amaharaneko/guix-mirrors
1
1
Fork 0
mirror of https://codeberg.org/guix/guix.git synced 2025-10-02 02:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: cvs: Rename patch file.

Browse source 
* gnu/packages/version-control.scm (cvs)[source]: Rename patch.
* gnu/packages/patches/cvs-2017-12836.patch: Rename to ...
* gnu/packages/patches/cvs-CVE-2018-12836.patch: ... this.
* gnu/local.mk (dist_patch_DATA): Register it.
This commit is contained in:
Efraim Flashner 2019-07-10 14:53:04 +03:00
parent 5a4e5c26cc
commit bba3c48970
No known key found for this signature in database
GPG key ID: 41AAE7DCCA3D8351
3 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

45
gnu/packages/patches/cvs-CVE-2017-12836.patch Normal file
View file

@ -0,0 +1,45 @@
Fix CVE-2017-12836:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12836
https://security-tracker.debian.org/tracker/CVE-2017-12836
Patch adpated from Debian (comments and changelog annotations removed):
https://anonscm.debian.org/cgit/collab-maint/cvs.git/commit/?h=stretch&id=41e077396e35efb6c879951f44c62dd8a1d0f094
From 41e077396e35efb6c879951f44c62dd8a1d0f094 Mon Sep 17 00:00:00 2001
From: mirabilos <m@mirbsd.org>
Date: Sat, 12 Aug 2017 03:17:18 +0200
Subject: Fix CVE-2017-12836 (Closes: #871810) for stretch
---
debian/changelog | 6 ++++++
src/rsh-client.c | 10 ++++++++--
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/src/rsh-client.c b/src/rsh-client.c
index fe0cfc4..1fc860d 100644
--- a/src/rsh-client.c
+++ b/src/rsh-client.c
@@ -105,6 +106,9 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p,
rsh_argv[i++] = argvport;
}
+ /* Only non-option arguments from here. (CVE-2017-12836) */
+ rsh_argv[i++] = "--";
+
rsh_argv[i++] = root->hostname;
rsh_argv[i++] = cvs_server;
if (readonlyfs)
@@ -189,6 +193,8 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p,
*p++ = argvport;
}
+ *p++ = "--";
+
*p++ = root->hostname;
*p++ = command;
*p++ = NULL;
--
cgit v0.12