!34 openEuler-20.03-LTS-Next: Fix CVE-2020-7062 CVE-2020-7071
From: @hugel Reviewed-by: @small_leek Signed-off-by: @small_leek
This commit is contained in:
openeuler-ci-bot
Gitee
commit
bf907554c0
84
backport-CVE-2020-7062-Fix-bug-79221.patch
Normal file
84
backport-CVE-2020-7062-Fix-bug-79221.patch
Normal file
@ -0,0 +1,84 @@
|
||||
From 90ae1818d54b3017ed114d45e83924eebafdb7d7 Mon Sep 17 00:00:00 2001
|
||||
From: Stanislav Malyshev <stas@php.net>
|
||||
Date: Sat, 15 Feb 2020 20:52:19 -0800
|
||||
Subject: [PATCH] Fix bug #79221 - Null Pointer Dereference in PHP Session
|
||||
Upload Progress
|
||||
|
||||
---
|
||||
ext/session/session.c | 10 +++++---
|
||||
ext/session/tests/bug79221.phpt | 45 +++++++++++++++++++++++++++++++++
|
||||
2 files changed, 51 insertions(+), 4 deletions(-)
|
||||
create mode 100644 ext/session/tests/bug79221.phpt
|
||||
|
||||
diff --git a/ext/session/session.c b/ext/session/session.c
|
||||
index 0470ba1fc645..ad299209b6a4 100644
|
||||
--- a/ext/session/session.c
|
||||
+++ b/ext/session/session.c
|
||||
@@ -3217,10 +3217,12 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
|
||||
if (PS(rfc1867_cleanup)) {
|
||||
php_session_rfc1867_cleanup(progress);
|
||||
} else {
|
||||
- SEPARATE_ARRAY(&progress->data);
|
||||
- add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1);
|
||||
- Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
|
||||
- php_session_rfc1867_update(progress, 1);
|
||||
+ if (!Z_ISUNDEF(progress->data)) {
|
||||
+ SEPARATE_ARRAY(&progress->data);
|
||||
+ add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1);
|
||||
+ Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
|
||||
+ php_session_rfc1867_update(progress, 1);
|
||||
+ }
|
||||
}
|
||||
php_rshutdown_session_globals();
|
||||
}
|
||||
diff --git a/ext/session/tests/bug79221.phpt b/ext/session/tests/bug79221.phpt
|
||||
new file mode 100644
|
||||
index 000000000000..b0972c469705
|
||||
--- /dev/null
|
||||
+++ b/ext/session/tests/bug79221.phpt
|
||||
@@ -0,0 +1,45 @@
|
||||
+--TEST--
|
||||
+Null Pointer Dereference in PHP Session Upload Progress
|
||||
+--INI--
|
||||
+error_reporting=0
|
||||
+file_uploads=1
|
||||
+upload_max_filesize=1024
|
||||
+session.save_path=
|
||||
+session.name=PHPSESSID
|
||||
+session.serialize_handler=php
|
||||
+session.use_strict_mode=0
|
||||
+session.use_cookies=1
|
||||
+session.use_only_cookies=0
|
||||
+session.upload_progress.enabled=1
|
||||
+session.upload_progress.cleanup=0
|
||||
+session.upload_progress.prefix=upload_progress_
|
||||
+session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS
|
||||
+session.upload_progress.freq=1%
|
||||
+session.upload_progress.min_freq=0.000000001
|
||||
+--COOKIE--
|
||||
+PHPSESSID=session-upload
|
||||
+--POST_RAW--
|
||||
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
|
||||
+-----------------------------20896060251896012921717172737
|
||||
+Content-Disposition: form-data; name="PHPSESSID"
|
||||
+
|
||||
+session-upload
|
||||
+-----------------------------20896060251896012921717172737
|
||||
+Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"
|
||||
+
|
||||
+ryat
|
||||
+-----------------------------20896060251896012921717172737
|
||||
+Content-Disposition: form-data; file="file"; ryat="filename"
|
||||
+
|
||||
+1
|
||||
+-----------------------------20896060251896012921717172737--
|
||||
+--FILE--
|
||||
+<?php
|
||||
+
|
||||
+session_start();
|
||||
+var_dump($_SESSION);
|
||||
+session_destroy();
|
||||
+
|
||||
+--EXPECTF--
|
||||
+array(0) {
|
||||
+}
|
||||
196
backport-CVE-2020-7071-Fix-bug-77423.patch
Normal file
196
backport-CVE-2020-7071-Fix-bug-77423.patch
Normal file
@ -0,0 +1,196 @@
|
||||
From 2d3d72412a6734e19a38ed10f385227a6238e4a6 Mon Sep 17 00:00:00 2001
|
||||
From: "Christoph M. Becker" <cmbecker69@gmx.de>
|
||||
Date: Wed, 13 May 2020 09:36:52 +0200
|
||||
Subject: [PATCH] Fix #77423: parse_url() will deliver a wrong host to user
|
||||
|
||||
To avoid that `parse_url()` returns an erroneous host, which would be
|
||||
valid for `FILTER_VALIDATE_URL`, we make sure that only userinfo which
|
||||
is valid according to RFC 3986 is treated as such.
