diff options
| author | Remi Collet <remi@remirepo.net> | 2023-06-21 11:09:59 +0200 |
|---|---|---|
| committer | Remi Collet <remi@php.net> | 2023-06-21 11:09:59 +0200 |
| commit | c8645533f9515a9368bd6b0e94a75fa979142cee (patch) | |
| tree | bd2cd6b916dfd532129d8c58d07f49069b35ccbe /php-cve-2023-3247.patch | |
| parent | d424f87c842ea2db86df7feebe21017dd3d5a394 (diff) | |
fix possible buffer overflow in date
define %php56___phpize and %php56___phpconfig
Diffstat (limited to 'php-cve-2023-3247.patch')
| -rw-r--r-- | php-cve-2023-3247.patch | 75 |
1 files changed, 75 insertions, 0 deletions
diff --git a/php-cve-2023-3247.patch b/php-cve-2023-3247.patch new file mode 100644 index 0000000..19c398d --- /dev/null +++ b/php-cve-2023-3247.patch @@ -0,0 +1,75 @@ +From 66e67c73b83b42234530b6681dc16aac5efaf0f7 Mon Sep 17 00:00:00 2001 +From: Remi Collet <remi@remirepo.net> +Date: Wed, 7 Jun 2023 10:11:02 +0200 +Subject: [PATCH] Increase random bytes in HTTP Digest authentication for SOAP + Minimal fix for GHSA-76gg-c692-v2mw + +--- + NEWS | 6 ++++++ + ext/soap/php_http.c | 7 +++++-- + 2 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/NEWS b/NEWS +index c9e6f7d3285..d32f3d7a874 100644 +--- a/NEWS ++++ b/NEWS +@@ -1,6 +1,12 @@ + PHP NEWS + ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| + ++Backported from 8.0.29 ++ ++- Soap: ++ . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random ++ bytes in HTTP Digest authentication for SOAP). (nielsdos, timwolla) ++ + Backported from 8.0.28 + + - Core: +diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c +index 324609197ad..f3935cb1b79 100644 +--- a/ext/soap/php_http.c ++++ b/ext/soap/php_http.c +@@ -639,10 +639,13 @@ int make_http_soap_request(zval *this_ptr, + char HA1[33], HA2[33], response[33], cnonce[33], nc[9]; + PHP_MD5_CTX md5ctx; + unsigned char hash[16]; ++ int i; + + PHP_MD5Init(&md5ctx); +- snprintf(cnonce, sizeof(cnonce), "%ld", php_rand(TSRMLS_C)); +- PHP_MD5Update(&md5ctx, (unsigned char*)cnonce, strlen(cnonce)); ++ for (i = 0; i < 4; i++) { /* 16 bytes of randomness*/ ++ snprintf(cnonce, sizeof(cnonce), "%ld", php_rand(TSRMLS_C)); ++ PHP_MD5Update(&md5ctx, (unsigned char*)cnonce, strlen(cnonce)); ++ } + PHP_MD5Final(hash, &md5ctx); + make_digest(cnonce, hash); + +From 486045f99833aa889be7a434a663fdf108a22992 Mon Sep 17 00:00:00 2001 +From: Remi Collet <remi@remirepo.net> +Date: Thu, 15 Jun 2023 08:47:55 +0200 +Subject: [PATCH] add cve + +(cherry picked from commit f3021d66d7bb42d2578530cc94f9bde47e58eb10) +--- + NEWS | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/NEWS b/NEWS +index d32f3d7a87..a658151942 100644 +--- a/NEWS ++++ b/NEWS +@@ -5,7 +5,8 @@ Backported from 8.0.29 + + - Soap: + . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random +- bytes in HTTP Digest authentication for SOAP). (nielsdos, timwolla) ++ bytes in HTTP Digest authentication for SOAP). ++ (CVE-2023-3247) (nielsdos, timwolla) + + Backported from 8.0.28 + +-- +2.40.1 + |