gnu/packages/patches/cvs-CVE-2017-12836.patch

   1 Fix CVE-2017-12836:
   2
   3 http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12836
   4 https://security-tracker.debian.org/tracker/CVE-2017-12836
   5
   6 Patch adpated from Debian (comments and changelog annotations removed):
   7
   8 https://anonscm.debian.org/cgit/collab-maint/cvs.git/commit/?h=stretch&id=41e077396e35efb6c879951f44c62dd8a1d0f094
   9
  10 From 41e077396e35efb6c879951f44c62dd8a1d0f094 Mon Sep 17 00:00:00 2001
  11 From: mirabilos <m@mirbsd.org>
  12 Date: Sat, 12 Aug 2017 03:17:18 +0200
  13 Subject: Fix CVE-2017-12836 (Closes: #871810) for stretch
  14
  15 ---
  16  debian/changelog |  6 ++++++
  17  src/rsh-client.c | 10 ++++++++--
  18  2 files changed, 14 insertions(+), 2 deletions(-)
  19
  20 diff --git a/src/rsh-client.c b/src/rsh-client.c
  21 index fe0cfc4..1fc860d 100644
  22 --- a/src/rsh-client.c
  23 +++ b/src/rsh-client.c
  24 @@ -105,6 +106,9 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p,
  25         rsh_argv[i++] = argvport;
  26      }
  27
  28 +    /* Only non-option arguments from here. (CVE-2017-12836) */
  29 +    rsh_argv[i++] = "--";
  30 +
  31      rsh_argv[i++] = root->hostname;
  32      rsh_argv[i++] = cvs_server;
  33      if (readonlyfs)
  34 @@ -189,6 +193,8 @@ start_rsh_server (cvsroot_t *root, struct buffer **to_server_p,
  35                 *p++ = argvport;
  36         }
  37
  38 +       *p++ = "--";
  39 +
  40         *p++ = root->hostname;
  41         *p++ = command;
  42         *p++ = NULL;
  43 --
  44 cgit v0.12
  45