|
||||
|
||||
For consistency with the existing url parsing code, we use ctype
|
||||
functions, although that is not necessarily correct.
|
||||
---
|
||||
ext/standard/tests/strings/url_t.phpt | 6 ++--
|
||||
ext/standard/tests/url/bug77423.phpt | 30 +++++++++++++++++++
|
||||
.../tests/url/parse_url_basic_001.phpt | 6 ++--
|
||||
.../tests/url/parse_url_basic_003.phpt | 2 +-
|
||||
.../tests/url/parse_url_basic_005.phpt | 2 +-
|
||||
.../tests/url/parse_url_unterminated.phpt | 6 ++--
|
||||
ext/standard/url.c | 21 +++++++++++++
|
||||
7 files changed, 59 insertions(+), 14 deletions(-)
|
||||
create mode 100644 ext/standard/tests/url/bug77423.phpt
|
||||
|
||||
diff --git a/ext/standard/tests/strings/url_t.phpt b/ext/standard/tests/strings/url_t.phpt
|
||||
index 79ff3bc4a8e3..f564f59f0632 100644
|
||||
--- a/ext/standard/tests/strings/url_t.phpt
|
||||
+++ b/ext/standard/tests/strings/url_t.phpt
|
||||
@@ -575,15 +575,13 @@ $sample_urls = array (
|
||||
string(16) "some_page_ref123"
|
||||
}
|
||||
|
||||
---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
|
||||
+--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
|
||||
["scheme"]=>
|
||||
string(4) "http"
|
||||
["host"]=>
|
||||
- string(11) "www.php.net"
|
||||
+ string(26) "secret@hideout@www.php.net"
|
||||
["port"]=>
|
||||
int(80)
|
||||
- ["user"]=>
|
||||
- string(14) "secret@hideout"
|
||||
["path"]=>
|
||||
string(10) "/index.php"
|
||||
["query"]=>
|
||||
diff --git a/ext/standard/tests/url/bug77423.phpt b/ext/standard/tests/url/bug77423.phpt
|
||||
new file mode 100644
|
||||
index 000000000000..be03fe95e24e
|
||||
--- /dev/null
|
||||
+++ b/ext/standard/tests/url/bug77423.phpt
|
||||
@@ -0,0 +1,30 @@
|
||||
+--TEST--
|
||||
+Bug #77423 (parse_url() will deliver a wrong host to user)
|
||||
+--FILE--
|
||||
+<?php
|
||||
+$urls = array(
|
||||
+ "http://php.net\@aliyun.com/aaa.do",
|
||||
+ "https://example.com\uFF03@bing.com",
|
||||
+);
|
||||
+foreach ($urls as $url) {
|
||||
+ var_dump(filter_var($url, FILTER_VALIDATE_URL));
|
||||
+ var_dump(parse_url($url));
|
||||
+}
|
||||
+?>
|
||||
+--EXPECT--
|
||||
+bool(false)
|
||||
+array(3) {
|
||||
+ ["scheme"]=>
|
||||
+ string(4) "http"
|
||||
+ ["host"]=>
|
||||
+ string(19) "php.net\@aliyun.com"
|
||||
+ ["path"]=>
|
||||
+ string(7) "/aaa.do"
|
||||
+}
|
||||
+bool(false)
|
||||
+array(2) {
|
||||
+ ["scheme"]=>
|
||||
+ string(5) "https"
|
||||
+ ["host"]=>
|
||||
+ string(26) "example.com\uFF03@bing.com"
|
||||
+}
|
||||
diff --git a/ext/standard/tests/url/parse_url_basic_001.phpt b/ext/standard/tests/url/parse_url_basic_001.phpt
|
||||
index 4606849c5781..51010991326c 100644
|
||||
--- a/ext/standard/tests/url/parse_url_basic_001.phpt
|
||||
+++ b/ext/standard/tests/url/parse_url_basic_001.phpt
|
||||
@@ -506,15 +506,13 @@ echo "Done";
|
||||
string(16) "some_page_ref123"
|
||||
}
|
||||
