Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:xapian-core
User: [email protected]
Usertags: pu
This fixes #1144490 which is a previously missed corner case of
CVE-2018-0499. It's a missing HTML escaping bug.
It affects upstream releases 1.4.x for x <= 31 and 2.0.0.
Upstream releases 1.4.32 and 2.1.0 include a fix, and I've already
uploaded 1.4.32-1 to unstable and 2.1.0-1 to experimental.
I've already contacted the security team who decided it was more
appropriate to handle via a stable update.
[ Impact ]
There's potential for unescaped data appearing in HTML search result
pages. It is only exploitable with a particular combination of
parameters which don't seem to be commonly used in practice (I search
codesearch.d.n and didn't locate any examples, though `snippet` is a
fairly common function name, and it may be used in code people run on
Debian which isn't packaged for Debian).
Exploitation would generally also require the attacker can supply
documents to the search system, or find suitable document content
already in the system.
[ Tests ]
The patch include regression tests which are automatically run during
the package build.
[ Risks ]
This is a low risk change - the patch is small and not complex, and
just changes this code path to use existing escaping functionality
already used on other code paths.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
In the affected case, the return value is escaped rather than returned
as-is.
[ Other info ]
I wonder if this should be considered for the stable-updates suite
so users get the fix sooner? While it seems an unusual use of the API,
for users affected the lack of company won't be much comfort, and it's
a low risk patch.
Cheers,
Olly
diff -Nru xapian-core-1.4.29/debian/changelog
xapian-core-1.4.29/debian/changelog
--- xapian-core-1.4.29/debian/changelog 2025-05-02 11:29:34.000000000 +1200
+++ xapian-core-1.4.29/debian/changelog 2026-08-16 09:59:21.000000000 +1200
@@ -1,3 +1,11 @@
+xapian-core (1.4.29-3+deb13u1) trixie; urgency=medium
+
+ * Cherry-pick fix for missed corner case of CVE-2018-0499. New patch:
+ cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch
+ (Closes: #1144490)
+
+ -- Olly Betts <[email protected]> Sun, 16 Aug 2026 09:59:21 +1200
+
xapian-core (1.4.29-3) unstable; urgency=medium
* debian/rules: Drop dependency on debian/control from
diff -Nru
xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch
xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch
---
xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch
1970-01-01 12:00:00.000000000 +1200
+++
xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch
2026-08-15 11:41:17.000000000 +1200
@@ -0,0 +1,54 @@
+Description: Fix missing escaping in MSet::snippet()
+ Fix missing escaping when hi_start and hi_end are empty and the
+ input string is already within the requested length.
+Origin: upstream, commit:b39620db6fa87c7aea83abef1a94dff96444ba29
+Last-Update: 2026-08-14
+Applied-Upstream: 1.4.32
+
+--- a/queryparser/termgenerator_internal.cc
++++ b/queryparser/termgenerator_internal.cc
+@@ -760,8 +760,11 @@
+ const string & omit) const
+ {
+ if (hi_start.empty() && hi_end.empty() && text.size() <= length) {
+- // Too easy!
+- return text;
++ // The text is already short enough so we just need to perform
++ // escaping.
++ string output;
++ append_escaping_xml(text.data(), text.data() + text.size(), output);
++ return output;
+ }
+
+ bool try_word_break = (flags & MSet::SNIPPET_CJK_NGRAM);
+--- a/tests/api_snippets.cc
++++ b/tests/api_snippets.cc
+@@ -350,6 +350,13 @@
+ TEST_STRINGS_EQUAL(mset.snippet(input, 12, stem),
+ "...<<b>foo</b>.h> to...");
+
++ // Check escaping still happens without highlighting when the text is
++ // already short enough. Regression test for bug fixed in 1.4.32 and
++ // 2.0.1.
++ input = "<foo> &";
++ TEST_STRINGS_EQUAL(mset.snippet(input, 12, stem, 0, "", ""),
++ "<foo> &amp;");
++
+ input = "¡foo!";
+ TEST_STRINGS_EQUAL(mset.snippet(input, strlen(input), stem),
+ "¡<b>foo</b>!");
+@@ -456,6 +463,14 @@
+ input = "foo for 10¢";
+ TEST_STRINGS_EQUAL(mset.snippet(input, strlen(input), stem),
+ "<b>foo</b> for <b>10</b>¢");
++
++ // Check escaping still happens without highlighting when the text is
++ // already short enough. Regression test for bug fixed in 1.4.32 and
++ // 2.0.1.
++ input = "&foo takes the address of foo";
++ TEST_STRINGS_EQUAL(mset.snippet(input, strlen(input), stem, 0, "", ""),
++ "&foo takes the address of foo");
++
+ }
+
+ /// Test snippets with small and zero length.
diff -Nru xapian-core-1.4.29/debian/patches/series
xapian-core-1.4.29/debian/patches/series
--- xapian-core-1.4.29/debian/patches/series 1970-01-01 12:00:00.000000000
+1200
+++ xapian-core-1.4.29/debian/patches/series 2026-08-15 11:26:55.000000000
+1200
@@ -0,0 +1 @@
+cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch
