Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package cyrus-sasl for openSUSE:Factory checked in at 2026-10-10 14:58:30 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/cyrus-sasl (Old) and /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "cyrus-sasl" Sat Oct 10 14:58:30 2026 rev:76 rq:1383727 version:2.1.28 Changes: -------- --- /work/SRC/openSUSE:Factory/cyrus-sasl/cyrus-sasl-bdb.changes 2025-12-02 13:18:45.839346032 +0100 +++ /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-bdb.changes 2026-10-10 14:59:10.295457380 +0200 @@ -1,0 +2,14 @@ +Thu Oct 8 12:06:21 UTC 2026 - Peter Varkoly <[email protected]> + +- Fix heap-based buffer overflow in DIGEST-MD5 add_to_challenge(): + buffer size was not recomputed after quoting expanded the value, + allowing a malicious server to overflow the client heap. (bsc#1284687) + * add cyrus-sasl-digestmd5-quote-overflow.patch + +------------------------------------------------------------------- +Mon Dec 29 15:43:45 UTC 2025 - Peter Varkoly <[email protected]> + +- Clean up an synchronize changes +- Fix packages for Immutable Mode - cyrus-sasl (jsc#PED-14856) + +------------------------------------------------------------------- @@ -8,0 +23,6 @@ +Wed Sep 10 02:45:48 UTC 2025 - William Brown <[email protected]> + +- bsc#1247498 - replace insecure MD5 with ephemeral HMAC-SHA256 + * 0001-Use-HMAC-SHA256-for-cache-passwords-over-MD5.patch + +------------------------------------------------------------------- @@ -18 +38 @@ - RC4 is legacy provided since openSSL3 and requires explicit loading, disable openssl3 depricated API warnings. + RC4 is legacy provided since openSSL3 and requires explicit loading, dDisable openssl3 depricated API warnings. --- /work/SRC/openSUSE:Factory/cyrus-sasl/cyrus-sasl-saslauthd-bdb.changes 2025-12-02 13:18:46.487373238 +0100 +++ /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-saslauthd-bdb.changes 2026-10-10 14:59:10.316458258 +0200 @@ -1,0 +2,14 @@ +Thu Oct 8 12:06:21 UTC 2026 - Peter Varkoly <[email protected]> + +- Fix heap-based buffer overflow in DIGEST-MD5 add_to_challenge(): + buffer size was not recomputed after quoting expanded the value, + allowing a malicious server to overflow the client heap. (bsc#1284687) + * add cyrus-sasl-digestmd5-quote-overflow.patch + +------------------------------------------------------------------- +Mon Dec 29 15:43:45 UTC 2025 - Peter Varkoly <[email protected]> + +- Clean up an synchronize changes +- Fix packages for Immutable Mode - cyrus-sasl (jsc#PED-14856) + +------------------------------------------------------------------- @@ -8,0 +23,6 @@ +Wed Sep 10 02:45:48 UTC 2025 - William Brown <[email protected]> + +- bsc#1247498 - replace insecure MD5 with ephemeral HMAC-SHA256 + * 0001-Use-HMAC-SHA256-for-cache-passwords-over-MD5.patch + +------------------------------------------------------------------- @@ -14,0 +35,7 @@ +Thu Sep 19 06:36:56 UTC 2024 - Angel Yankov <[email protected]> + +- Make DIGEST-MD5 work with openssl3 ( bsc#1230111 ) + RC4 is legacy provided since openSSL3 and requires explicit loading, dDisable openssl3 depricated API warnings. + * Add cyrus-sasl-make-digestmd5-work-ssl3.patch + +------------------------------------------------------------------- --- /work/SRC/openSUSE:Factory/cyrus-sasl/cyrus-sasl-saslauthd.changes 2025-12-02 13:18:47.947434539 +0100 +++ /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-saslauthd.changes 2026-10-10 14:59:10.328458760 +0200 @@ -1,0 +2,14 @@ +Thu Oct 8 12:06:21 UTC 2026 - Peter Varkoly <[email protected]> + +- Fix heap-based buffer overflow in DIGEST-MD5 add_to_challenge(): + buffer size was not recomputed after quoting expanded the value, + allowing a malicious server to overflow the client heap. (bsc#1284687) + * add cyrus-sasl-digestmd5-quote-overflow.patch + +------------------------------------------------------------------- +Mon Dec 29 15:43:45 UTC 2025 - Peter Varkoly <[email protected]> + +- Clean up an synchronize changes +- Fix packages for Immutable Mode - cyrus-sasl (jsc#PED-14856) + +------------------------------------------------------------------- @@ -20,0 +35,7 @@ +Thu Sep 19 06:36:56 UTC 2024 - Angel Yankov <[email protected]> + +- Make DIGEST-MD5 work with openssl3 ( bsc#1230111 ) + RC4 is legacy provided since openSSL3 and requires explicit loading, dDisable openssl3 depricated API warnings. + * Add cyrus-sasl-make-digestmd5-work-ssl3.patch + +------------------------------------------------------------------- --- /work/SRC/openSUSE:Factory/cyrus-sasl/cyrus-sasl.changes 2025-12-02 13:18:49.023479716 +0100 +++ /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl.changes 2026-10-10 14:59:10.346459514 +0200 @@ -1,0 +2,15 @@ +Thu Oct 8 12:06:21 UTC 2026 - Peter Varkoly <[email protected]> + +- Fix heap-based buffer overflow in DIGEST-MD5 add_to_challenge(): + buffer size was not recomputed after quoting expanded the value, + allowing a malicious server to overflow the client heap. + (bsc#1284687) CVE-2026-107161 + * add cyrus-sasl-digestmd5-quote-overflow.patch + +------------------------------------------------------------------- +Mon Dec 29 15:43:45 UTC 2025 - Peter Varkoly <[email protected]> + +- Clean up an synchronize changes +- Fix packages for Immutable Mode - cyrus-sasl (jsc#PED-14856) + +------------------------------------------------------------------- @@ -8,0 +24,6 @@ +Wed Sep 10 02:45:48 UTC 2025 - William Brown <[email protected]> + +- bsc#1247498 - replace insecure MD5 with ephemeral HMAC-SHA256 + * 0001-Use-HMAC-SHA256-for-cache-passwords-over-MD5.patch + +------------------------------------------------------------------- New: ---- cyrus-sasl-digestmd5-quote-overflow.patch ----------(New B)---------- New:/work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-bdb.changes- allowing a malicious server to overflow the client heap. (bsc#1284687) /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-bdb.changes: * add cyrus-sasl-digestmd5-quote-overflow.patch /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-bdb.changes- -- /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-saslauthd-bdb.changes- allowing a malicious server to overflow the client heap. (bsc#1284687) /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-saslauthd-bdb.changes: * add cyrus-sasl-digestmd5-quote-overflow.patch /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-saslauthd-bdb.changes- -- /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-saslauthd.changes- allowing a malicious server to overflow the client heap. (bsc#1284687) /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-saslauthd.changes: * add cyrus-sasl-digestmd5-quote-overflow.patch /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl-saslauthd.changes- -- /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl.changes- (bsc#1284687) CVE-2026-107161 /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl.changes: * add cyrus-sasl-digestmd5-quote-overflow.patch /work/SRC/openSUSE:Factory/.cyrus-sasl.new.3698736/cyrus-sasl.changes- ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cyrus-sasl-bdb.spec ++++++ --- /var/tmp/diff_new_pack.pPHe6J/_old 2026-10-10 14:59:11.346501353 +0200 +++ /var/tmp/diff_new_pack.pPHe6J/_new 2026-10-10 14:59:11.348501437 +0200 @@ -1,7 +1,7 @@ # # spec file for package cyrus-sasl-bdb # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -33,7 +33,10 @@ Patch6: cyrus-sasl-lfs.patch Patch7: fix_libpq-fe_include.diff Patch8: 0001-Fix-time.h-check.patch -Patch9: remove-senceless-log.patch +Patch9: cyrus-sasl-make-digestmd5-work-ssl3.patch +Patch10: 0001-Use-HMAC-SHA256-for-cache-passwords-over-MD5.patch +Patch11: remove-senceless-log.patch +Patch12: cyrus-sasl-digestmd5-quote-overflow.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build Requires: libsasl2-3 BuildRequires: db-devel @@ -169,6 +172,9 @@ %patch -P 7 -p1 %patch -P 8 -p1 %patch -P 9 -p1 +%patch -P 10 -p1 +%patch -P 11 -p1 +%patch -P 12 -p1 %build find . -name "*.cvsignore" -exec rm -fv "{}" "+" @@ -211,8 +217,11 @@ %{_libdir}/sasl2/liblogin.so* %{_libdir}/sasl2/libsasldb.so* %dir /etc/sasl2/ -/usr/sbin/* -/usr/bin/* +%{_sbindir}/pluginviewer +%{_sbindir}/sasldblistusers2 +%{_sbindir}/saslpasswd2 +%{_bindir}/cyrus_sasl_sample_client +%{_bindir}/cyrus_sasl_sample_server %doc %{_mandir}/man3/sasl.*.gz %doc %{_mandir}/man8/*.gz ++++++ cyrus-sasl-saslauthd-bdb.spec ++++++ --- /var/tmp/diff_new_pack.pPHe6J/_old 2026-10-10 14:59:11.376502608 +0200 +++ /var/tmp/diff_new_pack.pPHe6J/_new 2026-10-10 14:59:11.378502692 +0200 @@ -1,7 +1,7 @@ # # spec file for package cyrus-sasl-saslauthd-bdb # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -38,7 +38,10 @@ Patch6: cyrus-sasl-lfs.patch Patch7: fix_libpq-fe_include.diff Patch8: 0001-Fix-time.h-check.patch -Patch9: remove-senceless-log.patch +Patch9: cyrus-sasl-make-digestmd5-work-ssl3.patch +Patch10: 0001-Use-HMAC-SHA256-for-cache-passwords-over-MD5.patch +Patch11: remove-senceless-log.patch +Patch12: cyrus-sasl-digestmd5-quote-overflow.patch PreReq: %fillup_prereq BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: db-devel @@ -83,6 +86,9 @@ %patch -P 7 -p1 %patch -P 8 -p1 %patch -P 9 -p1 +%patch -P 10 -p1 +%patch -P 11 -p1 +%patch -P 12 -p1 %build find . -name "*.cvsignore" -exec rm -fv "{}" "+" ++++++ cyrus-sasl-saslauthd.spec ++++++ --- /var/tmp/diff_new_pack.pPHe6J/_old 2026-10-10 14:59:11.413504156 +0200 +++ /var/tmp/diff_new_pack.pPHe6J/_new 2026-10-10 14:59:11.417504324 +0200 @@ -1,7 +1,7 @@ # # spec file for package cyrus-sasl-saslauthd # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -38,8 +38,10 @@ Patch6: cyrus-sasl-lfs.patch Patch7: fix_libpq-fe_include.diff Patch8: 0001-Fix-time.h-check.patch -Patch9: 0001-Use-HMAC-SHA256-for-cache-passwords-over-MD5.patch -Patch10: remove-senceless-log.patch +Patch9: cyrus-sasl-make-digestmd5-work-ssl3.patch +Patch10: 0001-Use-HMAC-SHA256-for-cache-passwords-over-MD5.patch +Patch11: remove-senceless-log.patch +Patch12: cyrus-sasl-digestmd5-quote-overflow.patch PreReq: %fillup_prereq BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: gdbm-devel @@ -85,6 +87,8 @@ %patch -P 8 -p1 %patch -P 9 -p1 %patch -P 10 -p1 +%patch -P 11 -p1 +%patch -P 12 -p1 %build find . -name "*.cvsignore" -exec rm -fv "{}" "+" ++++++ cyrus-sasl.spec ++++++ --- /var/tmp/diff_new_pack.pPHe6J/_old 2026-10-10 14:59:11.443505411 +0200 +++ /var/tmp/diff_new_pack.pPHe6J/_new 2026-10-10 14:59:11.444505453 +0200 @@ -1,7 +1,7 @@ # # spec file for package cyrus-sasl # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -36,7 +36,7 @@ Patch9: cyrus-sasl-make-digestmd5-work-ssl3.patch Patch10: 0001-Use-HMAC-SHA256-for-cache-passwords-over-MD5.patch Patch11: remove-senceless-log.patch - +Patch12: cyrus-sasl-digestmd5-quote-overflow.patch BuildRequires: gdbm-devel BuildRequires: krb5-mini-devel BuildRequires: libtool @@ -182,6 +182,7 @@ %patch -P 9 -p1 %patch -P 10 -p1 %patch -P 11 -p1 +%patch -P 12 -p1 %build find . -name "*.cvsignore" -exec rm -fv "{}" "+" @@ -211,6 +212,7 @@ mkdir -p %{buildroot}%{_sysconfdir}/sasl2 install -m 755 sample/.libs/client %{buildroot}%{_bindir}/cyrus_sasl_sample_client install -m 755 sample/.libs/server %{buildroot}%{_bindir}/cyrus_sasl_sample_server +rm doc/html/.buildinfo find doc -type f -exec chmod 0644 {} \; rm -f doc/Makefile* rm -f %{buildroot}/%{_mandir}/cat?/* @@ -222,7 +224,6 @@ %pre #Convert password file from berkely into gdbm -#In %pre the existing file will be dumped out if test -x %{_bindir}/db_verify && %{_bindir}/db_verify %{_sysconfdir}/sasldb2 >/dev/null 2>&1 ; then cat > %{_localstatedir}/adm/update-scripts/saslpw.awk <<EOF @@ -265,8 +266,11 @@ %{_libdir}/sasl2/liblogin.so* %{_libdir}/sasl2/libsasldb.so* %dir %{_sysconfdir}/sasl2/ -%{_sbindir}/* -%{_bindir}/* +%{_sbindir}/pluginviewer +%{_sbindir}/sasldblistusers2 +%{_sbindir}/saslpasswd2 +%{_bindir}/cyrus_sasl_sample_client +%{_bindir}/cyrus_sasl_sample_server %{_mandir}/man3/sasl.*.gz %{_mandir}/man8/*.gz ++++++ cyrus-sasl-digestmd5-quote-overflow.patch ++++++ From: Peter Varkoly <[email protected]> Subject: digestmd5: fix heap overflow in add_to_challenge() when quoting add_to_challenge() computed the needed buffer size from the unquoted value length. When the value contains '"' or '\', quote() returns a longer string, but the buffer was re-allocated with the stale size and the quoted value was then appended with strcat(), overflowing the heap buffer by an attacker-controlled amount (e.g. a crafted realm or nonce sent by a malicious DIGEST-MD5 / HTTP Digest server). Recompute newlen from the quoted length before re-allocating. This also keeps *curlen consistent with the actual string length. --- a/plugins/digestmd5.c +++ b/plugins/digestmd5.c @@ -567,6 +567,7 @@ valuesize = strlen(quoted); /* As the quoted string is bigger, make sure we have enough space now */ + newlen = (unsigned) (*curlen + 1 + namesize + 2 + valuesize + 2); ret = _plug_buf_alloc(utils, str, buflen, newlen); if (ret == SASL_OK) { strcat(*str, quoted); ++++++ pre_checkin.sh ++++++ --- /var/tmp/diff_new_pack.pPHe6J/_old 2026-10-10 14:59:11.565510516 +0200 +++ /var/tmp/diff_new_pack.pPHe6J/_new 2026-10-10 14:59:11.567510600 +0200 @@ -3,7 +3,6 @@ echo -n "Generating cyrus-sasl-saslauthd " cp cyrus-sasl.changes cyrus-sasl-saslauthd.changes -cp cyrus-sasl.changes cyrus-sasl-saslauthd.changes cp cyrus-sasl.changes cyrus-sasl-bdb.changes cp cyrus-sasl.changes cyrus-sasl-saslauthd-bdb.changes SASLVERSION=$(awk '/^Version/ {print $2; exit;} {next;};' < cyrus-sasl.spec)
