Pisilinux/main
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #16909 from mrSi-Si/various-2

Browse Source 
plank-reloaded v139, libxaw3dxft v1.6.4, libetpan rebuild.
This commit is contained in:
Kamil ATLI
2025-06-28 18:03:00 +03:00
committed by GitHub
parent a061f4274f b116c5f2b9
commit 8e68d2045b
5 changed files with 164 additions and 91 deletions
Download Patch File Download Diff File Expand all files Collapse all files
network/library/libetpan/files/CVE-2020-15953.patch
+79
View File
@@ -0,0 +1,79 @@
From 1002a0121a8f5a9aee25357769807f2c519fa50b Mon Sep 17 00:00:00 2001
From: Damian Poddebniak <duesee@users.noreply.github.com>
Date: Fri, 24 Jul 2020 19:39:53 +0200
Subject: [PATCH] Detect extra data after STARTTLS response and exit (#387)
---
src/low-level/imap/mailimap.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/low-level/imap/mailimap.c b/src/low-level/imap/mailimap.c
index bb17119d..4ffcf55d 100644
--- a/src/low-level/imap/mailimap.c
+++ b/src/low-level/imap/mailimap.c
@@ -2428,6 +2428,13 @@ int mailimap_starttls(mailimap * session)
mailimap_response_free(response);
+ // Detect if the server send extra data after the STARTTLS response.
+ // This *may* be a "response injection attack".
+ if (session->imap_stream->read_buffer_len != 0) {
+ // Since it is also an IMAP protocol violation, exit.
+ return MAILIMAP_ERROR_STARTTLS;
+ }
+
switch (error_code) {
case MAILIMAP_RESP_COND_STATE_OK:
return MAILIMAP_NO_ERROR;
From 298460a2adaabd2f28f417a0f106cb3b68d27df9 Mon Sep 17 00:00:00 2001
From: Fabian Ising <Murgeye@users.noreply.github.com>
Date: Fri, 24 Jul 2020 19:40:48 +0200
Subject: [PATCH] Detect extra data after STARTTLS responses in SMTP and POP3
and exit (#388)
* Detect extra data after STLS response and return error
* Detect extra data after SMTP STARTTLS response and return error
---
src/low-level/pop3/mailpop3.c | 8 ++++++++
src/low-level/smtp/mailsmtp.c | 8 ++++++++
2 files changed, 16 insertions(+)
diff --git a/src/low-level/pop3/mailpop3.c b/src/low-level/pop3/mailpop3.c
index ab9535be..e2124bf8 100644
--- a/src/low-level/pop3/mailpop3.c
+++ b/src/low-level/pop3/mailpop3.c
@@ -959,6 +959,14 @@ int mailpop3_stls(mailpop3 * f)
if (r != RESPONSE_OK)
return MAILPOP3_ERROR_STLS_NOT_SUPPORTED;
+
+ // Detect if the server send extra data after the STLS response.
+ // This *may* be a "response injection attack".
+ if (f->pop3_stream->read_buffer_len != 0) {
+ // Since it is also protocol violation, exit.
+ // There is no error type for STARTTLS errors in POP3
+ return MAILPOP3_ERROR_SSL;
+ }
return MAILPOP3_NO_ERROR;
}
diff --git a/src/low-level/smtp/mailsmtp.c b/src/low-level/smtp/mailsmtp.c
index b7fc459e..3145cadf 100644
--- a/src/low-level/smtp/mailsmtp.c
+++ b/src/low-level/smtp/mailsmtp.c
@@ -1111,6 +1111,14 @@ int mailesmtp_starttls(mailsmtp * session)
return MAILSMTP_ERROR_STREAM;
r = read_response(session);
+ // Detect if the server send extra data after the STARTTLS response.
+ // This *may* be a "response injection attack".
+ if (session->stream->read_buffer_len != 0) {
+ // Since it is also protocol violation, exit.
+ // There is no general error type for STARTTLS errors in SMTP
+ return MAILSMTP_ERROR_SSL;
+ }
+
switch (r) {
case 220:
return MAILSMTP_NO_ERROR;
network/library/libetpan/files/Detect_extra_data_after_STARTTLS_response_and_exit.patch
-27
View File
@@ -1,27 +0,0 @@
From 8ceb0cf0191f8b374a7f05974b29c6242ce8f752 Mon Sep 17 00:00:00 2001
From: Damian Poddebniak <poddebniak@fh-muenster.de>
Date: Thu, 23 Jul 2020 19:24:45 +0200
Subject: [PATCH] Detect extra data after STARTTLS response and exit
---
src/low-level/imap/mailimap.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/low-level/imap/mailimap.c b/src/low-level/imap/mailimap.c
index bb17119d..4ffcf55d 100644
--- a/src/low-level/imap/mailimap.c
+++ b/src/low-level/imap/mailimap.c
@@ -2428,6 +2428,13 @@ int mailimap_starttls(mailimap * session)
mailimap_response_free(response);
+ // Detect if the server send extra data after the STARTTLS response.
