libetpan rebuild.
This commit is contained in:
uglyside
@@ -0,0 +1,79 @@
|
||||
From 1002a0121a8f5a9aee25357769807f2c519fa50b Mon Sep 17 00:00:00 2001
|
||||
From: Damian Poddebniak <duesee@users.noreply.github.com>
|
||||
Date: Fri, 24 Jul 2020 19:39:53 +0200
|
||||
Subject: [PATCH] Detect extra data after STARTTLS response and exit (#387)
|
||||
|
||||
---
|
||||
src/low-level/imap/mailimap.c | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
diff --git a/src/low-level/imap/mailimap.c b/src/low-level/imap/mailimap.c
|
||||
index bb17119d..4ffcf55d 100644
|
||||
--- a/src/low-level/imap/mailimap.c
|
||||
+++ b/src/low-level/imap/mailimap.c
|
||||
@@ -2428,6 +2428,13 @@ int mailimap_starttls(mailimap * session)
|
||||
|
||||
mailimap_response_free(response);
|
||||
|
||||
+ // Detect if the server send extra data after the STARTTLS response.
|
||||
+ // This *may* be a "response injection attack".
|
||||
+ if (session->imap_stream->read_buffer_len != 0) {
|
||||
+ // Since it is also an IMAP protocol violation, exit.
|
||||
+ return MAILIMAP_ERROR_STARTTLS;
|
||||
+ }
|
||||
+
|
||||
switch (error_code) {
|
||||
case MAILIMAP_RESP_COND_STATE_OK:
|
||||
return MAILIMAP_NO_ERROR;
|
||||
From 298460a2adaabd2f28f417a0f106cb3b68d27df9 Mon Sep 17 00:00:00 2001
|
||||
From: Fabian Ising <Murgeye@users.noreply.github.com>
|
||||
Date: Fri, 24 Jul 2020 19:40:48 +0200
|
||||
Subject: [PATCH] Detect extra data after STARTTLS responses in SMTP and POP3
|
||||
and exit (#388)
|
||||
|
||||
* Detect extra data after STLS response and return error
|
||||
|
||||
* Detect extra data after SMTP STARTTLS response and return error
|
||||
---
|
||||
src/low-level/pop3/mailpop3.c | 8 ++++++++
|
||||
src/low-level/smtp/mailsmtp.c | 8 ++++++++
|
||||
2 files changed, 16 insertions(+)
|
||||
|
||||
diff --git a/src/low-level/pop3/mailpop3.c b/src/low-level/pop3/mailpop3.c
|
||||
index ab9535be..e2124bf8 100644
|
||||
--- a/src/low-level/pop3/mailpop3.c
|
||||
+++ b/src/low-level/pop3/mailpop3.c
|
||||
@@ -959,6 +959,14 @@ int mailpop3_stls(mailpop3 * f)
|
||||
|
||||
if (r != RESPONSE_OK)
|
||||
return MAILPOP3_ERROR_STLS_NOT_SUPPORTED;
|
||||
+
|
||||
+ // Detect if the server send extra data after the STLS response.
|
||||
+ // This *may* be a "response injection attack".
|
||||
+ if (f->pop3_stream->read_buffer_len != 0) {
|
||||
+ // Since it is also protocol violation, exit.
|
||||
+ // There is no error type for STARTTLS errors in POP3
|
||||
+ return MAILPOP3_ERROR_SSL;
|
||||
+ }
|
||||
|
||||
return MAILPOP3_NO_ERROR;
|
||||
}
|
||||
diff --git a/src/low-level/smtp/mailsmtp.c b/src/low-level/smtp/mailsmtp.c
|
||||
index b7fc459e..3145cadf 100644
|
||||
--- a/src/low-level/smtp/mailsmtp.c
|
||||
+++ b/src/low-level/smtp/mailsmtp.c
|
||||
@@ -1111,6 +1111,14 @@ int mailesmtp_starttls(mailsmtp * session)
|
||||
return MAILSMTP_ERROR_STREAM;
|
||||
r = read_response(session);
|
||||
|
||||
+ // Detect if the server send extra data after the STARTTLS response.
|
||||
+ // This *may* be a "response injection attack".
|
||||
+ if (session->stream->read_buffer_len != 0) {
|
||||
+ // Since it is also protocol violation, exit.
