-upgrade-saves.patch \ %D%/packages/patches/crda-optional-gcrypt.patch \ %D%/packages/patches/clucene-contribs-lib.patch \ diff --git a/gnu/packages/password-utils.scm b/gnu/packages/password-utils.scm index 9fd5a6ff0d..ad89cee5a8 100644 --- a/gnu/packages/password-utils.scm +++ b/gnu/packages/password-utils.scm @@ -9,7 +9,7 @@ ;;; Copyright © 2016 Alex Griffin <a@ajgrf.com> ;;; Copyright © 2017 Leo Famulari <leo@famulari.name> ;;; Copyright © 2017, 2018 Clément Lassieur <clement@lassieur.org> -;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr> +;;; Copyright © 2017, 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr> ;;; Copyright © 2017 Jelle Licht <jlicht@fsfe.org> ;;; Copyright © 2017 Eric Bavier <bavier@member.fsf.org> ;;; Copyright © 2017 Nicolas Goaziou <mail@nicolasgoaziou.fr> @@ -295,17 +295,15 @@ and vice versa.") (define-public cracklib (package (name "cracklib") - (version "2.9.6") - (source (origin - (method url-fetch) - (uri (string-append "https://github.com/cracklib/cracklib/" - "releases/download/" name "-" version "/" - name "-" version ".tar.gz")) - (patches (search-patches "cracklib-CVE-2016-6318.patch" - "cracklib-fix-buffer-overflow.patch")) - (sha256 - (base32 - "0hrkb0prf7n92w6rxgq0ilzkk6rkhpys2cfqkrbzswp27na7dkqp")))) + (version "2.9.7") + (source + (origin + (method url-fetch) + (uri (string-append "https://github.com/cracklib/cracklib/" + "releases/download/v" version "/" + "cracklib-" version ".tar.bz2")) + (sha256 + (base32 "1rimpjsdnmw8f5b7k558cic41p2qy2n2yrlqp5vh7mp4162hk0py")))) (build-system gnu-build-system) (synopsis "Password checking library") (home-page "https://github.com/cracklib/cracklib") diff --git a/gnu/packages/patches/cracklib-CVE-2016-6318.patch b/gnu/packages/patches/cracklib-CVE-2016-6318.patch deleted file mode 100644 index 4806ecaae9..0000000000 --- a/gnu/packages/patches/cracklib-CVE-2016-6318.patch +++ /dev/null @@ -1,95 +0,0 @@ -Fix CVE-2016-6318. - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6318 - -Patch copied from Red Hat: - -https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6318 -https://bugzilla.redhat.com/attachment.cgi?id=1188599&action=diff - -It is not safe to pass words longer than STRINGSIZE further to cracklib -so the longbuffer cannot be longer than STRINGSIZE. -diff -up cracklib-2.9.0/lib/fascist.c.longgecos cracklib-2.9.0/lib/fascist.c ---- cracklib-2.9.0/lib/fascist.c.longgecos 2014-02-06 16:03:59.000000000 +0100 -+++ cracklib-2.9.0/lib/fascist.c 2016-08-08 12:05:40.279235815 +0200 -@@ -515,7 +515,7 @@ FascistGecosUser(char *password, const c - char gbuffer[STRINGSIZE]; - char tbuffer[STRINGSIZE]; - char *uwords[STRINGSIZE]; -- char longbuffer[STRINGSIZE * 2]; -+ char longbuffer[STRINGSIZE]; - - if (gecos == NULL) - gecos = ""; -@@ -596,38 +596,47 @@ FascistGecosUser(char *password, const c - { - for (i = 0; i < j; i++) - { -- strcpy(longbuffer, uwords[i]); -- strcat(longbuffer, uwords[j]); -- -- if (GTry(longbuffer, password)) -+ if (strlen(uwords[i]) + strlen(uwords[j]) < STRINGSIZE) - { -- return _("it is derived from your password entry"); -- } -- -- strcpy(longbuffer, uwords[j]); -- strcat(longbuffer, uwords[i]); -+ strcpy(longbuffer, uwords[i]); -+ strcat(longbuffer, uwords[j]); - -- if (GTry(longbuffer, password)) -- { -- return _("it's derived from your password entry"); -+ if (GTry(longbuffer, password)) -+ { -+ return _("it is derived from your password entry"); -+ } -+ -+ strcpy(longbuffer, uwords[j]); -+ strcat(longbuffer, uwords[i]); -+ -+ if (GTry(longbuffer, password)) -+ { -+ return _("it's derived from your password entry"); -+ } - } - -- longbuffer[0] = uwords[i][0]; -- longbuffer[1] = '\0'; -- strcat(longbuffer, uwords[j]); -- -- if (GTry(longbuffer, password)) -+ if (strlen(uwords[j]) < STRINGSIZE - 1) - { -- return _("it is derivable from your password entry"); -+ longbuffer[0] = uwords[i][0]; -+ longbuffer[1] = '\0'; -+ strcat(longbuffer, uwords[j]); -+ -+ if (GTry(longbuffer, password)) -+ { -+ return _("it is derivable from your password entry"); -+ } - } - -- longbuffer[0] = uwords[j][0]; -- longbuffer[1] = '\0'; -- strcat(longbuffer, uwords[i]); -- -- if (GTry(longbuffer, password)) -+ if (strlen(uwords[i]) < STRINGSIZE - 1) - { -- return _("it's derivable from your password entry"); -+ longbuffer[0] = uwords[j][0]; -+ longbuffer[1] = '\0'; -+ strcat(longbuffer, uwords[i]); -+ -+ if (GTry(longbuffer, password)) -+ { -+ return _("it's derivable from your password entry"); -+ } - } - } - } diff --git a/gnu/packages/patches/cracklib-fix-buffer-overflow.patch b/gnu/packages/patches/cracklib-fix-buffer-overflow.patch deleted file mode 100644 index b1c990f282..0000000000 --- a/gnu/packages/patches/cracklib-fix-buffer-overflow.patch +++ /dev/null @@ -1,39 +0,0 @@ -Fix buffer overflow processing long words in Mangle(). - -Patch adpated from upstream commit, omitting changes to 'NEWS': - -https://github.com/cracklib/cracklib/commit/33d7fa4585247cd2247a1ffa032ad245836c6edb - -From 33d7fa4585247cd2247a1ffa032ad245836c6edb Mon Sep 17 00:00:00 2001 -From: Jan Dittberner <jan@dittberner.info> -Date: Thu, 25 Aug 2016 17:17:53 +0200 -Subject: [PATCH] Fix a buffer overflow processing long words - -A buffer overflow processing long words has been discovered. This commit -applies the patch from -https://build.opensuse.org/package/view_file/Base:System/cracklib/0004-overflow-processing-long-words.patch -by Howard Guo. - -See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=835386 and -http://www.openwall.com/lists/oss-security/2016/08/23/8 ---- - src/NEWS | 1 + - src/lib/rules.c | 5 ++--- - 2 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/lib/rules.c b/src/lib/rules.c -index d193cc0..3a2aa46 100644 ---- a/lib/rules.c -+++ b/lib/rules.c -@@ -434,9 +434,8 @@ Mangle(input, control) /* returns a pointer to a controlled Mangle */ - { - int limit; - register char *ptr; -- static char area[STRINGSIZE]; -- char area2[STRINGSIZE]; -- area[0] = '\0'; -+ static char area[STRINGSIZE * 2] = {0}; -+ char area2[STRINGSIZE * 2] = {0}; - strcpy(area, input); - - for (ptr = control; *ptr; ptr++) |