+ // This *may* be a "response injection attack".
+ if (session->imap_stream->read_buffer_len != 0) {
+ // Since it is also an IMAP protocol violation, exit.
+ return MAILIMAP_ERROR_STARTTLS;
+ }
+
switch (error_code) {
case MAILIMAP_RESP_COND_STATE_OK:
return MAILIMAP_NO_ERROR;
network/library/libetpan/pspec.xml
+69 -62
View File
@@ -1,76 +1,83 @@
<?xml version="1.0" ?> <?xml version="1.0" ?>
<!DOCTYPE PISI SYSTEM "https://pisilinux.org/projeler/pisi/pisi-spec.dtd"> <!DOCTYPE PISI SYSTEM "https://pisilinux.org/projeler/pisi/pisi-spec.dtd">
<PISI> <PISI>
<Source> <Source>
<Name>libetpan</Name> <Name>libetpan</Name>
<Homepage>https://www.etpan.org/libetpan.html</Homepage> <Homepage>https://www.etpan.org/libetpan.html</Homepage>
<Packager> <Packager>
<Name>PisiLinux Community</Name> <Name>PisiLinux Community</Name>
<Email>admins@pisilinux.org</Email> <Email>admins@pisilinux.org</Email>
</Packager> </Packager>
<License>custom</License> <License>custom</License>
<IsA>library</IsA> <IsA>library</IsA>
<PartOf>network.library</PartOf> <PartOf>network.library</PartOf>
<Summary>A portable middleware for email access.</Summary> <Summary>A portable middleware for email access.</Summary>
<Description>The purpose of this mail library is to provide a portable, efficient framework for different kinds of mail access: IMAP, SMTP, POP and NNTP.</Description> <Description>The purpose of this mail library is to provide a portable, efficient framework for different kinds of mail access: IMAP, SMTP, POP and NNTP.</Description>
<Archive sha1sum="cfdfe4329382a30afc5b540e258aaa950fabd25f" type="targz"> <Archive sha1sum="cfdfe4329382a30afc5b540e258aaa950fabd25f" type="targz">
https://github.com/dinhvh/libetpan/archive/1.9.4.tar.gz https://github.com/dinhvh/libetpan/archive/1.9.4.tar.gz
</Archive> </Archive>
<BuildDependencies> <BuildDependencies>
<Dependency>db-devel</Dependency> <Dependency>db-devel</Dependency>
<Dependency>curl-devel</Dependency> <Dependency>curl-devel</Dependency>
<Dependency>expat-devel</Dependency> <Dependency>expat-devel</Dependency>
<Dependency>gnutls-devel</Dependency> <Dependency>gnutls-devel</Dependency>
<Dependency>openssl-devel</Dependency> <Dependency>openssl-devel</Dependency>
<Dependency>cyrus-sasl-devel</Dependency> <Dependency>cyrus-sasl-devel</Dependency>
</BuildDependencies> </BuildDependencies>
<Patches> <Patches>
<Patch level="1">Detect_extra_data_after_STARTTLS_response_and_exit.patch</Patch> <Patch level="1">CVE-2020-15953.patch</Patch>
</Patches> </Patches>
</Source> </Source>
<Package> <Package>
<Name>libetpan</Name> <Name>libetpan</Name>
<RuntimeDependencies> <RuntimeDependencies>
<Dependency>db</Dependency> <Dependency>db</Dependency>
<Dependency>openssl</Dependency> <Dependency>openssl</Dependency>
<Dependency>cyrus-sasl</Dependency> <Dependency>cyrus-sasl</Dependency>
</RuntimeDependencies> </RuntimeDependencies>
<Files> <Files>
<Path fileType="library">/usr/lib</Path> <Path fileType="library">/usr/lib</Path>
</Files> </Files>
</Package> </Package>
<Package> <Package>
<Name>libetpan-devel</Name> <Name>libetpan-devel</Name>
<RuntimeDependencies> <RuntimeDependencies>
<Dependency release="current">libetpan</Dependency> <Dependency release="current">libetpan</Dependency>
<Dependency>db-devel</Dependency> <Dependency>db-devel</Dependency>
<Dependency>gnutls-devel</Dependency> <Dependency>gnutls-devel</Dependency>
<Dependency>openssl-devel</Dependency> <Dependency>openssl-devel</Dependency>
<Dependency>cyrus-sasl-devel</Dependency> <Dependency>cyrus-sasl-devel</Dependency>
</RuntimeDependencies> </RuntimeDependencies>
<Files> <Files>
<Path fileType="header">/usr/include</Path> <Path fileType="header">/usr/include</Path>