|
||||
+ // There is no general error type for STARTTLS errors in SMTP
|
||||
+ return MAILSMTP_ERROR_SSL;
|
||||
+ }
|
||||
+
|
||||
switch (r) {
|
||||
case 220:
|
||||
return MAILSMTP_NO_ERROR;
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
From 8ceb0cf0191f8b374a7f05974b29c6242ce8f752 Mon Sep 17 00:00:00 2001
|
||||
From: Damian Poddebniak <poddebniak@fh-muenster.de>
|
||||
Date: Thu, 23 Jul 2020 19:24:45 +0200
|
||||
Subject: [PATCH] Detect extra data after STARTTLS response and exit
|
||||
|
||||
---
|
||||
src/low-level/imap/mailimap.c | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
diff --git a/src/low-level/imap/mailimap.c b/src/low-level/imap/mailimap.c
|
||||
index bb17119d..4ffcf55d 100644
|
||||
--- a/src/low-level/imap/mailimap.c
|
||||
+++ b/src/low-level/imap/mailimap.c
|
||||
@@ -2428,6 +2428,13 @@ int mailimap_starttls(mailimap * session)
|
||||
|
||||
mailimap_response_free(response);
|
||||
|
||||
+ // Detect if the server send extra data after the STARTTLS response.
|
||||
+ // This *may* be a "response injection attack".
|
||||
+ if (session->imap_stream->read_buffer_len != 0) {
|
||||
+ // Since it is also an IMAP protocol violation, exit.
|
||||
+ return MAILIMAP_ERROR_STARTTLS;
|
||||
+ }
|
||||
+
|
||||
switch (error_code) {
|
||||
case MAILIMAP_RESP_COND_STATE_OK:
|
||||
return MAILIMAP_NO_ERROR;
|
||||
@@ -1,76 +1,83 @@
|
||||
<?xml version="1.0" ?>
|
||||
<!DOCTYPE PISI SYSTEM "https://pisilinux.org/projeler/pisi/pisi-spec.dtd">
|
||||
<PISI>
|
||||
<Source>
|
||||
<Name>libetpan</Name>
|
||||
<Homepage>https://www.etpan.org/libetpan.html</Homepage>
|
||||
<Packager>
|
||||
<Name>PisiLinux Community</Name>
|
||||
<Email>admins@pisilinux.org</Email>
|
||||
</Packager>
|
||||
<License>custom</License>
|
||||
<IsA>library</IsA>
|
||||
<PartOf>network.library</PartOf>
|
||||
<Summary>A portable middleware for email access.</Summary>
|
||||
<Description>The purpose of this mail library is to provide a portable, efficient framework for different kinds of mail access: IMAP, SMTP, POP and NNTP.</Description>
|
||||
<Archive sha1sum="cfdfe4329382a30afc5b540e258aaa950fabd25f" type="targz">
|
||||
https://github.com/dinhvh/libetpan/archive/1.9.4.tar.gz
|
||||
</Archive>
|
||||
<BuildDependencies>
|
||||
<Dependency>db-devel</Dependency>
|
||||
<Dependency>curl-devel</Dependency>
|
||||
<Dependency>expat-devel</Dependency>
|
||||
<Dependency>gnutls-devel</Dependency>
|
||||
<Dependency>openssl-devel</Dependency>
|
||||
<Dependency>cyrus-sasl-devel</Dependency>
|
||||
</BuildDependencies>
|
||||
<Patches>
|
||||
<Patch level="1">Detect_extra_data_after_STARTTLS_response_and_exit.patch</Patch>
|
||||
</Patches>
|
||||
</Source>
|
||||
<Source>
|
||||
<Name>libetpan</Name>
|
||||
<Homepage>https://www.etpan.org/libetpan.html</Homepage>
|
||||
<Packager>
|
||||
<Name>PisiLinux Community</Name>
|
||||
<Email>admins@pisilinux.org</Email>
|
||||
</Packager>
|
||||
<License>custom</License>
|
||||
<IsA>library</IsA>
|
||||
<PartOf>network.library</PartOf>
|
||||
<Summary>A portable middleware for email access.</Summary>
|
||||
<Description>The purpose of this mail library is to provide a portable, efficient framework for different kinds of mail access: IMAP, SMTP, POP and NNTP.</Description>
