Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (676a65686a676278860f349553bcd30871d9a3c6)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Treeve Jelbert <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (676a65686a676278860f349553bcd30871d9a3c6)
  • Date: Sun, 2 Aug 2020 12:44:31 +0000

GIT changes to master grimoire by Treeve Jelbert <treeve AT sourcemage.org>:

kde5-utils/ark/DETAILS | 2 -
kde5-utils/ark/HISTORY | 4 +++
kde5-utils/ark/PRE_BUILD | 1
kde5-utils/ark/patches/cve.patch | 41
+++++++++++++++++++++++++++++++++++++++
4 files changed, 47 insertions(+), 1 deletion(-)

New commits:
commit 676a65686a676278860f349553bcd30871d9a3c6
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>

ark - SECURIT FIX

diff --git a/kde5-utils/ark/DETAILS b/kde5-utils/ark/DETAILS
index ec39fa1..81fc816 100644
--- a/kde5-utils/ark/DETAILS
+++ b/kde5-utils/ark/DETAILS
@@ -9,7 +9,7 @@
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
WEB_SITE=https://www.kde.org/release-service/utilities/ark
ENTERED=20110821
-# SECURITY_PATCH=1
+ SECURITY_PATCH=1
LICENSE[0]=GPL
KEYWORDS="kde5"
SHORT="archive utility for KDE"
diff --git a/kde5-utils/ark/HISTORY b/kde5-utils/ark/HISTORY
index 3862448..09f4288 100644
--- a/kde5-utils/ark/HISTORY
+++ b/kde5-utils/ark/HISTORY
@@ -1,3 +1,7 @@
+2020-08-02Treeve Jelbert <treeve AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++
+ * patches/cve.patch: added
+
2020-07-09 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 20.04.3

diff --git a/kde5-utils/ark/PRE_BUILD b/kde5-utils/ark/PRE_BUILD
index 2b28599..9e88470 100755
--- a/kde5-utils/ark/PRE_BUILD
+++ b/kde5-utils/ark/PRE_BUILD
@@ -1,3 +1,4 @@
default_pre_build &&
cd $SOURCE_DIRECTORY &&
+apply_patch_dir patches &&
sed -i '/update_xdg_mimetypes/D' kerfuffle/CMakeLists.txt
diff --git a/kde5-utils/ark/patches/cve.patch
b/kde5-utils/ark/patches/cve.patch
new file mode 100644
index 0000000..a258ed8
--- /dev/null
+++ b/kde5-utils/ark/patches/cve.patch
@@ -0,0 +1,41 @@
+commit 0df592524fed305d6fbe74ddf8a196bc9ffdb92f
+Author: Elvis Angelaccio <elvis.angelaccio AT kde.org>
+Date: Wed Jul 29 23:45:30 2020 +0200
+
+ Fix vulnerability to path traversal attacks
+
+ Ark was vulnerable to directory traversal attacks because of
+ missing validation of file paths in the archive.
+
+ More details about this attack are available at:
+ https://github.com/snyk/zip-slip-vulnerability
+
+ Job::onEntry() is the only place where we can safely check the path of
+ every entry in the archive. There shouldn't be a valid reason
+ to have a "../" in an archive path, so we can just play safe and abort
+ the LoadJob if we detect such an entry. This makes impossibile to
+ extract this kind of malicious archives and perform the attack.
+
+ Thanks to Albert Astals Cid for suggesting to use QDir::cleanPath()
+ so that we can still allow loading of legitimate archives that
+ contain "../" in their paths but still resolve inside the extraction
folder.
+
+diff --git a/kerfuffle/jobs.cpp b/kerfuffle/jobs.cpp
+index fdaa4869..f73b56f8 100644
+--- a/kerfuffle/jobs.cpp
++++ b/kerfuffle/jobs.cpp
+@@ -180,6 +180,14 @@ void Job::onError(const QString & message, const
QString & details)
+
+ void Job::onEntry(Archive::Entry *entry)
+ {
++ const QString entryFullPath = entry->fullPath();
++ if (QDir::cleanPath(entryFullPath).contains(QLatin1String("../"))) {
++ qCWarning(ARK) << "Possibly malicious archive. Detected entry that
could lead to a directory traversal attack:" << entryFullPath;
++ onError(i18n("Could not load the archive because it contains
ill-formed entries and might be a malicious archive."), QString());
++ onFinished(false);
++ return;
++ }
++
+ emit newEntry(entry);
+ }
+



  • [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (676a65686a676278860f349553bcd30871d9a3c6), Treeve Jelbert, 08/02/2020

Archive powered by MHonArc 2.6.24.

Top of Page