Hello community,
here is the log from the commit of package jakarta-commons-httpclient for
openSUSE:12.3 checked in at 2013-02-14 21:00:19
Comparing /work/SRC/openSUSE:12.3/jakarta-commons-httpclient (Old)
and /work/SRC/openSUSE:12.3/.jakarta-commons-httpclient.new (New)
Package is jakarta-commons-httpclient, Maintainer is
Changes:
---
/work/SRC/openSUSE:12.3/jakarta-commons-httpclient/jakarta-commons-httpclient.changes
2013-01-31 01:20:33.0 +0100
+++
/work/SRC/openSUSE:12.3/.jakarta-commons-httpclient.new/jakarta-commons-httpclient.changes
2013-02-14 21:00:25.0 +0100
@@ -1,0 +2,6 @@
+Thu Feb 14 09:10:48 UTC 2013 - mvysko...@suse.com
+
+- fix bnc#802: no ssl certificate hostname checking (CVE-2012-5783)
+ * commons-httpclient-CVE-2012-5783.patch
+
+---
New:
commons-httpclient-CVE-2012-5783.patch
Other differences:
--
++ jakarta-commons-httpclient.spec ++
--- /var/tmp/diff_new_pack.jZUyB8/_old 2013-02-14 21:00:25.0 +0100
+++ /var/tmp/diff_new_pack.jZUyB8/_new 2013-02-14 21:00:25.0 +0100
@@ -1,7 +1,7 @@
#
# spec file for package jakarta-commons-httpclient
#
-# Copyright (c) 2012 SUSE LINUX Products GmbH, Nuernberg, Germany.
+# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -32,6 +32,9 @@
# Add OSGi MANIFEST.MF bits
Patch1: %{name}-addosgimanifest.patch
Patch2: %{name}-encoding.patch
+#PATCH-FIX-UPSTREAM: bnc#803332
+#http://svn.apache.org/viewvc?view=revisionrevision=483925
+Patch3: commons-httpclient-CVE-2012-5783.patch
BuildArch: noarch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
@@ -111,6 +114,7 @@
popd
%patch2
+%patch3 -p1
# Use javax classes, not com.sun ones
# assume no filename contains spaces
++ commons-httpclient-CVE-2012-5783.patch ++
Index:
commons-httpclient-3.1/src/java/org/apache/commons/httpclient/protocol/SSLProtocolSocketFactory.java
===
---
commons-httpclient-3.1.orig/src/java/org/apache/commons/httpclient/protocol/SSLProtocolSocketFactory.java
+++
commons-httpclient-3.1/src/java/org/apache/commons/httpclient/protocol/SSLProtocolSocketFactory.java
@@ -31,10 +31,17 @@
package org.apache.commons.httpclient.protocol;
import java.io.IOException;
+import java.io.InputStream;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;
+import java.security.cert.Certificate;
+import java.security.cert.X509Certificate;
+
+import javax.net.ssl.SSLException;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import org.apache.commons.httpclient.ConnectTimeoutException;
@@ -79,12 +86,17 @@ public class SSLProtocolSocketFactory im
InetAddress clientHost,
int clientPort)
throws IOException, UnknownHostException {
-return SSLSocketFactory.getDefault().createSocket(
+SSLSocket socket = (SSLSocket)
SSLSocketFactory.getDefault().createSocket(
host,
port,
clientHost,
clientPort
);
+
+verifyHostName( host, (SSLSocket) socket );
+
+// verifyHostName() didn't blowup - good!
+return socket;
}
/**
@@ -124,15 +136,18 @@ public class SSLProtocolSocketFactory im
}
int timeout = params.getConnectionTimeout();
if (timeout == 0) {
-return createSocket(host, port, localAddress, localPort);
+SSLSocket socket = (SSLSocket) createSocket(host, port,
localAddress, localPort);
+verifyHostName(host, (SSLSocket) socket);
+return socket;
} else {
// To be eventually deprecated when migrated to Java 1.4 or above
-Socket socket = ReflectionSocketFactory.createSocket(
+SSLSocket socket =(SSLSocket) ReflectionSocketFactory.createSocket(
javax.net.ssl.SSLSocketFactory, host, port, localAddress,
localPort, timeout);
if (socket == null) {
-socket = ControllerThreadSocketFactory.createSocket(
+socket = (SSLSocket)
ControllerThreadSocketFactory.createSocket(
this, host, port, localAddress, localPort, timeout);
}
+verifyHostName(host, (SSLSocket) socket);
return socket;
}
}
@@ -142,10 +157,12 @@ public class SSLProtocolSocketFactory im
*/
public Socket
