Your message dated Tue, 26 Dec 2023 20:32:29 +0000
with message-id <e1rie6h-005q8c...@fasolo.debian.org>
and subject line Bug#1054417: fixed in weborf 0.17-3+deb11u1
has caused the Debian Bug report #1054417,
regarding weborf: Denial of service when executing cgi executables
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1054417: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054417
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: weborf
Version: 0.20
Severity: grave
Tags: patch upstream security
X-Debbugs-Cc: tipos...@tiscali.it
Dear Maintainer,
there is an error in the code to execute cgi.
Best
-- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (500, 'unstable'), (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.5.0-2-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=it_IT.UTF-8, LC_CTYPE=it_IT.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages weborf depends on:
ii libc6 2.37-12
ii libmagic1 1:5.45-2
ii libssl3 3.0.11-1
weborf recommends no packages.
Versions of packages weborf suggests:
pn php-cgi <none>
-- no debconf information
commit 49824204add55aab0568d90a6b1e7c822d32120d
Author: Salvo 'LtWorf' Tomaselli <tipos...@tiscali.it>
Date: Wed Oct 11 23:48:19 2023 +0200
Solve issue with unterminated buffer
diff --git a/cgi.c b/cgi.c
index 08d664d..f8276b1 100644
--- a/cgi.c
+++ b/cgi.c
@@ -233,8 +233,7 @@ static inline void cgi_execute_child(connection_t*
connection_prop,string_t* pos
environ = NULL; //Clear env vars
if (strlen(executor) == 0) {
- executor = malloc(connection_prop->strfile_len + 1);
- strncpy(executor, connection_prop->strfile,
connection_prop->strfile_len);
+ executor = connection_prop->strfile;
}
cgi_set_http_env_vars(connection_prop->http_param);
--- End Message ---
--- Begin Message ---
Source: weborf
Source-Version: 0.17-3+deb11u1
Done: Salvo 'LtWorf' Tomaselli <ltw...@debian.org>
We believe that the bug you reported is fixed in the latest version of
weborf, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1054...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvo 'LtWorf' Tomaselli <ltw...@debian.org> (supplier of updated weborf
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 22 Dec 2023 09:47:49 +0100
Source: weborf
Architecture: source
Version: 0.17-3+deb11u1
Distribution: bullseye
Urgency: medium
Maintainer: Salvo 'LtWorf' Tomaselli <tipos...@tiscali.it>
Changed-By: Salvo 'LtWorf' Tomaselli <ltw...@debian.org>
Closes: 1054417
Changes:
weborf (0.17-3+deb11u1) bullseye; urgency=medium
.
* Backport patch from upstream to fix denial of service (Closes: 1054417)
Checksums-Sha1:
51f2514e2a84a874d1308b8e826e8169d4ad2677 2188 weborf_0.17-3+deb11u1.dsc
b333a2c78b84f59dc70e835f84fd7b7e9f6e6d6a 17072
weborf_0.17-3+deb11u1.debian.tar.xz
3ea35f1d2bfd214b951b638e853f07616860d57f 11748
weborf_0.17-3+deb11u1_amd64.buildinfo
Checksums-Sha256:
37b0231f753e70db8819fd19025e4f927b62db63bb8cb0c706662fefa42b3644 2188
weborf_0.17-3+deb11u1.dsc
db05d3d9e2a0692cc0b27c7deb7ac1c3ae68a1b8612959e92037678c114424f1 17072
weborf_0.17-3+deb11u1.debian.tar.xz
dce4b9349b62404b72d0ccf25717fdd066f1cc9a9d011f90708c104e3367b457 11748
weborf_0.17-3+deb11u1_amd64.buildinfo
Files:
f18abb2d1f8f19728e8c79e28e5b34d0 2188 httpd optional weborf_0.17-3+deb11u1.dsc
c9c2130cb32f6272db2041525c116a09 17072 httpd optional
weborf_0.17-3+deb11u1.debian.tar.xz
81a6b3203f6b3de2a502b3d14736d650 11748 httpd optional
weborf_0.17-3+deb11u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEQnSLnnbYmXmeH74Us6fPDIAYhs8FAmWFTYgACgkQs6fPDIAY
hs/nHhAAlV2/C6UZ5adX6AC4VxJ6PizKX5Nbxe+NqqvnKy67YIcKY/+csdVhSWzr
9RNECDVqcW1mypmj8GovUU1fWjp+f+k+L0aUeDmrOjWY6+WKQfmNIK+IAZqxrv5v
m8S8Rv1388py6/grliLpgHIYZH+4au6BD7fyHwF2uJwmu/u3htDFLT8LMOuFRzFV
Rh0NlyLVur1q8bm8nXiX3KId/zC1c0yNvAiwEK1/eA0IkW8k9kePC5ZpaxQJqpbd
tF06mWoRTBOo8c3xvOfM03N1uATgLqN+z8201wML/2NmU6mOrW+u31wM4RGaUO5x
5vWj6rQKH77lyDl1+Wkn8241udAWRSds9sE8XJ7L/QthW4EfkrzuOuR0Bn6oOh0W
hKXGNwSHRZro2ZE0yKkmX3xBYhqDFJ+XcF99pjoBnOnyZMhD6gJyeNG+UHVb+SMt
1r1DtiB+gsn11d8bDdaq2puCOEHRXpphr6H3tGEb5XIgFGcaT6SA6dYvfVyvdH4J
+N0CSlBFQ10B9ErhTjvYee+h6fXu4x9EUwf9y0AaDI5okWMMxoXxPz5tnzq5VFR4
1ncADMbi391ZD7wJa79O2URAuuN4TCgWSXIZZtvGB8BZMPHQhg7XGYHHZHKQ8xbU
/eTbw6c3TmeqDFn1kjT+0U5EEFbYXFN/1CPODGdqZM5pj4Vo1to=
=bxgf
-----END PGP SIGNATURE-----
--- End Message ---
