diff options
| author | Marius Bakke <mbakke@fastmail.com> | 2019-07-12 01:03:53 +0200 |
|---|---|---|
| committer | Marius Bakke <mbakke@fastmail.com> | 2019-07-12 01:03:53 +0200 |
| commit | fb9a23a3f3ad3d7b5b7f03b2007baf27684d6bbd (patch) | |
| tree | afbd3f4f33771c61254b0c3d977092542fbe8009 /gnu/packages/patches/cvs-CVE-2017-12836.patch | |
| parent | 1c4b72cb34640638e40c5190676e5c8c352d292d (diff) | |
| parent | 5a836ce38c9c29e9c2bd306007347486b90c5064 (diff) | |
| download | guix-patches-fb9a23a3f3ad3d7b5b7f03b2007baf27684d6bbd.tar guix-patches-fb9a23a3f3ad3d7b5b7f03b2007baf27684d6bbd.tar.gz | |
Merge branch 'master' into core-updates
Conflicts:
gnu/local.mk
gnu/packages/python-xyz.scm
gnu/packages/xml.scm
guix/gexp.scm
po/guix/POTFILES.in
Diffstat (limited to 'gnu/packages/patches/cvs-CVE-2017-12836.patch')
| -rw-r--r-- | gnu/packages/patches/cvs-CVE-2017-12836.patch | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/gnu/packages/patches/cvs-CVE-2017-12836.patch b/gnu/packages/patches/cvs-CVE-2017-12836.patch new file mode 100644 index 0000000000..507ab0f7d0 --- /dev/null +++ b/gnu/packages/patches/cvs-CVE-2017-12836.patch @@ -0,0 +1,45 @@ +Fix CVE-2017-12836: + +http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12836 +https://security-tracker.debian.org/tracker/CVE-2017-12836 + +Patch adpated from Debian (comments and changelog annotations removed): + +https://anonscm.debian.org/cgit/collab-maint/cvs.git/commit/?h=stretch&id=41e077396e35efb6c879951f44c62dd8a1d0f094 + +From 41e077396e35efb6c879951f44c62dd8a1d0f094 Mon Sep 17 00:00:00 2001 +From: mirabilos <m@mirbsd.org> +Date: Sat, 12 Aug 2017 03:17:18 +0200 +Subject: Fix CVE-2017-12836 (Closes: #871810) for stretch + +--- + debian/changelog | 6 ++++++ + src/rsh-client.c | 10 ++++++++-- + 2 files changed, 14 insertions(+), 2 deletions(-) + +diff --git a/src/rsh-client.c b/src/rsh-client.c +index fe0cfc4..1fc860d 100644 +--- a/src/rsh-client.c ++++ b/src/rsh-client.c +@@ -105,6 +106,9 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p, + rsh_argv[i++] = argvport; + } + ++ /* Only non-option arguments from here. (CVE-2017-12836) */ ++ rsh_argv[i++] = "--"; ++ + rsh_argv[i++] = root->hostname; + rsh_argv[i++] = cvs_server; + if (readonlyfs) +@@ -189,6 +193,8 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p, + *p++ = argvport; + } + ++ *p++ = "--"; ++ + *p++ = root->hostname; + *p++ = command; + *p++ = NULL; +-- +cgit v0.12 + |