|
||||
---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
|
||||
+--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
|
||||
["scheme"]=>
|
||||
string(4) "http"
|
||||
["host"]=>
|
||||
- string(11) "www.php.net"
|
||||
+ string(26) "secret@hideout@www.php.net"
|
||||
["port"]=>
|
||||
int(80)
|
||||
- ["user"]=>
|
||||
- string(14) "secret@hideout"
|
||||
["path"]=>
|
||||
string(10) "/index.php"
|
||||
["query"]=>
|
||||
diff --git a/ext/standard/tests/url/parse_url_basic_003.phpt b/ext/standard/tests/url/parse_url_basic_003.phpt
|
||||
index 3d5a4a344afd..7968fd3f09fd 100644
|
||||
--- a/ext/standard/tests/url/parse_url_basic_003.phpt
|
||||
+++ b/ext/standard/tests/url/parse_url_basic_003.phpt
|
||||
@@ -68,7 +68,7 @@ echo "Done";
|
||||
--> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
|
||||
--> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
|
||||
--> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
|
||||
---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
|
||||
+--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(26) "secret@hideout@www.php.net"
|
||||
--> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
|
||||
--> nntp://news.php.net : string(12) "news.php.net"
|
||||
--> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : string(11) "ftp.gnu.org"
|
||||
diff --git a/ext/standard/tests/url/parse_url_basic_005.phpt b/ext/standard/tests/url/parse_url_basic_005.phpt
|
||||
index aefb33964bc4..ba778bf9035d 100644
|
||||
--- a/ext/standard/tests/url/parse_url_basic_005.phpt
|
||||
+++ b/ext/standard/tests/url/parse_url_basic_005.phpt
|
||||
@@ -68,7 +68,7 @@ echo "Done";
|
||||
--> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
|
||||
--> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(0) ""
|
||||
--> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
|
||||
---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(14) "secret@hideout"
|
||||
+--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : NULL
|
||||
--> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
|
||||
--> nntp://news.php.net : NULL
|
||||
--> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : NULL
|
||||
diff --git a/ext/standard/tests/url/parse_url_unterminated.phpt b/ext/standard/tests/url/parse_url_unterminated.phpt
|
||||
index 912b6a5641e8..875d93a10948 100644
|
||||
--- a/ext/standard/tests/url/parse_url_unterminated.phpt
|
||||
+++ b/ext/standard/tests/url/parse_url_unterminated.phpt
|
||||
@@ -508,15 +508,13 @@ echo "Done";
|
||||
string(16) "some_page_ref123"
|
||||
}
|
||||
|
||||
---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
|
||||
+--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
|
||||
["scheme"]=>
|
||||
string(4) "http"
|
||||
["host"]=>
|
||||
- string(11) "www.php.net"
|
||||
+ string(26) "secret@hideout@www.php.net"
|
||||
["port"]=>
|
||||
int(80)
