From unknown Fri Sep 19 16:51:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#28143] [PATCH] gnu: newsbeuter: Fix CVE-2017-12904. Resent-From: Leo Famulari Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Fri, 18 Aug 2017 20:48:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 28143 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 28143@debbugs.gnu.org X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.150308925721869 (code B ref -1); Fri, 18 Aug 2017 20:48:02 +0000 Received: (at submit) by debbugs.gnu.org; 18 Aug 2017 20:47:37 +0000 Received: from localhost ([127.0.0.1]:44686 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dioB2-0005gZ-2m for submit@debbugs.gnu.org; Fri, 18 Aug 2017 16:47:37 -0400 Received: from eggs.gnu.org ([208.118.235.92]:35392) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dioAy-0005gJ-9d for submit@debbugs.gnu.org; Fri, 18 Aug 2017 16:47:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dioAr-000703-TJ for submit@debbugs.gnu.org; Fri, 18 Aug 2017 16:47:23 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,TVD_SPACE_RATIO, T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:45016) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dioAr-0006zu-Pa for submit@debbugs.gnu.org; Fri, 18 Aug 2017 16:47:21 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54589) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dioAq-0003vZ-BD for guix-patches@gnu.org; Fri, 18 Aug 2017 16:47:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dioAn-0006xs-0g for guix-patches@gnu.org; Fri, 18 Aug 2017 16:47:20 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:52607) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dioAm-0006xN-LN for guix-patches@gnu.org; Fri, 18 Aug 2017 16:47:16 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id E59F622060; Fri, 18 Aug 2017 16:47:14 -0400 (EDT) Received: from frontend1 ([10.202.2.160]) by compute4.internal (MEProxy); Fri, 18 Aug 2017 16:47:14 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=date:from:message-id:subject:to:x-me-sender:x-me-sender :x-sasl-enc:x-sasl-enc; s=mesmtp; bh=Ib/4SngzK6R9JcpsxI4uytiUZ0+ 5/ROTRqMUQCIfjR4=; b=OadfzLMV8Bn6RkOXdpzVGBf8ItOc4QpHmaCsMtjRcSp RluKhg+62l3ttK9pzt6Mc25YbMzLCaR2Cb6nu9HYpu0AknshEG5FBiWSUsW/dFTH pD0ipdTF9LOQ5GVqrvbTvtMuR0JwjBsmGtV4WfF4jJttsilIkxUTzeD2kbDzdV4s = DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=date:from:message-id:subject:to :x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=Ib/4Sn gzK6R9JcpsxI4uytiUZ0+5/ROTRqMUQCIfjR4=; b=AtGqJQDv+CV69bmfSqWLcp 1pbuVoun+YuN7EvHqFhf8B6wS8WlSDPybz97Q4IVWYrNeDLXukVPATIymEHPhy9Y vRvmy1htp5yQW4A2orgDvHyDnhVbZkze0cfLUhtzwY98B7vUmV6TQ7wfWzAVRp3U ysaNBjY1PxgyiHiF/LEUxI6ZZ6oN9zY7IxwTuW9Az1+GU0KPQhDewok86S5r0fQh dYI0h1s+EFsGXh3pbueZZ0VmooGwCppcRNYeZ+KjT+8+eol4lBoFXA9yUMk1hemR 5gWoLBEXTUJd4UGJaFQDp766+SrmsB6UsY7jcSSb+5WmlkGuCjjVYErOaRdPo9gA == X-ME-Sender: X-Sasl-enc: iGoSaIKxH2K1qpIQ+Sn5qUvgvdymK8R0RtdEqIymGP1I 1503089234 Received: from jasmine.lan (c-73-165-108-70.hsd1.pa.comcast.net [73.165.108.70]) by mail.messagingengine.com (Postfix) with ESMTPA id AC8C57F97F for ; Fri, 18 Aug 2017 16:47:14 -0400 (EDT) From: Leo Famulari Date: Fri, 18 Aug 2017 16:47:09 -0400 Message-Id: X-Mailer: git-send-email 2.14.1 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.9 (/) * gnu/packages/patches/newsbeuter-CVE-2017-12904.