[Pkg-owncloud-commits] [owncloud-client] 01/02: cherry-pick patches to close CVE-2015-4456
Sandro Knauß
hefee-guest at moszumanska.debian.org
Wed Sep 16 17:45:46 UTC 2015
This is an automated email from the git hooks/post-receive script.
hefee-guest pushed a commit to branch jessie
in repository owncloud-client.
commit 88e63b0b74fac4784dc3a2a3daa849e445b457bb
Author: Sandro Knauß <bugs at sandroknauss.de>
Date: Wed Sep 16 17:07:39 2015 +0200
cherry-pick patches to close CVE-2015-4456
---
...005-Nicer-fix-for-the-security-issue-3283.patch | 26 ++++++++++
...equest-and-reset-the-QNAM-if-user-does-no.patch | 27 +++++++++++
...eset-QNAM-as-a-workaround.-2899-2895-2973.patch | 55 ++++++++++++++++++++++
debian/patches/series | 3 ++
4 files changed, 111 insertions(+)
diff --git a/debian/patches/0005-Nicer-fix-for-the-security-issue-3283.patch b/debian/patches/0005-Nicer-fix-for-the-security-issue-3283.patch
new file mode 100644
index 0000000..7889eed
--- /dev/null
+++ b/debian/patches/0005-Nicer-fix-for-the-security-issue-3283.patch
@@ -0,0 +1,26 @@
+From: Christian Kamm <kamm at incasoftware.de>
+Date: Wed, 3 Jun 2015 10:46:33 +0200
+Subject: Nicer fix for the security issue #3283.
+
+(cherry picked from commit 89376e14d6135a6f39a6df99d54fde253573575c)
+---
+ src/mirall/account.cpp | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/mirall/account.cpp b/src/mirall/account.cpp
+index af31331..d1c1e3a 100644
+--- a/src/mirall/account.cpp
++++ b/src/mirall/account.cpp
+@@ -407,7 +407,11 @@ void Account::slotHandleErrors(QNetworkReply *reply , QList<QSslError> errors)
+ addApprovedCerts(approvedCerts);
+ // all ssl certs are known and accepted. We can ignore the problems right away.
+ qDebug() << "Certs are already known and trusted, Errors are not valid.";
+- reply->ignoreSslErrors();
++
++ // Warning: Do *not* use ignoreSslErrors() (without args) here:
++ // it permanently ignores all SSL errors for this host, even
++ // certificate changes.
++ reply->ignoreSslErrors(errors);
+ } else {
+ _treatSslErrorsAsFailure = true;
+ return;
diff --git a/debian/patches/0006-Abort-the-request-and-reset-the-QNAM-if-user-does-no.patch b/debian/patches/0006-Abort-the-request-and-reset-the-QNAM-if-user-does-no.patch
new file mode 100644
index 0000000..42d47f5
--- /dev/null
+++ b/debian/patches/0006-Abort-the-request-and-reset-the-QNAM-if-user-does-no.patch
@@ -0,0 +1,27 @@
+From: Klaas Freitag <freitag at owncloud.com>
+Date: Tue, 2 Jun 2015 12:21:49 +0200
+Subject: Abort the request and reset the QNAM if user does not ACK a new cert.
+
+This is supposed to fix bug #3283
+
+(cherry picked from commit 75b38d1a2ffe57d0f1eb3ebb8c5f30b8b2a185e4)
+---
+ src/mirall/account.cpp | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/mirall/account.cpp b/src/mirall/account.cpp
+index d1c1e3a..181988a 100644
+--- a/src/mirall/account.cpp
++++ b/src/mirall/account.cpp
+@@ -414,6 +414,11 @@ void Account::slotHandleErrors(QNetworkReply *reply , QList<QSslError> errors)
+ reply->ignoreSslErrors(errors);
+ } else {
+ _treatSslErrorsAsFailure = true;
++ // if during normal operation, a new certificate was MITM'ed, and the user does not
++ // ACK it, the running request must be aborted and the QNAM must be reset, to not
++ // treat the new cert as granted. See bug #3283
++ reply->abort();
++ resetNetworkAccessManager();
+ return;
+ }
+ }
diff --git a/debian/patches/0007-Windows-Reset-QNAM-as-a-workaround.-2899-2895-2973.patch b/debian/patches/0007-Windows-Reset-QNAM-as-a-workaround.-2899-2895-2973.patch
new file mode 100644
index 0000000..fbf650f
--- /dev/null
+++ b/debian/patches/0007-Windows-Reset-QNAM-as-a-workaround.-2899-2895-2973.patch
@@ -0,0 +1,55 @@
+From: Christian Kamm <kamm at incasoftware.de>
+Date: Thu, 19 Mar 2015 11:40:47 +0100
+Subject: Windows: Reset QNAM as a workaround. #2899 #2895 #2973
+
+The QNetworkAccessManager is reset when we are disconnected, just
+before attempting to fetch the server's status.php.
+
+This may help fix the problem described in various issues where we
+get 'Connection closed' or timeout errors after the OS has woken
+from sleep.
+
+(cherry-picked from 57c14a0ebab56c322fe2b42e33e557cc42a70781)
+---
+ src/mirall/account.cpp | 15 +++++++++++++++
+ src/mirall/account.h | 1 +
+ 2 files changed, 16 insertions(+)
+
+diff --git a/src/mirall/account.cpp b/src/mirall/account.cpp
+index 181988a..f59c45f 100644
+--- a/src/mirall/account.cpp
++++ b/src/mirall/account.cpp
+@@ -251,6 +251,21 @@ void Account::clearCookieJar()
+ _am->setCookieJar(new CookieJar);
+ }
+
++void Account::resetNetworkAccessManager()
++{
++ if (!_credentials || !_am) {
++ return;
++ }
++
++ qDebug() << "Resetting QNAM";
++ QNetworkCookieJar* jar = _am->cookieJar();
++ _am->deleteLater();
++ _am = _credentials->getQNAM();
++ _am->setCookieJar(jar); // takes ownership of the old cookie jar
++ connect(_am, SIGNAL(sslErrors(QNetworkReply*,QList<QSslError>)),
++ SLOT(slotHandleErrors(QNetworkReply*,QList<QSslError>)));
++}
++
+ QNetworkAccessManager *Account::networkAccessManager()
+ {
+ return _am;
+diff --git a/src/mirall/account.h b/src/mirall/account.h
+index 383be5b..7662458 100644
+--- a/src/mirall/account.h
++++ b/src/mirall/account.h
+@@ -151,6 +151,7 @@ public:
+
+ void clearCookieJar();
+
++ void resetNetworkAccessManager();
+ QNetworkAccessManager* networkAccessManager();
+
+ QuotaInfo *quotaInfo();
diff --git a/debian/patches/series b/debian/patches/series
index d7de1e6..49e3c9e 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,3 +2,6 @@
0002-debian_version.patch
0003-skip_tests_freebsd.patch
0004-downgrade-db
+0005-Nicer-fix-for-the-security-issue-3283.patch
+0006-Abort-the-request-and-reset-the-QNAM-if-user-does-no.patch
+0007-Windows-Reset-QNAM-as-a-workaround.-2899-2895-2973.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud-client.git
More information about the Pkg-owncloud-commits
mailing list