On Fri, Jul 31, 2026 at 02:31:52PM +0200, Salvatore Bonaccorso wrote: > Source: goaccess > Version: 1:1.10.1-1 > Severity: important > Tags: security upstream > X-Debbugs-Cc: [email protected], Debian Security Team > <[email protected]> > > Hi, > > The following vulnerabilities were published for goaccess. > > CVE-2026-54715[0]: > | GoAccess is a real-time web log analyzer and interactive viewer that > | runs in a terminal in *nix systems or through the browser. In > | version 1.10.2, parse_browser assumes the matched browser token > | begins with Opera and moves a trailing version substring to match > | plus five, allowing a crafted User-Agent in a processed access log > | to write one to four attacker-influenced bytes beyond the heap > | allocation and corrupt or crash GoAccess. This issue is fixed in > | version 1.11. > > > CVE-2026-55768[1]: > | GoAccess is a real-time web log analyzer and interactive viewer that > | runs in a terminal in *nix systems or through the browser. Prior to > | version 1.11, the built-in WebSocket server narrows a 64-bit > | extended frame length into the signed 32-bit WSFrame.payloadlen > | field before enforcing the maximum frame size, allowing an > | unauthenticated remote client to bypass the guard and force an > | approximately 18-exabyte allocation request that terminates the > | process. This issue is fixed in version 1.11. > > > CVE-2026-55777[2]: > | GoAccess is a real-time web log analyzer and interactive viewer that > | runs in a terminal in *nix systems or through the browser. Prior to > | 1.11, the parse_ios() function uses an attacker-controlled keyword- > | to-OS offset as both the source offset and copy length for memmove, > | allowing a crafted User-Agent in a processed access log to read up > | to approximately 4 KB beyond the heap allocation and conditionally > | crash GoAccess. This issue is fixed in version 1.11. > > > If you fix the vulnerabilities please also make sure to include the > CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
I just uploaded a new upstream release that includes the fixes for these to unstable. I also have a trixie branch where I cherry picked the individual fixes. I'm attaching the full diff and the individual patches here, LMK what you think. Are you releasing a DSA for those, or should I go for a stable update?
diff --git c/debian/changelog w/debian/changelog index 6a55b588..7eb23efc 100644 --- c/debian/changelog +++ w/debian/changelog @@ -1,3 +1,16 @@ +goaccess (1:1.9.3-1+deb13u1) trixie-security; urgency=high + + * Apply security updates (Closes: #1143181) + Includes fixes for the following vulnerabilities: + - CVE-2026-54715: Heap Out-of-Bounds Write in GoAccess `parse_browser()` + - CVE-2026-55768: GoAccess WebSocket server: signed 32 bit truncation of + the 64 bit frame length causes a remote pre authentication denial of + service + - CVE-2026-55777: Out-of-bounds heap read in parse_ios() via crafted + User-Agent (opesys.c:323) lead to remote crash/DoS + + -- Antonio Terceiro <[email protected]> Mon, 17 Aug 2026 18:49:23 -0300 + goaccess (1:1.9.3-1) unstable; urgency=medium * New upstream version 1.9.3 diff --git c/debian/patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch w/debian/patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch new file mode 100644 index 00000000..c6f244ab --- /dev/null +++ w/debian/patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch @@ -0,0 +1,37 @@ +From: Gerardo O <[email protected]> +Date: Sun, 7 Jun 2026 23:13:31 -0500 +Subject: Fix heap buffer overflow in parse_browser() Opera handling + +Anchor the offset to the actual 'Opera' position and require the slash to be at +or after the byte following it (op + 5 <= slh) so the destination can never run +past the buffer's NUL terminator. + +(cherry picked from commit 81f90d9dafd6956c188dea9f944d24946d3d3351) +--- + src/browsers.