Package: release.debian.org Severity: normal Tags: trixie User: [email protected] X-Debbugs-Cc: [email protected] Usertags: pu Control: affects -1 + src:patch
Hi RMs, [ Reason ] There is a flaw in the 'patch' utility that may allow arbitrary file creation outside the intended working directory. This bug is marked as no-DSA by the security team, but I would like to fix this anyway. [ Impact ] With automation workflows or when the user doesn't take close attention, this can cause security issues. With a simple additional check this is prevented. [ Tests ] The update adds two self-tests that check if this fix works as expected. The previous self-tests pass as well at build time. [ Risks ] Basically nothing. The fix is small and straightforward. Self-testing checks some common functionality already. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in stable [x] the issues are verified as fixed in unstable Thanks, Laszlo/GCS
diff -Nru patch-2.8/debian/changelog patch-2.8/debian/changelog --- patch-2.8/debian/changelog 2025-06-13 20:59:38.000000000 +0200 +++ patch-2.8/debian/changelog 2026-10-29 17:22:30.000000000 +0100 @@ -1,3 +1,10 @@ +patch (2.8-2+deb13u1) trixie; urgency=medium + + * Backport upstream fix for CVE-2026-115207: prevent creation of out-of-tree + files. + + -- Laszlo Boszormenyi (GCS) <[email protected]> Thu, 29 Oct 2026 17:22:30 +0100 + patch (2.8-2) unstable; urgency=medium [ Samuel Thibault <[email protected]> ] diff -Nru patch-2.8/debian/patches/CVE-2026-115207.patch patch-2.8/debian/patches/CVE-2026-115207.patch --- patch-2.8/debian/patches/CVE-2026-115207.patch 1970-01-01 01:00:00.000000000 +0100 +++ patch-2.8/debian/patches/CVE-2026-115207.patch 2026-10-29 17:22:01.000000000 +0100 @@ -0,0 +1,99 @@ +commit 0cd45bb2132a42cd38d84b20661f3eae9b4da7ce +Author: Andreas Gruenbacher <[email protected]> +Date: Wed Oct 21 16:49:38 2026 +0200 + + Prevent creation of out-of-tree files (CVE-2026-115207) + + When reverse-applying a patch that deletes a file, patch created that + file without checking if the pathname is safe. Fix that by adding the + missing check. + * src/pch.c (intuit_diff_type): Add the missing check. + * tests/create-delete: Add two new tests. + * tests/bad-filenames: This changes the output of these tests. + +diff --git a/src/pch.c b/src/pch.c +index a65322c..64ce72f 100644 +--- a/src/pch.c ++++ b/src/pch.c +@@ -956,6 +956,7 @@ intuit_diff_type (bool need_header, mode_t *p_file_type) + } + + if (i0 != NONE ++ && name_is_valid (p_name[i0]) + && (i == NONE || (st[i].st_mode & S_IFMT) == file_type) + && maybe_reverse (p_name[i == NONE ? i0 : i], i == NONE, + i == NONE || st[i].st_size == 0) +diff --git a/tests/bad-filenames b/tests/bad-filenames +index 2515f0a..ae6ba13 100644 +--- a/tests/bad-filenames ++++ b/tests/bad-filenames +@@ -104,6 +104,7 @@ cat > d.diff <<EOF + EOF + + check 'patch -f -p0 --dry-run < d.diff || echo status: $?' <<EOF ++Ignoring potentially dangerous file name ../g + can't find file to patch at input line 3 + Perhaps you used the wrong -p or --strip option? + The text leading up to this was: +@@ -118,6 +119,7 @@ EOF + + echo 1 > f + check 'patch -f -p0 --dry-run < d.diff || echo status: $?' <<EOF ++Ignoring potentially dangerous file name ../g + checking file f + EOF + +diff --git a/tests/create-delete b/tests/create-delete +index adcce27..8edeb67 100644 +--- a/tests/create-delete ++++ b/tests/create-delete +@@ -295,3 +295,49 @@ EOF + check 'cat target.orig' <<EOF + data + EOF ++ ++# ================================================================ ++# CVE-2026-XXXXX: Reverse-applying a patch should not create ++# out-of-tree files. ++ ++cat > p.diff <<EOF ++--- ../invalid +++++ ../invalid ++@@ -1 +0,0 @@ ++-data ++EOF ++ ++check 'patch -p0 -t < p.diff || echo status: $?' <<EOF ++Ignoring potentially dangerous file name ../invalid ++can't find file to patch at input line 3 ++Perhaps you used the wrong -p or --strip option? ++The text leading up to this was: ++-------------------------- ++|--- ../invalid ++|+++ ../invalid ++-------------------------- ++No file to patch. Skipping patch. ++1 out of 1 hunk ignored ++status: 1 ++EOF ++ ++cat > p.diff <<EOF ++--- $PWD/invalid 2025-01-01 12:00:00.000000000 +0000 +++++ $PWD/invalid 1970-01-01 00:00:00.000000000 +0000 ++@@ -1 +0,0 @@ ++-data ++EOF ++ ++check 'patch -p0 -t < p.diff || echo status: $?' <<EOF ++Ignoring potentially dangerous file name $PWD/invalid ++can't find file to patch at input line 3 ++Perhaps you used the wrong -p or --strip option? ++The text leading up to this was: ++-------------------------- ++|--- $PWD/invalid 2025-01-01 12:00:00.000000000 +0000 ++|+++ $PWD/invalid 1970-01-01 00:00:00.000000000 +0000 ++-------------------------- ++No file to patch. Skipping patch. ++1 out of 1 hunk ignored ++status: 1 ++EOF diff -Nru patch-2.8/debian/patches/series patch-2.8/debian/patches/series --- patch-2.8/debian/patches/series 2025-06-13 00:38:08.000000000 +0200 +++ patch-2.8/debian/patches/series 2026-10-29 17:22:30.000000000 +0100 @@ -2,3 +2,4 @@ add_some_missing_filename_quoting.patch reject_empty_filenames.patch skip_read-only_check_when_output_file_specified.patch +CVE-2026-115207.patch