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/syndication.scm (newsbeuter)[source]: Use it. --- gnu/local.mk | 1 + .../patches/newsbeuter-CVE-2017-12904.patch | 34 ++++++++++++++++++++++ gnu/packages/syndication.scm | 2 ++ 3 files changed, 37 insertions(+) create mode 100644 gnu/packages/patches/newsbeuter-CVE-2017-12904.patch diff --git a/gnu/local.mk b/gnu/local.mk index c37d4b220..8e4e29bdd 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -879,6 +879,7 @@ dist_patch_DATA = \ %D%/packages/patches/netsurf-system-utf8proc.patch \ %D%/packages/patches/netsurf-y2038-tests.patch \ %D%/packages/patches/netsurf-longer-test-timeout.patch \ + %D%/packages/patches/newsbeuter-CVE-2017-12904.patch \ %D%/packages/patches/ngircd-handle-zombies.patch \ %D%/packages/patches/ninja-zero-mtime.patch \ %D%/packages/patches/node-9077.patch \ diff --git a/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch b/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch new file mode 100644 index 000000000..8e9050246 --- /dev/null +++ b/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch @@ -0,0 +1,34 @@ +Fix CVE-2017-12904: + +https://github.com/akrennmair/newsbeuter/issues/591 +https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12904 + +Patch copied from the Debian package of newsbeuter, version 2.9-5+deb9u1. + +Adapted from upstream source repository: + +https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307 + +Description: Fix a RCE vulnerability in the bookmark command + Newsbeuter didn't properly escape the title and description fields before + passing them to the bookmarking program which could lead to remote code + execution using the shells command substitution functionality (e.g. "$()", ``, + etc) + +Origin: upstream, https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307 +Last-Update: 2017-08-18 + +--- newsbeuter-2.9.orig/src/controller.cpp ++++ newsbeuter-2.9/src/controller.cpp +@@ -1274,9 +1274,10 @@ std::string controller::bookmark(const s + std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd"); + bool is_interactive = cfg.get_configvalue_as_bool("bookmark-interactive"); + if (bookmark_cmd.length() > 0) { +- std::string cmdline = utils::strprintf("%s '%s' %s %s", ++ std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'", + bookmark_cmd.c_str(), utils::replace_all(url,"'", "%27").c_str(), +- stfl::quote(title).c_str(), stfl::quote(description).c_str()); ++ utils::replace_all(title,"'", "%27").c_str(), ++ utils::replace_all(description,"'", "%27").c_str()); + + LOG(LOG_DEBUG, "controller::bookmark: cmd = %s", cmdline.c_str()); diff --git a/gnu/packages/syndication.scm b/gnu/packages/syndication.scm index f43400665..80c45c396 100644 --- a/gnu/packages/syndication.scm +++ b/gnu/packages/syndication.scm @@ -18,6 +18,7 @@ #:use-module (guix download) #:use-module (guix packages) #:use-module (guix build-system gnu) + #:use-module (gnu packages) #:use-module (gnu packages curl) #:use-module (gnu packages databases) #:use-module (gnu packages gettext) @@ -37,6 +38,7 @@ (method url-fetch) (uri (string-append "https://newsbeuter.org/downloads/newsbeuter-" version ".tar.gz")) + (patches (search-patches "newsbeuter-CVE-2017-12904.patch")) (sha256 (base32 "1j1x0hgwxz11dckk81ncalgylj5y5fgw5bcmp9qb5hq9kc0vza3l")))) -- 2.14.1 From unknown Fri Sep 19 16:51:32 