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/browsers.c b/src/browsers.c +index de0b56b..20f6fa7 100644 +--- a/src/browsers.c ++++ b/src/browsers.c +@@ -525,7 +525,7 @@ check_http_crawler (const char *str) { + * Otherwise the parsed browser is returned. */ + static char * + parse_browser (char *match, char *type, int i, char ***hash) { +- char *b = NULL, *ptr = NULL, *slh = NULL; ++ char *b = NULL, *ptr = NULL, *slh = NULL, *op = NULL; + size_t cnt = 0, space = 0; + + match = char_replace (match, '+', '-'); +@@ -547,8 +547,8 @@ parse_browser (char *match, char *type, int i, char ***hash) { + return parse_opera (slh); + } + /* Opera has the version number at the end */ +- if (strstr (match, "Opera") && (slh = strrchr (match, '/')) && match < slh) { +- memmove (match + 5, slh, strlen (slh) + 1); ++ if ((op = strstr (match, "Opera")) && (slh = strrchr (match, '/')) && op + 5 <= slh) { ++ memmove (op + 5, slh, strlen (slh) + 1); + } + /* IE Old */ + if (strstr (match, "MSIE") != NULL) { diff --git c/debian/patches/0002-Tighten-websocket-payload-length-handling.patch w/debian/patches/0002-Tighten-websocket-payload-length-handling.patch new file mode 100644 index 00000000..b22792a0 --- /dev/null +++ w/debian/patches/0002-Tighten-websocket-payload-length-handling.patch @@ -0,0 +1,46 @@ +From: Gerardo O <[email protected]> +Date: Mon, 15 Jun 2026 16:56:06 -0500 +Subject: Tighten websocket payload length handling. + +(cherry picked from commit ea74b87254d0adc675c087ff49bddd2d60dc01d5) +--- + src/websocket.c | 5 ++++- + src/websocket.h | 2 +- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/src/websocket.c b/src/websocket.c +index 8088921..8da1da9 100644 +--- a/src/websocket.c ++++ b/src/websocket.c +@@ -2027,7 +2027,7 @@ ws_get_frm_header (WSClient *client) { + ws_set_payloadlen ((*frm), (*frm)->buf); + ws_set_masking_key ((*frm), (*frm)->buf); + +- if ((*frm)->payloadlen > wsconfig.max_frm_size) { ++ if ((*frm)->payloadlen > (uint64_t) wsconfig.max_frm_size) { + ws_error (client, WS_CLOSE_TOO_LARGE, "Frame is too big"); + return ws_set_status (client, WS_ERR | WS_CLOSE, bytes); + } +@@ -2049,6 +2049,9 @@ ws_realloc_frm_payload (WSFrame *frm, WSMessage *msg) { + uint64_t newlen = 0; + + newlen = msg->payloadsz + frm->payloadlen; ++ if (newlen > (uint64_t) wsconfig.max_frm_size) ++ return 1; ++ + tmp = realloc (msg->payload, newlen); + if (tmp == NULL && newlen > 0) { + free (msg->payload); +diff --git a/src/websocket.h b/src/websocket.h +index 2846d6b..bd575a0 100644 +--- a/src/websocket.h ++++ b/src/websocket.h +@@ -195,7 +195,7 @@ typedef struct WSFrame_ { + unsigned char mask[4]; /* mask key */ + uint8_t res; /* extensions */ + int payload_offset; /* end of header/start of payload */ +- int payloadlen; /* payload length (for each frame) */ ++ uint64_t payloadlen; /* payload length (for each frame) */ + + /* status flags */ + int reading; /* still reading frame's header part? */ diff --git c/debian/patches/0003-Tighten-iOS-user-agent-parsing.patch w/debian/patches/0003-Tighten-iOS-user-agent-parsing.patch new file mode 100644 index 00000000..21fc3f96 --- /dev/null +++ w/debian/patches/0003-Tighten-iOS-user-agent-parsing.patch @@ -0,0 +1,23 @@ +From: Gerardo O <[email protected]> +Date: Mon, 15 Jun 2026 19:49:17 -0500 +Subject: Tighten iOS user agent parsing + +(cherry picked from commit ba813ed97d998dbdcb8d87e178799a4bb2da9e81) +--- + src/opesys.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/opesys.c b/src/opesys.c +index f83d0c3..ca05690 100644 +--- a/src/opesys.c ++++ b/src/opesys.c +@@ -303,7 +303,8 @@ parse_ios (char *agent, int tlen) { + goto out; + + *q = 0; +- memmove (agent + tlen, agent + offset, offset); ++ /* Move the version suffix to sit immediately after the matched keyword. */ ++ memmove (agent + tlen, p, (size_t) (q - p) + 1); + return char_replace (agent, '_', '.'); + + out: diff --git c/debian/patches/series w/debian/patches/series new file mode 100644 index 00000000..6453687c --- /dev/null +++ w/debian/patches/series @@ -0,0 +1,3 @@ +0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch +0002-Tighten-websocket-payload-length-handling.patch +0003-Tighten-iOS-user-agent-parsing.patch
