diff options
| author | Michal Vasilek <michal.vasilek@nic.cz> | 2021-08-23 13:37:53 +0200 |
|---|---|---|
| committer | Michal Vasilek <michal.vasilek@nic.cz> | 2021-08-23 15:38:23 +0200 |
| commit | 0777e40b7472a0b0b77531b6797448f8c15bd586 (patch) | |
| tree | 8264795b14c6ba646f4c50f92b2ded7a5565d7c2 /libs/apr | |
| parent | f4c765409af34e41769882e506064ad08b6dcb64 (diff) | |
apr: patch CVE-2021-35940
Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
Diffstat (limited to 'libs/apr')
| -rw-r--r-- | libs/apr/Makefile | 2 | ||||
| -rw-r--r-- | libs/apr/patches/CVE-2021-35940.patch | 49 |
2 files changed, 50 insertions, 1 deletions
diff --git a/libs/apr/Makefile b/libs/apr/Makefile index f7869d5d8..33ea07dd6 100644 --- a/libs/apr/Makefile +++ b/libs/apr/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=apr PKG_VERSION:=1.7.0 -PKG_RELEASE:=2 +PKG_RELEASE:=3 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2 PKG_SOURCE_URL:=@APACHE/apr/ diff --git a/libs/apr/patches/CVE-2021-35940.patch b/libs/apr/patches/CVE-2021-35940.patch new file mode 100644 index 000000000..49a858aa3 --- /dev/null +++ b/libs/apr/patches/CVE-2021-35940.patch @@ -0,0 +1,49 @@ + +SECURITY: CVE-2021-35940 (cve.mitre.org) + +Restore fix for CVE-2017-12613 which was missing in 1.7.x branch, though +was addressed in 1.6.x in 1.6.3 and later via r1807976. + +The fix was merged back to 1.7.x in r1891198. + +Since this was a regression in 1.7.0, a new CVE name has been assigned +to track this, CVE-2021-35940. + +Thanks to Iveta Cesalova <icesalov redhat.com> for reporting this issue. + +https://svn.apache.org/viewvc?view=revision&revision=1891198 + +--- a/time/unix/time.c ++++ b/time/unix/time.c +@@ -142,6 +142,9 @@ APR_DECLARE(apr_status_t) apr_time_exp_g + static const int dayoffset[12] = + {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275}; + ++ if (xt->tm_mon < 0 || xt->tm_mon >= 12) ++ return APR_EBADDATE; ++ + /* shift new year to 1st March in order to make leap year calc easy */ + + if (xt->tm_mon < 2) +--- a/time/win32/time.c ++++ b/time/win32/time.c +@@ -54,6 +54,9 @@ static void SystemTimeToAprExpTime(apr_t + static const int dayoffset[12] = + {0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334}; + ++ if (tm->wMonth < 1 || tm->wMonth > 12) ++ return APR_EBADDATE; ++ + /* Note; the caller is responsible for filling in detailed tm_usec, + * tm_gmtoff and tm_isdst data when applicable. + */ +@@ -228,6 +231,9 @@ APR_DECLARE(apr_status_t) apr_time_exp_g + static const int dayoffset[12] = + {306, 337, 0, 31, 61, 92, 122, 153, 184, 214, 245, 275}; + ++ if (xt->tm_mon < 0 || xt->tm_mon >= 12) ++ return APR_EBADDATE; ++ + /* shift new year to 1st March in order to make leap year calc easy */ + + if (xt->tm_mon < 2) |