Skip to content

Commit d419417

Browse files
kevin-b-lockwoodkevin-b-lockwood
authored
[Medium] Patch ceph to fix CVE-2014-5461 (#12123)
1 parent e1055df commit d419417

File tree

5 files changed

+129
-3
lines changed

5 files changed

+129
-3
lines changed

‎SPECS/ceph/CVE-2012-6708.patch

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
From c993d7d4b9ddb5d9dcb0c4120f798730aacfff0a Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Mon, 13 Jan 2025 14:53:54 -0800
4+
Subject: [PATCH] Adjust jQuery('html') detection to only match when html
5+
starts with '<' (not counting space characters). Fixes #11290.
6+
7+
Source: https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d.patch
8+
---
9+
qa/workunits/erasure-code/jquery.js | 3 ++-
10+
1 file changed, 2 insertions(+), 1 deletion(-)
11+
12+
diff --git a/qa/workunits/erasure-code/jquery.js b/qa/workunits/erasure-code/jquery.js
13+
index 8c24ffc61..45c208837 100644
14+
--- a/qa/workunits/erasure-code/jquery.js
15+
+++ b/qa/workunits/erasure-code/jquery.js
16+
@@ -56,7 +56,8 @@ var
17+
18+
// A simple way to check for HTML strings
19+
// Prioritize #id over <tag> to avoid XSS via location.hash (#9521)
20+
- rquickExpr = /^(?:[^#<]*(<[\w\W]+>)[^>]*$|#([\w\-]*)$)/,
21+
+ // Strict HTML recognition (#11290: must start with <)
22+
+ rquickExpr = /^(?:(<[\w\W]+>)[^>]*|#([\w-]*))$/,
23+
24+
// Match a standalone tag
25+
rsingleTag = /^<(\w+)\s*\/?>(?:<\/\1>|)$/,
26+
--
27+
2.34.1
28+

‎SPECS/ceph/CVE-2014-5461.patch

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
From 4c6ecee6fcb3c3deead402098c6de1cfd53bb91b Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Tue, 28 Jan 2025 15:47:50 -0800
4+
Subject: [PATCH] Patch ceph to fix CVE-2014-5461
5+
6+
Stack overflow in vararg functions with many fixed parameters called
7+
with few arguments.
8+
9+
Link: https://www.lua.org/bugs.html#5.2.2-1
10+
---
11+
.../3rdparty/civetweb/src/third_party/lua-5.1.5/src/ldo.c | 2 +-
12+
1 file changed, 1 insertion(+), 1 deletion(-)
13+
14+
diff --git a/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/third_party/lua-5.1.5/src/ldo.c b/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/third_party/lua-5.1.5/src/ldo.c
15+
index d1bf786cb..30333bfa5 100644
16+
--- a/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/third_party/lua-5.1.5/src/ldo.c
17+
+++ b/src/jaegertracing/opentelemetry-cpp/third_party/prometheus-cpp/3rdparty/civetweb/src/third_party/lua-5.1.5/src/ldo.c
18+
@@ -274,7 +274,7 @@ int luaD_precall (lua_State *L, StkId func, int nresults) {
19+
CallInfo *ci;
20+
StkId st, base;
21+
Proto *p = cl->p;
22+
- luaD_checkstack(L, p->maxstacksize);
23+
+ luaD_checkstack(L, p->maxstacksize + p->numparams);
24+
func = restorestack(L, funcr);
25+
if (!p->is_vararg) { /* no varargs? */
26+
base = func + 1;
27+
--
28+
2.34.1
29+

‎SPECS/ceph/CVE-2015-9251.patch

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
From 124fa2abfde0939c5a7684be1c9f11565888a3a5 Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Tue, 28 Jan 2025 17:30:43 -0800
4+
Subject: [PATCH] [Medium] Patch ceph to fix CVE-2015-9251
5+
6+
Link: https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc.patch
7+
---
8+
qa/workunits/erasure-code/jquery.js | 8 ++++++++
9+
1 file changed, 8 insertions(+)
10+
11+
diff --git a/qa/workunits/erasure-code/jquery.js b/qa/workunits/erasure-code/jquery.js
12+
index 8c24ffc61..f4ce660b1 100644
13+
--- a/qa/workunits/erasure-code/jquery.js
14+
+++ b/qa/workunits/erasure-code/jquery.js
15+
@@ -8245,6 +8245,14 @@ jQuery.ajaxPrefilter( "json jsonp", function( s, originalSettings, jqXHR ) {
16+
return "script";
17+
}
18+
});
19+
+
20+
+// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432)
21+
+jQuery.ajaxPrefilter( function( s ) {
22+
+ if ( s.crossDomain ) {
23+
+ s.contents.script = false;
24+
+ }
25+
+} );
26+
+
27+
// Install script dataType
28+
jQuery.ajaxSetup({
29+
accepts: {
30+
--
31+
2.34.1
32+

