summaryrefslogtreecommitdiffstats
path: root/php-cve-2023-3247.patch
diff options
context:
space:
mode:
authorRemi Collet <remi@remirepo.net>2023-06-21 11:09:59 +0200
committerRemi Collet <remi@php.net>2023-06-21 11:09:59 +0200
commitc8645533f9515a9368bd6b0e94a75fa979142cee (patch)
treebd2cd6b916dfd532129d8c58d07f49069b35ccbe /php-cve-2023-3247.patch
parentd424f87c842ea2db86df7feebe21017dd3d5a394 (diff)
fix possible buffer overflow in date
define %php56___phpize and %php56___phpconfig
Diffstat (limited to 'php-cve-2023-3247.patch')
-rw-r--r--php-cve-2023-3247.patch75
1 files changed, 75 insertions, 0 deletions
diff --git a/php-cve-2023-3247.patch b/php-cve-2023-3247.patch
new file mode 100644
index 0000000..19c398d
--- /dev/null
+++ b/php-cve-2023-3247.patch
@@ -0,0 +1,75 @@
+From 66e67c73b83b42234530b6681dc16aac5efaf0f7 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi@remirepo.net>
+Date: Wed, 7 Jun 2023 10:11:02 +0200
+Subject: [PATCH] Increase random bytes in HTTP Digest authentication for SOAP
+ Minimal fix for GHSA-76gg-c692-v2mw
+
+---
+ NEWS | 6 ++++++
+ ext/soap/php_http.c | 7 +++++--
+ 2 files changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/NEWS b/NEWS
+index c9e6f7d3285..d32f3d7a874 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,6 +1,12 @@
+ PHP NEWS
+ |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+
++Backported from 8.0.29
++
++- Soap:
++ . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
++ bytes in HTTP Digest authentication for SOAP). (nielsdos, timwolla)
++
+ Backported from 8.0.28
+
+ - Core:
+diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
+index 324609197ad..f3935cb1b79 100644
+--- a/ext/soap/php_http.c
++++ b/ext/soap/php_http.c
+@@ -639,10 +639,13 @@ int make_http_soap_request(zval *this_ptr,
+ char HA1[33], HA2[33], response[33], cnonce[33], nc[9];
+ PHP_MD5_CTX md5ctx;
+ unsigned char hash[16];
++ int i;
+
+ PHP_MD5Init(&md5ctx);
+- snprintf(cnonce, sizeof(cnonce), "%ld", php_rand(TSRMLS_C));
+- PHP_MD5Update(&md5ctx, (unsigned char*)cnonce, strlen(cnonce));
++ for (i = 0; i < 4; i++) { /* 16 bytes of randomness*/
++ snprintf(cnonce, sizeof(cnonce), "%ld", php_rand(TSRMLS_C));
++ PHP_MD5Update(&md5ctx, (unsigned char*)cnonce, strlen(cnonce));
++ }
+ PHP_MD5Final(hash, &md5ctx);
+ make_digest(cnonce, hash);
+
+From 486045f99833aa889be7a434a663fdf108a22992 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi@remirepo.net>
+Date: Thu, 15 Jun 2023 08:47:55 +0200
+Subject: [PATCH] add cve
+
+(cherry picked from commit f3021d66d7bb42d2578530cc94f9bde47e58eb10)
+---
+ NEWS | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/NEWS b/NEWS
+index d32f3d7a87..a658151942 100644
+--- a/NEWS
++++ b/NEWS
+@@ -5,7 +5,8 @@ Backported from 8.0.29
+
+ - Soap:
+ . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
+- bytes in HTTP Digest authentication for SOAP). (nielsdos, timwolla)
++ bytes in HTTP Digest authentication for SOAP).
++ (CVE-2023-3247) (nielsdos, timwolla)
+
+ Backported from 8.0.28
+
+--
+2.40.1
+