Your message dated Sat, 02 Dec 2023 19:47:16 +0000
with message-id <e1r9vxm-003ovc...@fasolo.debian.org>
and subject line Bug#1054417: fixed in weborf 0.19-2.1+deb12u1
has caused the Debian Bug report #1054417,
regarding weborf: Denial of service when executing cgi executables
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1054417: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054417
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: weborf
Version: 0.20
Severity: grave
Tags: patch upstream security
X-Debbugs-Cc: tipos...@tiscali.it
Dear Maintainer,
there is an error in the code to execute cgi.
Best
-- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (500, 'unstable'), (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.5.0-2-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=it_IT.UTF-8, LC_CTYPE=it_IT.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages weborf depends on:
ii libc6 2.37-12
ii libmagic1 1:5.45-2
ii libssl3 3.0.11-1
weborf recommends no packages.
Versions of packages weborf suggests:
pn php-cgi <none>
-- no debconf information
commit 49824204add55aab0568d90a6b1e7c822d32120d
Author: Salvo 'LtWorf' Tomaselli <tipos...@tiscali.it>
Date: Wed Oct 11 23:48:19 2023 +0200
Solve issue with unterminated buffer
diff --git a/cgi.c b/cgi.c
index 08d664d..f8276b1 100644
--- a/cgi.c
+++ b/cgi.c
@@ -233,8 +233,7 @@ static inline void cgi_execute_child(connection_t*
connection_prop,string_t* pos
environ = NULL; //Clear env vars
if (strlen(executor) == 0) {
- executor = malloc(connection_prop->strfile_len + 1);
- strncpy(executor, connection_prop->strfile,
connection_prop->strfile_len);
+ executor = connection_prop->strfile;
}
cgi_set_http_env_vars(connection_prop->http_param);
--- End Message ---
--- Begin Message ---
Source: weborf
Source-Version: 0.19-2.1+deb12u1
Done: Salvo 'LtWorf' Tomaselli <ltw...@debian.org>
We believe that the bug you reported is fixed in the latest version of
weborf, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1054...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvo 'LtWorf' Tomaselli <ltw...@debian.org> (supplier of updated weborf
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 30 Nov 2023 10:58:16 +0100
Source: weborf
Architecture: source
Version: 0.19-2.1+deb12u1
Distribution: bookworm
Urgency: medium
Maintainer: Salvo 'LtWorf' Tomaselli <tipos...@tiscali.it>
Changed-By: Salvo 'LtWorf' Tomaselli <ltw...@debian.org>
Closes: 1054417
Changes:
weborf (0.19-2.1+deb12u1) bookworm; urgency=medium
.
* Backport patch from upstream to fix denial of service (Closes: 1054417)
Checksums-Sha1:
3629fe4079d386fee648c2b3c0d25b6301646577 2246 weborf_0.19-2.1+deb12u1.dsc
d0fd86befb61726fc5315d3c2d88e1f95f734e8d 15964
weborf_0.19-2.1+deb12u1.debian.tar.xz
a52776f9e392406ced5bbd41f44763f092d2afae 11620
weborf_0.19-2.1+deb12u1_amd64.buildinfo
Checksums-Sha256:
260adca24c146f2e1445a4d2a0e2870a8730b6872d02d03e9f86b532e4e72a8b 2246
weborf_0.19-2.1+deb12u1.dsc
2913bc45b06110ac6a5a5d681d011cc852e090368e50307ad7cb17b88ff2388b 15964
weborf_0.19-2.1+deb12u1.debian.tar.xz
0d8e150f6619e0bdafac2385e3dee67ca1f6e26c4f2b122547facf3130a3a715 11620
weborf_0.19-2.1+deb12u1_amd64.buildinfo
Files:
f278f837040337f7487ec3819c09b508 2246 httpd optional
weborf_0.19-2.1+deb12u1.dsc
df24e107c697a9a74c92c17e9530e962 15964 httpd optional
weborf_0.19-2.1+deb12u1.debian.tar.xz
4235ae73b0b83c9cff5d6d5e9d74a548 11620 httpd optional
weborf_0.19-2.1+deb12u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEQnSLnnbYmXmeH74Us6fPDIAYhs8FAmVoXYQACgkQs6fPDIAY
hs+nSQ//RZbjPafr9oWzHsQINDHxHsXFPl40i6yagAanfZpIYPf76HSbtdBtQxci
C/a5YqJxYg2nscTZrm69kjUJxh/xz4vhYHGyiw2TKnjBHL8QZJ76WhFFFtya5TV9
3BCCGovZOolxMQYBcDHp9/PeJYzWtA4OXJ4igmlJ6OTmT0KRZMkH/dcVNGEH7vy9
rWgfmuYZQSKs3AFdU8lCyguwDMQILHTtXBZLyGMWnoXLftoUnLC0uT/6nR8O9rru
iuVWKxtvurLl29kK1V4pMZEt/+sVbscTAZ4gux6Yr6Wg1Ut9eZrdnd1Je6as9dO/
8lUpBGTIUn3msfMAO5E2ysy0UCej37JOueuMSqEI/sjqr7xpsxpyjNvhEVqMt7om
itegLepZ/rvAMc4ENCNh5v2d/NNRXnlK+jDLUBbPwyUij+RTnWzE1XnCbYG/xOQZ
sV7z7usXspn+w/bOf/2qmQ6M2W7Rt+vjvyF574MulzxMeU1CeuGnZEl2hWiPsbu5
niENEYS3syWibK5w9ShgVXMUhaJr36KFYdTdaJQM2Cl8Nv0ozEmdfEhb7cxeyouL
PIjFELQDFkhlfD0UyYxCCNufiJos2+/jbl7xVJWM0j/cvWpCznl77Ex7HXzroCxd
GLuUdXbauV49PedmZIxRkXePcxNQOcXSsgbd6rF4xAchdFtSTfE=
=lZa7
-----END PGP SIGNATURE-----
--- End Message ---
