Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (cd366ca2ac333a1720ab1d47a4884ca6bbc53ebb)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Treeve Jelbert <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (cd366ca2ac333a1720ab1d47a4884ca6bbc53ebb)
  • Date: Fri, 28 Aug 2020 08:38:44 +0000

GIT changes to master grimoire by Treeve Jelbert <treeve AT sourcemage.org>:

kde5-utils/ark/DETAILS | 2 -
kde5-utils/ark/HISTORY | 4 ++
kde5-utils/ark/PRE_BUILD | 1
kde5-utils/ark/patches/cve.patch | 41 ---------------------------
kde5-utils/ark/patches/symlink.patch | 53
+++++++++++++++++++++++++++++++++++
5 files changed, 59 insertions(+), 42 deletions(-)

New commits:
commit cd366ca2ac333a1720ab1d47a4884ca6bbc53ebb
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>

ark - SECURITY FIX - CVE-2020-24654

diff --git a/kde5-utils/ark/DETAILS b/kde5-utils/ark/DETAILS
index 63b344a..ef54790 100644
--- a/kde5-utils/ark/DETAILS
+++ b/kde5-utils/ark/DETAILS
@@ -9,7 +9,7 @@
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
WEB_SITE=https://www.kde.org/release-service/utilities/ark
ENTERED=20110821
- SECURITY_PATCH=1
+ SECURITY_PATCH=2
LICENSE[0]=GPL
KEYWORDS="kde5"
SHORT="archive utility for KDE"
diff --git a/kde5-utils/ark/HISTORY b/kde5-utils/ark/HISTORY
index ea0945e3..8651ef5 100644
--- a/kde5-utils/ark/HISTORY
+++ b/kde5-utils/ark/HISTORY
@@ -1,3 +1,7 @@
+2020-08-28 Treeve Jelbert <treeve AT sourcemage.org>
+ * patches/symlink.patch: added, fix CVE-2020-24654
+ * PRE_BUILD: adjust
+
2020-08-13 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 20.08.0

diff --git a/kde5-utils/ark/PRE_BUILD b/kde5-utils/ark/PRE_BUILD
index 2b28599..7d6b041 100755
--- a/kde5-utils/ark/PRE_BUILD
+++ b/kde5-utils/ark/PRE_BUILD
@@ -1,3 +1,4 @@
default_pre_build &&
cd $SOURCE_DIRECTORY &&
sed -i '/update_xdg_mimetypes/D' kerfuffle/CMakeLists.txt
+apply_patch_dir patches
diff --git a/kde5-utils/ark/patches/cve.patch
b/kde5-utils/ark/patches/cve.patch
deleted file mode 100644
index a258ed8..0000000
--- a/kde5-utils/ark/patches/cve.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-commit 0df592524fed305d6fbe74ddf8a196bc9ffdb92f
-Author: Elvis Angelaccio <elvis.angelaccio AT kde.org>
-Date: Wed Jul 29 23:45:30 2020 +0200
-
- Fix vulnerability to path traversal attacks
-
- Ark was vulnerable to directory traversal attacks because of
- missing validation of file paths in the archive.
-
- More details about this attack are available at:
- https://github.com/snyk/zip-slip-vulnerability
-
- Job::onEntry() is the only place where we can safely check the path of
- every entry in the archive. There shouldn't be a valid reason
- to have a "../" in an archive path, so we can just play safe and abort
- the LoadJob if we detect such an entry. This makes impossibile to
- extract this kind of malicious archives and perform the attack.
-
- Thanks to Albert Astals Cid for suggesting to use QDir::cleanPath()
- so that we can still allow loading of legitimate archives that
- contain "../" in their paths but still resolve inside the extraction
folder.
-
-diff --git a/kerfuffle/jobs.cpp b/kerfuffle/jobs.cpp
-index fdaa4869..f73b56f8 100644
---- a/kerfuffle/jobs.cpp
-+++ b/kerfuffle/jobs.cpp
-@@ -180,6 +180,14 @@ void Job::onError(const QString & message, const
QString & details)
-
- void Job::onEntry(Archive::Entry *entry)
- {
-+ const QString entryFullPath = entry->fullPath();
-+ if (QDir::cleanPath(entryFullPath).contains(QLatin1String("../"))) {
-+ qCWarning(ARK) << "Possibly malicious archive. Detected entry that
could lead to a directory traversal attack:" << entryFullPath;
-+ onError(i18n("Could not load the archive because it contains
ill-formed entries and might be a malicious archive."), QString());
-+ onFinished(false);
-+ return;
-+ }
-+
- emit newEntry(entry);
- }
-
diff --git a/kde5-utils/ark/patches/symlink.patch
b/kde5-utils/ark/patches/symlink.patch
new file mode 100644
index 0000000..8b38218
--- /dev/null
+++ b/kde5-utils/ark/patches/symlink.patch
@@ -0,0 +1,53 @@
+From 8bf8c5ef07b0ac5e914d752681e470dea403a5bd Mon Sep 17 00:00:00 2001
+From: Fabian Vogt <fabian AT ritter-vogt.de>
+Date: Tue, 25 Aug 2020 22:14:37 +0200
+Subject: [PATCH] Pass the ARCHIVE_EXTRACT_SECURE_SYMLINKS flag to libarchive
+
+There are archive types which allow to first create a symlink and then
+later on dereference it. If the symlink points outside of the archive,
+this results in writing outside of the destination directory.
+
+With the ARCHIVE_EXTRACT_SECURE_SYMLINKS option set, libarchive avoids
+this situation by verifying that none of the target path components are
+symlinks before writing.
+
+Remove the commented out code in the method, which would actually
+misbehave if enabled again.
+
+Signed-off-by: Fabian Vogt <fabian AT ritter-vogt.de>
+---
+ plugins/libarchive/libarchiveplugin.cpp | 18 +++---------------
+ 1 file changed, 3 insertions(+), 15 deletions(-)
+
+diff --git a/plugins/libarchive/libarchiveplugin.cpp
b/plugins/libarchive/libarchiveplugin.cpp
+index 50e81da1..8a0fed21 100644
+--- a/plugins/libarchive/libarchiveplugin.cpp
++++ b/plugins/libarchive/libarchiveplugin.cpp
+@@ -509,21 +509,9 @@ void LibarchivePlugin::emitEntryFromArchiveEntry(struct
archive_entry *aentry)
+
+ int LibarchivePlugin::extractionFlags() const
+ {
+- int result = ARCHIVE_EXTRACT_TIME;
+- result |= ARCHIVE_EXTRACT_SECURE_NODOTDOT;
+-
+- // TODO: Don't use arksettings here
+- /*if ( ArkSettings::preservePerms() )
+- {
+- result &= ARCHIVE_EXTRACT_PERM;
+- }
+-
+- if ( !ArkSettings::extractOverwrite() )
+- {
+- result &= ARCHIVE_EXTRACT_NO_OVERWRITE;
+- }*/
+-
+- return result;
++ return ARCHIVE_EXTRACT_TIME
++ | ARCHIVE_EXTRACT_SECURE_NODOTDOT
++ | ARCHIVE_EXTRACT_SECURE_SYMLINKS;
+ }
+
+ void LibarchivePlugin::copyData(const QString& filename, struct archive
*dest, bool partialprogress)
+--
+GitLab
+



  • [SM-Commit] GIT changes to master grimoire by Treeve Jelbert (cd366ca2ac333a1720ab1d47a4884ca6bbc53ebb), Treeve Jelbert, 08/28/2020

Archive powered by MHonArc 2.6.24.

Top of Page