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#28143] [PATCH] gnu: newsbeuter: Fix CVE-2017-12904. Resent-From: Marius Bakke Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Fri, 18 Aug 2017 20:56:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 28143 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: Leo Famulari , 28143@debbugs.gnu.org Received: via spool by 28143-submit@debbugs.gnu.org id=B28143.150308975922576 (code B ref 28143); Fri, 18 Aug 2017 20:56:01 +0000 Received: (at 28143) by debbugs.gnu.org; 18 Aug 2017 20:55:59 +0000 Received: from localhost ([127.0.0.1]:44693 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dioJD-0005s4-6D for submit@debbugs.gnu.org; Fri, 18 Aug 2017 16:55:59 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:35209) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dioJA-0005rv-5D for 28143@debbugs.gnu.org; Fri, 18 Aug 2017 16:55:58 -0400 Received: from compute5.internal (compute5.nyi.internal [10.202.2.45]) by mailout.nyi.internal (Postfix) with ESMTP id D2DF722051; Fri, 18 Aug 2017 16:55:55 -0400 (EDT) Received: from frontend2 ([10.202.2.161]) by compute5.internal (MEProxy); Fri, 18 Aug 2017 16:55:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fastmail.com; h= content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc :x-sasl-enc; s=fm1; bh=lTnetSk3bSSHbuLRZzVNScm4vJy22SnBnlJHTkfsZ S0=; b=QbosAX+8o4e0Rr6DQd882RsgUZxf0tkxjEZ0tdtnlDduwi4pUVbapVrEH YMWGltQqDOflp7rGyp+vpAWC1vCcjRaQVVJvrr/cTVU3DkGiZxxWfC6DfGtwXjbv qwT/089uOv95CBCgfmGnbU6LbR/Wbh2k5JgsS8k6K8FbH94i1qRAv9bx1NaaxIXR U80Kkr/et5JptAVcs8vGnpGghupfnSj4gejg2/Miw7WuM8n8C+Vhi2psFYxD+l0S UeZlbIbFZErcOL0slj+Dr/pjcJshwA+MGeumZAI6z46+7vj3i3pcacjFVaBmEJyW by8aN/aijREt5tK1RZBPDetWjSctw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=lTnetSk3bSSHbuLRZz VNScm4vJy22SnBnlJHTkfsZS0=; b=BLNnFi69mayN1J07hvToy52cU0VhX2XxcZ HpGv4JSs3ymkUoh0VQoReYBVMhLr0QsnE25MEI/u7SpAsghyrwSww8UMuF0lHFIC a/6RYyx/NuuyjkmxPNjNCirEx7+PaYkLTf7JjqVl0LUGHr7IVVs2bMlbQrXgm26f JqNlHcQJCEkrBrd5xpC+so4yNbE/YuqE5mSjuuSJGKZneTVumrFl9i6Hedxi0dgq 29aLuMN9+0SlrKKCniwFVghC7Me9YoWyJlTBOrFsUrAersiWpGWMmlCEZvIrPPbr OLw6lPz5IupWoATWLlLOdkLNNMPbSPLLSI0/SJxbZ9ZzuoDxttcQ== X-ME-Sender: X-Sasl-enc: aEVcGmXVre9dd3CSemCea3CSByHbTZVIXLgOzn6RYGE5 1503089755 Received: from localhost (unknown [188.113.81.93]) by mail.messagingengine.com (Postfix) with ESMTPA id 59C9524772; Fri, 18 Aug 2017 16:55:55 -0400 (EDT) From: Marius Bakke In-Reply-To: References: User-Agent: Notmuch/0.25 (https://notmuchmail.org) Emacs/25.2.1 (x86_64-unknown-linux-gnu) Date: Fri, 18 Aug 2017 22:55:27 +0200 Message-ID: <87lgmgy4sg.fsf@fastmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" X-Spam-Score: -0.7 (/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) --=-=-= Content-Type: text/plain Leo Famulari writes: > * gnu/packages/patches/newsbeuter-CVE-2017-12904.patch: New file. > * gnu/local.mk (dist_patch_DATA): Add it. > * gnu/packages/syndication.scm (newsbeuter)[source]: Use it. LGTM, thanks! --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEu7At3yzq9qgNHeZDoqBt8qM6VPoFAlmXVD8ACgkQoqBt8qM6 VPrqkQgAqHHDwgKfQmmI1X5UT+k/mg2X7IysNqh9DOQ55ZGQBAXD18gVEKprJswZ AQbLhaVEFBfiKbIILc94LGf78cfgSURom5u0Uxpa5LIrsQKhOaz4ZKBRzrU4hM9e 2yE/Qh4Tj5kMVIOXkjWm56P4sPyPl5WN0Knt4cDUV6l6zxVjr5Qpl8KgJ/xjqJ93 +BQ2/3JKEQVqxUnJq4izCPDWt4tj33qj5LQMQ2gGmx9EDERqimKufYZ49waXTxG3 