diff --git a/meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch new file mode 100644 index 0000000000..6097da38c3 --- /dev/null +++ b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712-regression.patch @@ -0,0 +1,39 @@ +From 1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Tue, 14 Apr 2026 04:32:00 +0000 +Subject: [PATCH] tools:gpgtar: Fix for a case of non existing dir with -C. + +* tools/gpgtar-extract.c (gpgtar_extract): Call the +check_output_directory function only when DIRNAME exists. + +-- +GnuPG-bug-id: 8159 + +CVE: CVE-2026-105712 +Upstream-Status: Backport [https://github.com/gpg/gnupg/commit/1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5] + +Backport Changes: +- Used gnupg_access() for the existence check because 2.5.17 does not + have the upstream COMPAT_NO_DIR_CHECK compatibility flag. + +Signed-off-by: NIIBE Yutaka +(cherry picked from commit 1bdd1f5bb4d192d9700dd6ab2540b0a940c23dd5) +Signed-off-by: Deepak Rathore +--- + tools/gpgtar-extract.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/gpgtar-extract.c b/tools/gpgtar-extract.c +index 5ca80cb..a5a925c 100644 +--- a/tools/gpgtar-extract.c ++++ b/tools/gpgtar-extract.c +@@ -504,7 +504,8 @@ gpgtar_extract (const char *filename, int decrypt) + goto leave; + } + +- if (!check_output_directory (dirname)) ++ if (gnupg_access (dirname, F_OK) == 0 ++ && !check_output_directory (dirname)) + { + err = gpg_error (GPG_ERR_INV_ARG); + goto leave; diff --git a/meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch new file mode 100644 index 0000000000..9b0bc1ca66 --- /dev/null +++ b/meta/recipes-support/gnupg/gnupg/CVE-2026-105712.patch @@ -0,0 +1,194 @@ +From 8df56dd913f3c910c9b265691efaac6c36a007a1 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Fri, 20 Mar 2026 13:33:00 +0900 +Subject: [PATCH] tool:gpgtar: Check the output directory with --directory. + +* doc/tools.texi (gpgtar): Clarify about the --directory option. +* tools/gpgtar-extract.c (check_output_directory): New. +(gpgtar_extract): Call check_output_directory. + +-- + +GnuPG-bug-id: 8159 + +CVE: CVE-2026-105712 +Upstream-Status: Backport [https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88] + +Signed-off-by: NIIBE Yutaka +(cherry picked from commit 7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88) +Signed-off-by: Deepak Rathore +--- + doc/tools.texi | 11 ++-- + tools/gpgtar-extract.c | 123 ++++++++++++++++++++++++++++++++++++++++- + 2 files changed, 128 insertions(+), 6 deletions(-) + +diff --git a/doc/tools.texi b/doc/tools.texi +index 45f3e897d..691b7dc9c 100644 +--- a/doc/tools.texi ++++ b/doc/tools.texi +@@ -2024,11 +2024,12 @@ Do not actually output the extracted files. + @item --directory @var{dir} + @itemx -C @var{dir} + @opindex directory +-Extract the files into the directory @var{dir}. The default is to +-take the directory name from the input filename. If no input filename +-is known a directory named @file{GPGARCH} is used. For tarball +-creation, switch to directory @var{dir} before performing any +-operations. ++Extract the files into the directory @var{dir}. It raises an error ++when @var{dir} is not empty, or @var{dir} is a symlink to other ++directory. When this option is not given, the default is to take the ++directory name from the input filename. If no input filename is known ++a directory, named @file{GPGARCH} is used. For tarball creation, ++switch to directory @var{dir} before performing any operations. + + @item --files-from @var{file} + @itemx -T @var{file} +diff --git a/tools/gpgtar-extract.c b/tools/gpgtar-extract.c +index d23ccc579..5ca80cb89 