There is already a patch for this CVE in kirkstone: https://git.yoctoproject.org/poky/commit/?h=kirkstone&id=4596433a54c12ee229e923ae39e3ec0d16d6f067
So I've dropped this patch from your series and adjusted the other two to take into account the above commit. Thanks! Steve On Tue, Aug 1, 2023 at 2:18 PM Sakib Sajal via lists.openembedded.org <sakib.sajal=windriver....@lists.openembedded.org> wrote: > > Backport required patch to fix CVE-2023-29406. > > Signed-off-by: Sakib Sajal <sakib.sa...@windriver.com> > --- > meta/recipes-devtools/go/go-1.17.13.inc | 1 + > .../go/go-1.19/CVE-2023-29406.patch | 210 ++++++++++++++++++ > 2 files changed, 211 insertions(+) > create mode 100644 meta/recipes-devtools/go/go-1.19/CVE-2023-29406.patch > > diff --git a/meta/recipes-devtools/go/go-1.17.13.inc > b/meta/recipes-devtools/go/go-1.17.13.inc > index d46eab01a0..b9d905a616 100644 > --- a/meta/recipes-devtools/go/go-1.17.13.inc > +++ b/meta/recipes-devtools/go/go-1.17.13.inc > @@ -41,6 +41,7 @@ SRC_URI += "\ > file://CVE-2023-24536_3.patch \ > file://CVE-2023-24531_1.patch \ > file://CVE-2023-24531_2.patch \ > + file://CVE-2023-29406.patch \ > " > SRC_URI[main.sha256sum] = > "a1a48b23afb206f95e7bbaa9b898d965f90826f6f1d1fc0c1d784ada0cd300fd" > > diff --git a/meta/recipes-devtools/go/go-1.19/CVE-2023-29406.patch > b/meta/recipes-devtools/go/go-1.19/CVE-2023-29406.patch > new file mode 100644 > index 0000000000..8a82d5c18c > --- /dev/null > +++ b/meta/recipes-devtools/go/go-1.19/CVE-2023-29406.patch > @@ -0,0 +1,210 @@ > +From 3077df09879fb1aad0ccfc009fee6fc5e5f532bc Mon Sep 17 00:00:00 2001 > +From: Damien Neil <dn...@google.com> > +Date: Wed, 28 Jun 2023 13:20:08 -0700 > +Subject: [PATCH] net/http: validate Host header before sending > + > +Verify that the Host header we send is valid. > +Avoids surprising behavior such as a Host of "go.dev\r\nX-Evil:oops" > +adding an X-Evil header to HTTP/1 requests. > + > +Add a test, skip the test for HTTP/2. HTTP/2 is not vulnerable to > +header injection in the way HTTP/1 is, but x/net/http2 doesn't validate > +the header and will go into a retry loop when the server rejects it. > +CL 506995 adds the necessary validation to x/net/http2. > + > +Updates #60374 > +Fixes #61075 > +For CVE-2023-29406 > + > +Change-Id: I05cb6866a9bead043101954dfded199258c6dd04 > +Reviewed-on: https://go-review.googlesource.com/c/go/+/506996 > +Reviewed-by: Tatiana Bradley <tatianabrad...@google.com> > +TryBot-Result: Gopher Robot <go...@golang.org> > +Run-TryBot: Damien Neil <dn...@google.com> > +(cherry picked from commit 499458f7ca04087958987a33c2703c3ef03e27e2) > +Reviewed-on: https://go-review.googlesource.com/c/go/+/507358 > +Run-TryBot: Tatiana Bradley <tatianabrad...@google.com> > +Reviewed-by: Roland Shoemaker <rol...@golang.org> > + > +CVE: CVE-2023-29406 > +Upstream-Status: Backport [5fa6923b1ea891400153d04ddf1545e23b40041b] > +Signed-off-by: Sakib Sajal <sakib.sa...@windriver.com> > +--- > + src/net/http/http_test.go | 29 ---------------------- > + src/net/http/request.go | 45 ++++++++-------------------------- > + src/net/http/request_test.go | 11 ++------- > + src/net/http/transport_test.go | 18 ++++++++++++++ > + 4 files changed, 30 insertions(+), 73 deletions(-) > + > +diff --git a/src/net/http/http_test.go b/src/net/http/http_test.go > +index 0d92fe5..f03272a 100644 > +--- a/src/net/http/http_test.go > ++++ b/src/net/http/http_test.go > +@@ -48,35 +48,6 @@ func TestForeachHeaderElement(t *testing.T) { > + } > + } > + > +-func TestCleanHost(t *testing.T) { > +- tests := []struct { > +- in, want string > +- }{ > +- {"www.google.com", "www.google.com"}, > +- {"www.google.com foo", "www.google.com"}, > +- {"www.google.com/foo", "www.google.com"}, > +- {" first character is a space", ""}, > +- {"[1::6]:8080", "[1::6]:8080"}, > +- > +- // Punycode: > +- {"гофер.рф/foo", "xn--c1ae0ajs.xn--p1ai"}, > +- {"bücher.de", "xn--bcher-kva.de"}, > +- {"bücher.de:8080", "xn--bcher-kva.de:8080"}, > +- // Verify we convert to lowercase before punycode: > +- {"BÜCHER.de", "xn--bcher-kva.de"}, > +- {"BÜCHER.de:8080", "xn--bcher-kva.de:8080"}, > +- // Verify we normalize to NFC before punycode: > +- {"gophér.nfc", "xn--gophr-esa.nfc"}, // NFC input; > no work needed > +- {"goph\u0065\u0301r.nfd", "xn--gophr-esa.nfd"}, // NFD input > +- } > +- for _, tt := range tests { > +- got := cleanHost(tt.in) > +- if tt.want != got { > +- t.Errorf("cleanHost(%q) = %q, want %q", tt.in, got, > tt.want) > +- } > +- } > +-} > +- > + // Test that cmd/go doesn't link in the HTTP server. > + // > + // This catches accidental dependencies between the