|
||||
- ["user"]=>
|
||||
- string(14) "secret@hideout"
|
||||
["path"]=>
|
||||
string(10) "/index.php"
|
||||
["query"]=>
|
||||
diff --git a/ext/standard/url.c b/ext/standard/url.c
|
||||
index 1dd073e2bb42..8d155bb9846c 100644
|
||||
--- a/ext/standard/url.c
|
||||
+++ b/ext/standard/url.c
|
||||
@@ -92,6 +92,22 @@ PHPAPI php_url *php_url_parse(char const *str)
|
||||
return php_url_parse_ex(str, strlen(str));
|
||||
}
|
||||
|
||||
+static int is_userinfo_valid(const char *str, size_t len)
|
||||
+{
|
||||
+ char *valid = "-._~!$&'()*+,;=:";
|
||||
+ char *p = str;
|
||||
+ while (p - str < len) {
|
||||
+ if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
|
||||
+ p++;
|
||||
+ } else if (*p == '%' && p - str <= len - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
|
||||
+ p += 3;
|
||||
+ } else {
|
||||
+ return 0;
|
||||
+ }
|
||||
+ }
|
||||
+ return 1;
|
||||
+}
|
||||
+
|
||||
/* {{{ php_url_parse
|
||||
*/
|
||||
PHPAPI php_url *php_url_parse_ex(char const *str, size_t length)
|
||||
@@ -235,13 +251,18 @@ PHPAPI php_url *php_url_parse_ex(char const *str, size_t length)
|
||||
ret->pass = estrndup(pp, (p-pp));
|
||||
php_replace_controlchars_ex(ret->pass, (p-pp));
|
||||
} else {
|
||||
+ if (!is_userinfo_valid(s, p-s)) {
|
||||
+ goto check_port;
|
||||
+ }
|
||||
ret->user = estrndup(s, (p-s));
|
||||
php_replace_controlchars_ex(ret->user, (p-s));
|
||||
+
|
||||
}
|
||||
|
||||
s = p + 1;
|
||||
}
|
||||
|
||||
+check_port:
|
||||
/* check for port */
|
||||
if (s < ue && *s == '[' && *(e-1) == ']') {
|
||||
/* Short circuit portscan,
|
||||
7
php.spec
7
php.spec
@ -28,7 +28,7 @@
|
||||
|
||||
Name: php
|
||||
Version: %{upver}%{?rcver:~%{rcver}}
|
||||
Release: 10
|
||||
Release: 11
|
||||
Summary: PHP scripting language for creating dynamic web sites
|
||||
License: PHP and Zend and BSD and MIT and ASL 1.0 and NCSA
|
||||
URL: http://www.php.net/
|
||||
@ -98,6 +98,8 @@ Patch6024: CVE-2019-11048.patch
|
||||
Patch6025: CVE-2020-7068.patch
|
||||
Patch6026: CVE-2020-7063.patch
|
||||
Patch6027: backport-CVE-2020-7059-Fix-79099-OOB-read.patch
|
||||
Patch6028: backport-CVE-2020-7062-Fix-bug-79221.patch
|
||||
Patch6029: backport-CVE-2020-7071-Fix-bug-77423.patch
|
||||
|
||||
BuildRequires: bzip2-devel, curl-devel >= 7.9, httpd-devel >= 2.0.46-1, pam-devel, httpd-filesystem, nginx-filesystem
|
||||
BuildRequires: libstdc++-devel, openssl-devel, sqlite-devel >= 3.6.0, zlib-devel, smtpdaemon, libedit-devel
|
||||
@ -1159,6 +1161,9 @@ systemctl try-restart php-fpm.service >/dev/null 2>&1 || :
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Jan 20 2021 Hugel <gengqihu1@huawei.com> - 7.2.10-11
|
||||
- Fix CVE-2020-7062 CVE-2020-7071
|
||||
|
||||
* Fri Jan 15 2021 panxiaohe <panxiaohe@huawei.com> - 7.2.10-10
|
||||
- Fix CVE-2020-7059
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user