1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
From 66e67c73b83b42234530b6681dc16aac5efaf0f7 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Wed, 7 Jun 2023 10:11:02 +0200
Subject: [PATCH] Increase random bytes in HTTP Digest authentication for SOAP
Minimal fix for GHSA-76gg-c692-v2mw
---
NEWS | 6 ++++++
ext/soap/php_http.c | 7 +++++--
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/NEWS b/NEWS
index c9e6f7d3285..d32f3d7a874 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,12 @@
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+Backported from 8.0.29
+
+- Soap:
+ . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
+ bytes in HTTP Digest authentication for SOAP). (nielsdos, timwolla)
+
Backported from 8.0.28
- Core:
diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
index 324609197ad..f3935cb1b79 100644
--- a/ext/soap/php_http.c
+++ b/ext/soap/php_http.c
@@ -639,10 +639,13 @@ int make_http_soap_request(zval *this_ptr,
char HA1[33], HA2[33], response[33], cnonce[33], nc[9];
PHP_MD5_CTX md5ctx;
unsigned char hash[16];
+ int i;
PHP_MD5Init(&md5ctx);
- snprintf(cnonce, sizeof(cnonce), "%ld", php_rand(TSRMLS_C));
- PHP_MD5Update(&md5ctx, (unsigned char*)cnonce, strlen(cnonce));
+ for (i = 0; i < 4; i++) { /* 16 bytes of randomness*/
+ snprintf(cnonce, sizeof(cnonce), "%ld", php_rand(TSRMLS_C));
+ PHP_MD5Update(&md5ctx, (unsigned char*)cnonce, strlen(cnonce));
+ }
PHP_MD5Final(hash, &md5ctx);
make_digest(cnonce, hash);
From 486045f99833aa889be7a434a663fdf108a22992 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Thu, 15 Jun 2023 08:47:55 +0200
Subject: [PATCH] add cve
(cherry picked from commit f3021d66d7bb42d2578530cc94f9bde47e58eb10)
---
NEWS | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/NEWS b/NEWS
index d32f3d7a87..a658151942 100644
--- a/NEWS
+++ b/NEWS
@@ -5,7 +5,8 @@ Backported from 8.0.29
- Soap:
. Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
- bytes in HTTP Digest authentication for SOAP). (nielsdos, timwolla)
+ bytes in HTTP Digest authentication for SOAP).
+ (CVE-2023-3247) (nielsdos, timwolla)
Backported from 8.0.28
--
2.40.1
|