LumHFT0bxAA482Z6SwLTdramcZKN9mQALlxIyXN2fupaQTNoPI2/kE4pn73GCDtI nnL2a8Bl08Jrm+xfH7sopzLLJ+qqwA== =kP2H -----END PGP SIGNATURE----- --=-=-=-- From debbugs-submit-bounces@debbugs.gnu.org Fri Aug 18 17:25:24 2017 Received: (at control) by debbugs.gnu.org; 18 Aug 2017 21:25:24 +0000 Received: from localhost ([127.0.0.1]:44712 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1diolg-0006YO-Gw for submit@debbugs.gnu.org; Fri, 18 Aug 2017 17:25:24 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:49609) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1diolf-0006YH-T9 for control@debbugs.gnu.org; Fri, 18 Aug 2017 17:25:24 -0400 Received: from compute4.internal (compute4.nyi.internal [10.202.2.44]) by mailout.nyi.internal (Postfix) with ESMTP id C99C222182; Fri, 18 Aug 2017 17:25:23 -0400 (EDT) Received: from frontend2 ([10.202.2.161]) by compute4.internal (MEProxy); Fri, 18 Aug 2017 17:25:23 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=famulari.name; h=content-type:date:from:message-id:mime-version:to:x-me-sender :x-me-sender:x-sasl-enc:x-sasl-enc; s=mesmtp; bh=H3mBnF0ZZjYETlK CXOlolr4tryGyJwaYu5s8y+3rL0o=; b=OA7rdI0Afj8pmQj74gWi+TTQa0GcwGA L3euSFEcwUq7JndiJo+Tq81gYzsyxEsGwfxBdrFMQ+tDg2qKJybiKXf4RQUjXYbS Zcx+HAarpyJmodAuyd+uZUn5LGTcadjE1DCb3eKLJH2boyjLrI3tsRyRe6+HDPd8 xMXRNRFplqs0= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:to:x-me-sender:x-me-sender:x-sasl-enc:x-sasl-enc; s=fm1; bh=H3mBnF0ZZjYETlKCXOlolr4tryGyJwaYu5s8y+3rL0o=; b=CYiAx gJF/GaRHoi7JmEZm9cqxwFRyWyLZFiV1kmHi0yn3lXqFnbaJHuQifPqQ78Y19e5O rIqZqxVVX6OuX4jSNV9wnk8evrOhNuz9yebSVD7jDiW11xHgiploS9m2o7BjfiQP W52tLwYxMiLgtS4MM8NHC9J50Fl1vvcjBMafRpIGIVQtqKLtMoEag6UYL7Q1+man 64sFY3TISbbh+dzVUqyeKvHhsw/qjcb23H+T19+LRnkI9iIGYOEoPGhc//CUJz0o I3wkMvo89eCrK8ex0ZmOV1uG49etzI/aVa7D9aMg2W9HXrda2RY8FRcELjIrPVsJ hXM5edl0o2OqRE+yQ== X-ME-Sender: X-Sasl-enc: LKZbrvONxo2ZswMd2hus+2XLuPw0wAmXXD4NTHQvgbK9 1503091523 Received: from localhost (c-73-165-108-70.hsd1.pa.comcast.net [73.165.108.70]) by mail.messagingengine.com (Postfix) with ESMTPA id 71FC4240AF for ; Fri, 18 Aug 2017 17:25:23 -0400 (EDT) Date: Fri, 18 Aug 2017 17:25:22 -0400 From: Leo Famulari To: control@debbugs.gnu.org Message-ID: <20170818212522.GA5892@jasmine.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.8.3 (2017-05-23) X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: close 28143 [...] Content analysis details: (1.3 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [66.111.4.25 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [66.111.4.25 listed in wl.mailspike.net] 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 1.8 MISSING_SUBJECT Missing Subject: header 0.2 NO_SUBJECT Extra score for no subject -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 1.3 (+) X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: close 28143 [...] Content analysis details: (1.3 points, 10.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [66.111.4.25 listed in wl.mailspike.net] -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [66.111.4.25 listed in list.dnswl.org] -0.0 SPF_PASS SPF: sender matches SPF record 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 TVD_SPACE_RATIO No description available. 1.8 MISSING_SUBJECT Missing Subject: header 0.2 NO_SUBJECT Extra score for no subject -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders close 28143