|
||||
<Archive sha1sum="cfdfe4329382a30afc5b540e258aaa950fabd25f" type="targz">
|
||||
https://github.com/dinhvh/libetpan/archive/1.9.4.tar.gz
|
||||
</Archive>
|
||||
<BuildDependencies>
|
||||
<Dependency>db-devel</Dependency>
|
||||
<Dependency>curl-devel</Dependency>
|
||||
<Dependency>expat-devel</Dependency>
|
||||
<Dependency>gnutls-devel</Dependency>
|
||||
<Dependency>openssl-devel</Dependency>
|
||||
<Dependency>cyrus-sasl-devel</Dependency>
|
||||
</BuildDependencies>
|
||||
<Patches>
|
||||
<Patch level="1">CVE-2020-15953.patch</Patch>
|
||||
</Patches>
|
||||
</Source>
|
||||
|
||||
<Package>
|
||||
<Name>libetpan</Name>
|
||||
<RuntimeDependencies>
|
||||
<Dependency>db</Dependency>
|
||||
<Dependency>openssl</Dependency>
|
||||
<Dependency>cyrus-sasl</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="library">/usr/lib</Path>
|
||||
</Files>
|
||||
</Package>
|
||||
<Package>
|
||||
<Name>libetpan</Name>
|
||||
<RuntimeDependencies>
|
||||
<Dependency>db</Dependency>
|
||||
<Dependency>openssl</Dependency>
|
||||
<Dependency>cyrus-sasl</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="library">/usr/lib</Path>
|
||||
</Files>
|
||||
</Package>
|
||||
|
||||
<Package>
|
||||
<Name>libetpan-devel</Name>
|
||||
<RuntimeDependencies>
|
||||
<Dependency release="current">libetpan</Dependency>
|
||||
<Dependency>db-devel</Dependency>
|
||||
<Dependency>gnutls-devel</Dependency>
|
||||
<Dependency>openssl-devel</Dependency>
|
||||
<Dependency>cyrus-sasl-devel</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="header">/usr/include</Path>
|
||||
<Path fileType="library">/usr/lib/pkgconfig</Path>
|
||||
</Files>
|
||||
</Package>
|
||||
<Package>
|
||||
<Name>libetpan-devel</Name>
|
||||
<RuntimeDependencies>
|
||||
<Dependency release="current">libetpan</Dependency>
|
||||
<Dependency>db-devel</Dependency>
|
||||
<Dependency>gnutls-devel</Dependency>
|
||||
<Dependency>openssl-devel</Dependency>
|
||||
<Dependency>cyrus-sasl-devel</Dependency>
|
||||
</RuntimeDependencies>
|
||||
<Files>
|
||||
<Path fileType="header">/usr/include</Path>
|
||||
<Path fileType="library">/usr/lib/pkgconfig</Path>
|
||||
</Files>
|
||||
</Package>
|
||||
|
||||
<History>
|
||||
<Update release="2">
|
||||
<History>
|
||||
<Update release="3">
|
||||
<Date>2025-06-28</Date>
|
||||
<Version>1.9.4</Version>
|
||||
<Comment>Rebuild.</Comment>
|
||||
<Name>Mustafa Cinasal</Name>
|
||||
<Email>muscnsl@gmail.com</Email>
|
||||
</Update>
|
||||
<Update release="2">
|
||||
<Date>2024-12-27</Date>
|
||||
<Version>1.9.4</Version>
|
||||
<Comment>Rebuild.</Comment>
|
||||
<Name>Mustafa Cinasal</Name>
|
||||
<Email>muscnsl@gmail.com</Email>
|
||||
</Update>
|
||||
<Update release="1">
|
||||
<Date>2021-10-13</Date>
|
||||
<Version>1.9.4</Version>
|
||||
<Comment>First build</Comment>
|
||||
<Name>fury</Name>
|
||||
<Email>uglyside@yandex.ru</Email>
|
||||
</Update>
|
||||
</History>
|
||||
<Update release="1">
|
||||
<Date>2021-10-13</Date>
|
||||
<Version>1.9.4</Version>
|
||||
<Comment>First build</Comment>
|
||||
<Name>fury</Name>
|
||||
<Email>uglyside@yandex.ru</Email>
|
||||
</Update>
|
||||
</History>
|
||||
</PISI>
|
||||
|
||||
|
||||
Reference in New Issue
Block a user