100644 +--- a/tools/gpgtar-extract.c ++++ b/tools/gpgtar-extract.c +@@ -24,6 +24,8 @@ + #include + #include + #include ++#include ++#include + #include + #include + #include +@@ -369,6 +371,112 @@ create_directory (const char *dirprefix) + } + + ++/* Check the output directory DIRNAME if it's not symlink and empty. ++ Return 1 if good, 0 otherwise. */ ++static int ++check_output_directory (const char *dirname) ++{ ++#ifdef HAVE_W32_SYSTEM ++#define dirent _wdirent ++#define DIR _WDIR ++#define readdir _wreaddir ++#define closedir _wclosedir ++#endif ++ DIR *d; ++ struct dirent *dent; ++ int count = 0; ++ ++#ifdef HAVE_W32_SYSTEM ++ wchar_t *wdirname; ++ DWORD attr; ++ ++ wdirname = utf8_to_wchar (dirname); ++ if (!wdirname) ++ return 0; ++ ++ attr = GetFileAttributesW (wdirname); ++ ++ if (attr == INVALID_FILE_ATTRIBUTES) ++ { ++ log_error ("error getting attributes '%s': %s\n", dirname, w32_strerror (-1)); ++ xfree (wdirname); ++ return 0; ++ } ++ else if ((attr & FILE_ATTRIBUTE_REPARSE_POINT)) ++ { ++ /* It's reparse point (possibly symlink), not good. */ ++ log_error ("Not a regular directory (may be symlink): %s\n", dirname); ++ xfree (wdirname); ++ return 0; ++ } ++ ++ d = _wopendir (wdirname); ++ xfree (wdirname); ++#else ++# if O_NOFOLLOW == 0 ++ struct stat sbuf; ++ ++ if (lstat (dirname, &sbuf)) ++ return 0; ++ ++ if (S_ISLNK (sbuf.st_mode)) ++ { ++ /* It's symlink, not good. */ ++ log_error ("It's symbolic link: %s\n", dirname); ++ return 0; ++ } ++ ++ d = opendir (dirname); ++# else ++ int fd; ++ ++ /* With O_NOFOLLOW, make sure it's not symlink. */ ++ fd = open (dirname, (O_RDONLY | O_NOFOLLOW)); ++ if (fd < 0) ++ { ++ log_error ("Can't open (symlink?): %s\n", dirname); ++ return 0; ++ } ++ ++ d = fdopendir (fd); ++# endif ++#endif ++ ++ if (d == NULL) ++ return 0; ++ ++ while ((dent = readdir (d)) != NULL) ++ { ++ if (dent->d_name[0] == '.' && dent->d_name[1] == 0) ++ continue; ++ ++ if (dent->d_name[0] == '.' && dent->d_name[1] == '.' ++ && dent->d_name[2] == 0) ++ continue; ++ ++ count++; ++ } ++ ++ /* In case of fdopendir, FD is released by closedir. */ ++ closedir (d); ++ ++ if (count) ++ { ++ /* It's not empty, not good. */ ++ log_error ("Directory not empty: %s\n", dirname); ++ return 0; ++ } ++ ++ /* Good. */ ++ return 1; ++} ++ ++#ifdef HAVE_W32_SYSTEM ++#undef dirent ++#undef DIR ++#undef readdir ++#undef closedir ++#endif + + gpg_error_t + gpgtar_extract (const char *filename, int decrypt) +@@ -388,7 +496,20 @@ gpgtar_extract (const char *filename, int decrypt) + memset (&tarinfo_buffer, 0, sizeof tarinfo_buffer); + + if (opt.directory) +- dirname = xtrystrdup (opt.directory); ++ { ++ dirname = xtrystrdup (opt.directory); ++ if (!dirname) ++ { ++ err = gpg_error_from_syserror (); ++ goto leave; ++ } ++ ++ if (!check_output_directory (dirname)) ++ { ++ err = gpg_error (GPG_ERR_INV_ARG); ++ goto leave; ++ } ++ } + else + { + if (opt.filename) diff --git a/meta/recipes-support/gnupg/gnupg_2.5.17.bb b/meta/recipes-support/gnupg/gnupg_2.5.17.bb index 6b2af1c96c..04666ee8d7 100644 --- a/meta/recipes-support/gnupg/gnupg_2.5.17.bb +++ b/meta/recipes-support/gnupg/gnupg_2.5.17.bb @@ -20,6 +20,8 @@ SRC_URI = "${GNUPG_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \ file://0002-use-pkgconfig-instead-of-npth-config.patch \ file://0001-Woverride-init-is-not-needed-with-gcc-9.patch \ file://CVE-2026-57062.patch \ + file://CVE-2026-105712.patch \ + file://CVE-2026-105712-regression.patch \ " SRC_URI:append:class-native = " file://0001-configure.ac-use-a-custom-value-for-the-location-of-.patch \ file://relocate.patch"