HTTP transport and > +diff --git a/src/net/http/request.go b/src/net/http/request.go > +index 09cb0c7..2f4e740 100644 > +--- a/src/net/http/request.go > ++++ b/src/net/http/request.go > +@@ -17,7 +17,6 @@ import ( > + "io" > + "mime" > + "mime/multipart" > +- "net" > + "net/http/httptrace" > + "net/http/internal/ascii" > + "net/textproto" > +@@ -27,6 +26,7 @@ import ( > + "strings" > + "sync" > + > ++ "golang.org/x/net/http/httpguts" > + "golang.org/x/net/idna" > + ) > + > +@@ -568,12 +568,19 @@ func (r *Request) write(w io.Writer, usingProxy bool, > extraHeaders Header, waitF > + // is not given, use the host from the request URL. > + // > + // Clean the host, in case it arrives with unexpected stuff in it. > +- host := cleanHost(r.Host) > ++ host := r.Host > + if host == "" { > + if r.URL == nil { > + return errMissingHost > + } > +- host = cleanHost(r.URL.Host) > ++ host = r.URL.Host > ++ } > ++ host, err = httpguts.PunycodeHostPort(host) > ++ if err != nil { > ++ return err > ++ } > ++ if !httpguts.ValidHostHeader(host) { > ++ return errors.New("http: invalid Host header") > + } > + > + // According to RFC 6874, an HTTP client, proxy, or other > +@@ -730,38 +737,6 @@ func idnaASCII(v string) (string, error) { > + return idna.Lookup.ToASCII(v) > + } > + > +-// cleanHost cleans up the host sent in request's Host header. > +-// > +-// It both strips anything after '/' or ' ', and puts the value > +-// into Punycode form, if necessary. > +-// > +-// Ideally we'd clean the Host header according to the spec: > +-// https://tools.ietf.org/html/rfc7230#section-5.4 (Host = uri-host [ ":" > port ]") > +-// https://tools.ietf.org/html/rfc7230#section-2.7 (uri-host -> rfc3986's > host) > +-// https://tools.ietf.org/html/rfc3986#section-3.2.2 (definition of host) > +-// But practically, what we are trying to avoid is the situation in > +-// issue 11206, where a malformed Host header used in the proxy context > +-// would create a bad request. So it is enough to just truncate at the > +-// first offending character. > +-func cleanHost(in string) string { > +- if i := strings.IndexAny(in, " /"); i != -1 { > +- in = in[:i] > +- } > +- host, port, err := net.SplitHostPort(in) > +- if err != nil { // input was just a host > +- a, err := idnaASCII(in) > +- if err != nil { > +- return in // garbage in, garbage out > +- } > +- return a > +- } > +- a, err := idnaASCII(host) > +- if err != nil { > +- return in // garbage in, garbage out > +- } > +- return net.JoinHostPort(a, port) > +-} > +- > + // removeZone removes IPv6 zone identifier from host. > + // E.g., "[fe80::1%en0]:8080" to "[fe80::1]:8080" > + func removeZone(host string) string { > +diff --git a/src/net/http/request_test.go b/src/net/http/request_test.go > +index fac12b7..368e87a 100644 > +--- a/src/net/http/request_test.go > ++++ b/src/net/http/request_test.go > +@@ -776,15 +776,8 @@ func TestRequestBadHost(t *testing.T) { > + } > + req.Host = "foo.com with spaces" > + req.URL.Host = "foo.com with spaces" > +- req.Write(logWrites{t, &got}) > +- want := []string{ > +- "GET /after HTTP/1.1\r\n", > +- "Host: foo.com\r\n", > +- "User-Agent: " + DefaultUserAgent + "\r\n", > +- "\r\n", > +- } > +- if !reflect.DeepEqual(got, want) { > +- t.Errorf("Writes = %q\n Want = %q", got, want) > ++ if err := req.Write(logWrites{t, &got}); err == nil { > ++ t.Errorf("Writing request with invalid Host: succeded, want > error") > + } > + } > + > +diff --git a/src/net/http/transport_test.go b/src/net/http/transport_test.go > +index eeaa492..58f12af 100644 > +--- a/src/net/http/transport_test.go > ++++ b/src/net/http/transport_test.go > +@@ -6512,3 +6512,21 @@ func TestCancelRequestWhenSharingConnection(t > *testing.T) { > + close(r2c) > + wg.Wait() > + } > ++ > ++func TestRequestSanitization(t *testing.T) { > ++ setParallel(t) > ++ defer afterTest(t) > ++ > ++ ts := newClientServerTest(t, h1Mode, HandlerFunc(func(rw > ResponseWriter, req *Request) { > ++ if h, ok := req.Header["X-Evil"]; ok { > ++ t.Errorf("request has X-Evil header: %q", h) > ++ } > ++ })).ts > ++ defer ts.Close() > ++ req, _ := NewRequest("GET", ts.URL, nil) > ++ req.Host = "go.dev\r\nX-Evil:evil" > ++ resp, _ := ts.Client().Do(req) > ++ if resp != nil { > ++ resp.Body.Close() > ++ } > ++} > +-- > +2.35.5 > + > -- > 2.39.0 > > > >
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#185420): https://lists.openembedded.org/g/openembedded-core/message/185420 Mute This Topic: https://lists.openembedded.org/mt/100496289/21656 Group Owner: openembedded-core+ow...@lists.openembedded.org Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