<Path fileType="library">/usr/lib/pkgconfig</Path> <Path fileType="data">/usr/lib/pkgconfig</Path>
</Files> </Files>
</Package> </Package>
<History> <History>
<Update release="2"> <Update release="3">
<Date>2025-06-28</Date>
<Version>1.9.4</Version>
<Comment>Rebuild.</Comment>
<Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email>
</Update>
<Update release="2">
<Date>2024-12-27</Date> <Date>2024-12-27</Date>
<Version>1.9.4</Version> <Version>1.9.4</Version>
<Comment>Rebuild.</Comment> <Comment>Rebuild.</Comment>
<Name>Mustafa Cinasal</Name> <Name>Mustafa Cinasal</Name>
<Email>muscnsl@gmail.com</Email> <Email>muscnsl@gmail.com</Email>
</Update> </Update>
<Update release="1"> <Update release="1">
<Date>2021-10-13</Date> <Date>2021-10-13</Date>
<Version>1.9.4</Version> <Version>1.9.4</Version>
<Comment>First build</Comment> <Comment>First build</Comment>
<Name>fury</Name> <Name>fury</Name>
<Email>uglyside@yandex.ru</Email> <Email>uglyside@yandex.ru</Email>
</Update> </Update>
</History> </History>
</PISI> </PISI>
util/dock/plank/pspec.xml
+8 -1
View File
@@ -13,7 +13,7 @@
<IsA>app</IsA> <IsA>app</IsA>
<Summary>Plank reloaded. Still stupidly simple.</Summary> <Summary>Plank reloaded. Still stupidly simple.</Summary>
<Description>A simplest dock. Also it is library which can be extended to create other dock programs with more advanced features.</Description> <Description>A simplest dock. Also it is library which can be extended to create other dock programs with more advanced features.</Description>
<Archive sha1sum="790a8734456b7c517b92fea6e7d2c58689724b7d" type="targz">https://github.com/zquestz/plank-reloaded/archive/0.11.127/plank-reloaded-0.11.127.tar.gz</Archive> <Archive sha1sum="105fe79122f50b60ece63c5ef41cff3947f83118" type="targz">https://github.com/zquestz/plank-reloaded/archive/0.11.139/plank-reloaded-0.11.139.tar.gz</Archive>
<BuildDependencies> <BuildDependencies>
<Dependency>meson</Dependency> <Dependency>meson</Dependency>
<Dependency>atk-devel</Dependency> <Dependency>atk-devel</Dependency>
@@ -91,6 +91,13 @@
</Package> </Package>
<History> <History>
<Update release="7">
<Date>2025-06-28</Date>
<Version>0.11.139</Version>
<Comment>Version bump.</Comment>
<Name>Kamil Atlı</Name>
<Email>suvari@pisilinux.org</Email>
</Update>
<Update release="6"> <Update release="6">
<Date>2025-05-16</Date> <Date>2025-05-16</Date>
<Version>0.11.127</Version> <Version>0.11.127</Version>
x11/library/libXaw3dXft/pspec.xml
+8 -1
View File
@@ -13,7 +13,7 @@
<IsA>library</IsA> <IsA>library</IsA>
<Summary>Athena Widgets + 3D + FreeType font support.</Summary> <Summary>Athena Widgets + 3D + FreeType font support.</Summary>
<Description>libXaw3dXft is an extension of libXaw3d that adds FreeType font support.</Description> <Description>libXaw3dXft is an extension of libXaw3d that adds FreeType font support.</Description>
<Archive sha1sum="40000304991e0ad6102fc1f966ccc12596c493bd" type="tarxz">https://github.com/DaveFlater/libXaw3dXft/releases/download/v1.6.3/libxaw3dxft-1.6.3.tar.xz</Archive> <Archive sha1sum="5b6cd86163559f65852572ba8691c53ea11ad027" type="tarxz">https://github.com/DaveFlater/libXaw3dXft/releases/download/v1.6.4/libxaw3dxft-1.6.4.tar.xz</Archive>
<BuildDependencies> <BuildDependencies>
<Dependency>Xaw3d-devel</Dependency> <Dependency>Xaw3d-devel</Dependency>
<Dependency>libXt-devel</Dependency> <Dependency>libXt-devel</Dependency>
@@ -61,6 +61,13 @@
</Package> </Package>
<History> <History>
<Update release="2">
<Date>2025-06-28</Date>
<Version>1.6.4</Version>
<Comment>Version bump.</Comment>
<Name>Kamil Atlı</Name>
<Email>suvari@pisilinux.org</Email>
</Update>
<Update release="1"> <Update release="1">
<Date>2025-06-20</Date> <Date>2025-06-20</Date>
<Version>1.6.3</Version> <Version>1.6.3</Version>