diff options
| author |  Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> | 2020-08-04 16:00:08 +0200 |
|---|---|---|
| committer |  Peter Korsgaard <peter@korsgaard.com> | 2020-08-05 22:18:29 +0200 |
| commit | 7e90b0171f4c4ab4c8b0f76079255261270ef61b (patch) | |
| tree | 57eab912e005e37443ecec9767c82b6bb9dd9aba | |
| parent | 37b5713442e894cb7e439f6a29d1ed32c81d9bba (diff) | |
| download | buildroot-7e90b0171f4c4ab4c8b0f76079255261270ef61b.tar.gz buildroot-7e90b0171f4c4ab4c8b0f76079255261270ef61b.tar.bz2 | |
package/dropbear: backport security fix for CVE-2018-20685
The update to 2020.79 contains several other changes that may not be
appropriate for the LTS branch, hence just backport the single fix.
Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
| -rw-r--r-- | package/dropbear/0001-scp-Port-OpenSSH-CVE-2018-20685-fix.patch | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/package/dropbear/0001-scp-Port-OpenSSH-CVE-2018-20685-fix.patch b/package/dropbear/0001-scp-Port-OpenSSH-CVE-2018-20685-fix.patch new file mode 100644 index 0000000000..4372d615d6 --- /dev/null +++ b/package/dropbear/0001-scp-Port-OpenSSH-CVE-2018-20685-fix.patch @@ -0,0 +1,24 @@ +# HG changeset patch +# User Haelwenn Monnier <contact+github.com@hacktivis.me> +# Date 1590411269 -7200 +# Mon May 25 14:54:29 2020 +0200 +# Node ID 087c2804147074c95b6a3f35137b4f4b726b1452 +# Parent 009d52ae26d35f3381c801e02318fa9be34be93c +scp.c: Port OpenSSH CVE-2018-20685 fix (#80) + +[backport from 2020.79 to 2019.78 for Buildroot 2020.02.x] +Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> + +diff --git a/scp.c b/scp.c +--- a/scp.c ++++ b/scp.c +@@ -935,7 +935,8 @@ sink(int argc, char **argv) + size = size * 10 + (*cp++ - '0'); + if (*cp++ != ' ') + SCREWUP("size not delimited"); +- if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) { ++ if (*cp == '\0' || strchr(cp, '/') != NULL || ++ strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) { + run_err("error: unexpected filename: %s", cp); + exit(1); + } |