[meta-oe,01/15] uw-imap: patch CVE-2018-19518

Message ID	20241227105615.3303193-2-peter.marko@siemens.com
State	Under Review
Headers	show Return-Path: <peter.marko@siemens.com> ip: 185.136.64.227, mailfrom: fm-256628-202412271057206379a10f67b0e55381-ajqyzl@rts-flowmailer.siemens.com) From: Peter Marko <peter.marko@siemens.com> To: openembedded-devel@lists.openembedded.org Cc: Peter Marko <peter.marko@siemens.com> Subject: [meta-oe][PATCH 01/15] uw-imap: patch CVE-2018-19518 Date: Fri, 27 Dec 2024 11:56:01 +0100 Message-Id: <20241227105615.3303193-2-peter.marko@siemens.com> In-Reply-To: <20241227105615.3303193-1-peter.marko@siemens.com> References: <20241227105615.3303193-1-peter.marko@siemens.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Feedback-ID: 519:519-256628:519-21489:flowmailer
Series	4th series for meta-openembedded master \| expand [meta-oe,00/15] 4th series for meta-openembedded master [meta-oe,01/15] uw-imap: patch CVE-2018-19518 [meta-networking,02/15] spice: set CVE-2016-2150 status to fixed [meta-oe,03/15] id3lib: mark CVE-2007-4460 as fixed [meta-oe,04/15] procmail: patch CVE-2014-3618 [meta-oe,05/15] procmail: patch CVE-2017-16844. [meta-oe,06/15] imagemagick: refactor so devtool upgrade works [meta-oe,07/15] imagemagick: upgrade 7.1.1-26 -> 7.1.1-43 [meta-oe,08/15] imagemagick: mark CVE-2023-5341 as fixed [meta-oe,09/15] libwmf; switched to unofficial fork [meta-oe,10/15] limwmf: upgrade 0.2.8.4 -> 0.2.13 [meta-oe,11/15] audiofile: fix multiple CVEs [meta-oe,12/15] audiofile: patch CVE-2017-6829 [meta-oe,13/15] audiofile: fix multiple CVEs [meta-oe,14/15] audiofile: patch CVE-2017-6831 [meta-oe,15/15] audiofile: patch CVE-2017-6839

Message ID

20241227105615.3303193-2-peter.marko@siemens.com

State

Under Review

Headers

From: Peter Marko <peter.marko@siemens.com>
To: openembedded-devel@lists.openembedded.org
Cc: Peter Marko <peter.marko@siemens.com>
Subject: [meta-oe][PATCH 01/15] uw-imap: patch CVE-2018-19518
Date: Fri, 27 Dec 2024 11:56:01 +0100
Message-Id: <20241227105615.3303193-2-peter.marko@siemens.com>
In-Reply-To: <20241227105615.3303193-1-peter.marko@siemens.com>
References: <20241227105615.3303193-1-peter.marko@siemens.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Feedback-ID: 519:519-256628:519-21489:flowmailer

Series

4th series for meta-openembedded master | expand

Commit Message

Peter Marko Dec. 27, 2024, 10:56 a.m. UTC

From: Peter Marko <peter.marko@siemens.com>

Take patch from Debian from
https://salsa.debian.org/lts-team/packages/uw-imap/-/commit/873b07f46ce40f43bca10ec85fe63a7a0b934294

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../uw-imap/uw-imap/CVE-2018-19518.patch      | 24 +++++++++++++++++++
 .../recipes-devtools/uw-imap/uw-imap_2007f.bb |  1 +
 2 files changed, 25 insertions(+)
 create mode 100644 meta-oe/recipes-devtools/uw-imap/uw-imap/CVE-2018-19518.patch

diff --git a/meta-oe/recipes-devtools/uw-imap/uw-imap/CVE-2018-19518.patch b/meta-oe/recipes-devtools/uw-imap/uw-imap/CVE-2018-19518.patch
new file mode 100644
index 0000000000..d942a752b3
--- /dev/null
+++ b/meta-oe/recipes-devtools/uw-imap/uw-imap/CVE-2018-19518.patch
@@ -0,0 +1,24 @@ 
+uw-imap (8:2007f~dfsg-6) unstable; urgency=medium
+
+  * [CVE-2018-19518] 2013_disable_rsh.patch (new): Disable access to IMAP
+    mailboxes through running imapd over rsh, and therefore ssh (Closes:
+    #914632). Code using the library can enable it with tcp_parameters()
+    after making sure that the IMAP server name is sanitized.
+
+ -- Magnus Holmgren <holmgren@debian.org>  Tue, 26 Feb 2019 23:35:43 +0100
+
+CVE: CVE-2018-19518
+Upstream-Status: Inactive-Upstream [lastrelease: 2007]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+
+--- a/src/osdep/unix/Makefile
++++ b/src/osdep/unix/Makefile
+@@ -988,7 +988,7 @@ onceenv:
+ 	 -DMD5ENABLE=\"$(MD5PWD)\" -DMAILSPOOL=\"$(MAILSPOOL)\" \
+ 	 -DANONYMOUSHOME=\"$(MAILSPOOL)/anonymous\" \
+ 	 -DACTIVEFILE=\"$(ACTIVEFILE)\" -DNEWSSPOOL=\"$(NEWSSPOOL)\" \
+-	 -DRSHPATH=\"$(RSHPATH)\" -DLOCKPGM=\"$(LOCKPGM)\" \
++	 -DLOCKPGM=\"$(LOCKPGM)\" \
+ 	 -DLOCKPGM1=\"$(LOCKPGM1)\" -DLOCKPGM2=\"$(LOCKPGM2)\" \
+ 	 -DLOCKPGM3=\"$(LOCKPGM3)\" > OSCFLAGS
+ 	echo $(BASELDFLAGS) $(EXTRALDFLAGS) > LDFLAGS
diff --git a/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb b/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb
index 6df54ee185..54d33379da 100644
--- a/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb
+++ b/meta-oe/recipes-devtools/uw-imap/uw-imap_2007f.bb
@@ -17,6 +17,7 @@  SRC_URI = "https://fossies.org/linux/misc/old/imap-${PV}.tar.gz \
            file://0001-Fix-Wincompatible-function-pointer-types.patch \
            file://uw-imap-newer-tls.patch \
            file://uw-imap-fix-incompatible-pointer-types.patch \
+           file://CVE-2018-19518.patch \
            "
 
 SRC_URI[sha256sum] = "53e15a2b5c1bc80161d42e9f69792a3fa18332b7b771910131004eb520004a28"

[meta-oe,01/15] uw-imap: patch CVE-2018-19518

Commit Message

Patch