‎SPECS/ceph/CVE-2020-22217.patch

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From 97568ddb836a9680c93335a3f8ca0f2c0616ccdc Mon Sep 17 00:00:00 2001
2+
From: Kevin Lockwood <[email protected]>
3+
Date: Mon, 27 Jan 2025 16:19:53 -0800
4+
Subject: [PATCH] Fix CVE-2020-22217 in c-ares
5+
6+
Link: https://github.com/c-ares/c-ares/pull/332
7+
---
8+
src/c-ares/ares_parse_soa_reply.c | 3 +++
9+
1 file changed, 3 insertions(+)
10+
11+
diff --git a/src/c-ares/ares_parse_soa_reply.c b/src/c-ares/ares_parse_soa_reply.c
12+
index 35af0a75c..5924bbca9 100644
13+
--- a/src/c-ares/ares_parse_soa_reply.c
14+
+++ b/src/c-ares/ares_parse_soa_reply.c
15+
@@ -65,6 +65,9 @@ ares_parse_soa_reply(const unsigned char *abuf, int alen,
16+
status = ares__expand_name_for_response(aptr, abuf, alen, &qname, &len);
17+
if (status != ARES_SUCCESS)
18+
goto failed_stat;
19+
+
20+
+ if (alen <= len + HFIXEDSZ + 1)
21+
+ goto failed;
22+
aptr += len;
23+
24+
/* skip qtype & qclass */
25+
--
26+
2.34.1
27+

‎SPECS/ceph/ceph.spec

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
#disable debuginfo because ceph-debuginfo rpm is too large
22
%define debug_package %{nil}
33
%define _unpackaged_files_terminate_build 0
4-
4+
55
Summary: User space components of the Ceph file system
66
Name: ceph
77
Version: 18.2.2
8-
Release: 3%{?dist}
8+
Release: 4%{?dist}
99
License: LGPLv2 and LGPLv3 and CC-BY-SA and GPLv2 and Boost and BSD and MIT and Public Domain and GPLv3 and ASL-2.0
1010
URL: https://ceph.io/
1111
Vendor: Microsoft Corporation
@@ -14,6 +14,10 @@ Source0: https://download.ceph.com/tarballs/%{name}-%{version}.tar.gz
1414
Patch0: 0034-src-pybind-rbd-rbd.pyx.patch
1515
Patch1: 0032-cmake-modules-BuildBoost.cmake.patch
1616
Patch2: CVE-2024-52338.patch
17+
Patch3: CVE-2014-5461.patch
18+
Patch4: CVE-2020-22217.patch
19+
Patch5: CVE-2015-9251.patch
20+
Patch6: CVE-2012-6708.patch
1721
#
1822
# Copyright (C) 2004-2019 The Ceph Project Developers. See COPYING file
1923
# at the top-level directory of this distribution and at
@@ -895,7 +899,7 @@ This package provides a Ceph hardware monitoring agent.
895899
# common
896900
#################################################################################
897901
%prep
898-
%autosetup -p1
902+
%autosetup -p1
899903

900904
%build
901905
pwd
@@ -2004,6 +2008,12 @@ exit 0
20042008

20052009

20062010
%changelog
2011+
* Tue Jan 28 2025 Kevin Lockwood <[email protected]> - 18.2.2-4
2012+
- Fix for CVE-2014-5461
2013+
- Fix for CVE-2020-22217
2014+
- Fix for CVE-2015-9251
2015+
- Fix for CVE-2012-6708
2016+
20072017
* Tue Jan 01 2025 Sandeep Karambelkar <[email protected]> - 18.2.2-3
20082018
- Based on the package build logs, opentelemetry-cpp submodule is not being built
20092019
- Removing opentelemetry-cpp to address below CVEs as this submodule is not relevant

0 commit comments

Comments
 (0)