Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=d1327f256de384d61c85b772c7318f36d0d0a7cd
commit d1327f256de384d61c85b772c7318f36d0d0a7cd Author: kikadf <[email protected]> Date: Mon Nov 24 08:45:29 2014 +0100 drupal7-7.22-2arcturus6-x86_64 * Fix CVE-2014-9015, CVE-2014-9016 diff --git a/source/network-extra/drupal7/FrugalBuild b/source/network-extra/drupal7/FrugalBuild index b9af52e..cd073cf 100644 --- a/source/network-extra/drupal7/FrugalBuild +++ b/source/network-extra/drupal7/FrugalBuild @@ -3,7 +3,7 @@ pkgname=drupal7 pkgver=7.22 -pkgrel=2arcturus5 +pkgrel=2arcturus6 pkgdesc="An open source content management platform" url="http://drupal.org"; rodepends=('apache' 'php') @@ -21,13 +21,15 @@ options=('stick') # FSA fix *** source=(${source[@]} SA-CORE-2013-003.patch SA-CORE-2014-001.patch SA-CORE-2014-002.patch SA-CORE-2014-003.patch - SA-CORE-2014-004.patch SA-CORE-2014-005.patch) + SA-CORE-2014-004.patch SA-CORE-2014-005.patch + SA-CORE-2014-006.patch) sha1sums=(${sha1sums[@]} '55f891eb3f4bebe75473073aad11cb843f19fcfe' \ '239b0251eac1a8dc8fb3a2368423d492df31cdea' \ 'a05c385dd251408ccef5cb7b2df115b1251473b9' \ '69ae289e73bdc43b8ac926fa7b33e1e99dcf5814' \ 'ebda3d193d0d44741197c618db68109e7e4da694' \ - '936eee8573326176efd84f0380a74aaf2de64e00') + '936eee8573326176efd84f0380a74aaf2de64e00' \ + 'f46f27f22827554e5126ddea5fabd3927d8fd5c1') _F_cd_path="${pkgname//7/}-$pkgver" # *********** diff --git a/source/network-extra/drupal7/SA-CORE-2014-006.patch b/source/network-extra/drupal7/SA-CORE-2014-006.patch new file mode 100644 index 0000000..0dcd288 --- /dev/null +++ b/source/network-extra/drupal7/SA-CORE-2014-006.patch @@ -0,0 +1,67 @@ +Index: drupal7/includes/password.inc +=================================================================== +--- drupal7.orig/includes/password.inc 2014-11-19 15:22:16.266318073 -0600 ++++ drupal7/includes/password.inc 2014-11-19 15:23:45.231345015 -0600 +@@ -140,7 +140,7 @@ + * @param $algo + * The string name of a hashing algorithm usable by hash(), like 'sha256'. + * @param $password +- * The plain-text password to hash. ++ * Plain-text password up to 512 bytes (128 to 512 UTF-8 characters) to hash. + * @param $setting + * An existing hash or the output of _password_generate_salt(). Must be + * at least 12 characters (the settings and salt). +@@ -150,6 +150,10 @@ + * The return string will be truncated at DRUPAL_HASH_LENGTH characters max. + */ + function _password_crypt($algo, $password, $setting) { ++ // Prevent DoS attacks by refusing to hash large passwords. ++ if (strlen($password) > 512) { ++ return FALSE; ++ } + // The first 12 characters of an existing hash are its setting string. + $setting = substr($setting, 0, 12); + +Index: drupal7/includes/session.inc +=================================================================== +--- drupal7.orig/includes/session.inc 2014-11-19 15:22:35.502540128 -0600 ++++ drupal7/includes/session.inc 2014-11-19 15:23:45.231345015 -0600 +@@ -79,7 +79,7 @@ + // Handle the case of first time visitors and clients that don't store + // cookies (eg. web crawlers). + $insecure_session_name = substr(session_name(), 1); +- if (!isset($_COOKIE[session_name()]) && !isset($_COOKIE[$insecure_session_name])) { ++ if (empty($sid) || (!isset($_COOKIE[session_name()]) && !isset($_COOKIE[$insecure_session_name]))) { + $user = drupal_anonymous_user(); + return ''; + } +Index: drupal7/modules/simpletest/tests/password.test +=================================================================== +--- drupal7.orig/modules/simpletest/tests/password.test 2014-11-19 15:22:16.270318121 -0600 ++++ drupal7/modules/simpletest/tests/password.test 2014-11-19 15:23:45.231345015 -0600 +@@ -57,4 +57,25 @@ + $this->assertFalse(user_needs_new_hash($account), t('Re-hashed password does not need a new hash.')); + $this->assertTrue(user_check_password($password, $account), t('Password check succeeds with re-hashed password.')); + } ++ ++ /** ++ * Verifies that passwords longer than 512 bytes are not hashed. ++ */ ++ public function testLongPassword() { ++ $password = str_repeat('x', 512); ++ $result = user_hash_password($password); ++ $this->assertFalse(empty($result), '512 byte long password is allowed.'); ++ $password = str_repeat('x', 513); ++ $result = user_hash_password($password); ++ $this->assertFalse($result, '513 byte long password is not allowed.'); ++ // Check a string of 3-byte UTF-8 characters. ++ $password = str_repeat('â¬', 170); ++ $result = user_hash_password($password); ++ $this->assertFalse(empty($result), '510 byte long password is allowed.'); ++ $password .= 'xx'; ++ $this->assertFalse(empty($result), '512 byte long password is allowed.'); ++ $password = str_repeat('â¬', 171); ++ $result = user_hash_password($password); ++ $this->assertFalse($result, '513 byte long password is not allowed.'); ++ } + }
_______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