From: Gerardo O <[email protected]> Date: Sun, 7 Jun 2026 23:13:31 -0500 Subject: Fix heap buffer overflow in parse_browser() Opera handling Anchor the offset to the actual 'Opera' position and require the slash to be at or after the byte following it (op + 5 <= slh) so the destination can never run past the buffer's NUL terminator. (cherry picked from commit 81f90d9dafd6956c188dea9f944d24946d3d3351) --- src/browsers.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/browsers.c b/src/browsers.c index de0b56b..20f6fa7 100644 --- a/src/browsers.c +++ b/src/browsers.c @@ -525,7 +525,7 @@ check_http_crawler (const char *str) { * Otherwise the parsed browser is returned. */ static char * parse_browser (char *match, char *type, int i, char ***hash) { - char *b = NULL, *ptr = NULL, *slh = NULL; + char *b = NULL, *ptr = NULL, *slh = NULL, *op = NULL; size_t cnt = 0, space = 0; match = char_replace (match, '+', '-'); @@ -547,8 +547,8 @@ parse_browser (char *match, char *type, int i, char ***hash) { return parse_opera (slh); } /* Opera has the version number at the end */ - if (strstr (match, "Opera") && (slh = strrchr (match, '/')) && match < slh) { - memmove (match + 5, slh, strlen (slh) + 1); + if ((op = strstr (match, "Opera")) && (slh = strrchr (match, '/')) && op + 5 <= slh) { + memmove (op + 5, slh, strlen (slh) + 1); } /* IE Old */ if (strstr (match, "MSIE") != NULL) {
From: Gerardo O <[email protected]> Date: Mon, 15 Jun 2026 16:56:06 -0500 Subject: Tighten websocket payload length handling. (cherry picked from commit ea74b87254d0adc675c087ff49bddd2d60dc01d5) --- src/websocket.c | 5 ++++- src/websocket.h | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/websocket.c b/src/websocket.c index 8088921..8da1da9 100644 --- a/src/websocket.c +++ b/src/websocket.c @@ -2027,7 +2027,7 @@ ws_get_frm_header (WSClient *client) { ws_set_payloadlen ((*frm), (*frm)->buf); ws_set_masking_key ((*frm), (*frm)->buf); - if ((*frm)->payloadlen > wsconfig.max_frm_size) { + if ((*frm)->payloadlen > (uint64_t) wsconfig.max_frm_size) { ws_error (client, WS_CLOSE_TOO_LARGE, "Frame is too big"); return ws_set_status (client, WS_ERR | WS_CLOSE, bytes); } @@ -2049,6 +2049,9 @@ ws_realloc_frm_payload (WSFrame *frm, WSMessage *msg) { uint64_t newlen = 0; newlen = msg->payloadsz + frm->payloadlen; + if (newlen > (uint64_t) wsconfig.max_frm_size) + return 1; + tmp = realloc (msg->payload, newlen); if (tmp == NULL && newlen > 0) { free (msg->payload); diff --git a/src/websocket.h b/src/websocket.h index 2846d6b..bd575a0 100644 --- a/src/websocket.h +++ b/src/websocket.h @@ -195,7 +195,7 @@ typedef struct WSFrame_ { unsigned char mask[4]; /* mask key */ uint8_t res; /* extensions */ int payload_offset; /* end of header/start of payload */ - int payloadlen; /* payload length (for each frame) */ + uint64_t payloadlen; /* payload length (for each frame) */ /* status flags */ int reading; /* still reading frame's header part? */
From: Gerardo O <[email protected]> Date: Mon, 15 Jun 2026 19:49:17 -0500 Subject: Tighten iOS user agent parsing (cherry picked from commit ba813ed97d998dbdcb8d87e178799a4bb2da9e81) --- src/opesys.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/opesys.c b/src/opesys.c index f83d0c3..ca05690 100644 --- a/src/opesys.c +++ b/src/opesys.c @@ -303,7 +303,8 @@ parse_ios (char *agent, int tlen) { goto out; *q = 0; - memmove (agent + tlen, agent + offset, offset); + /* Move the version suffix to sit immediately after the matched keyword. */ + memmove (agent + tlen, p, (size_t) (q - p) + 1); return char_replace (agent, '_', '.'); out:
signature.asc
Description: PGP signature
