<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi security-team,<div class=""><br class=""></div><div class="">I’ve prepared an update for squid3 in jessie, fixing CVE-2015-5400 and closing bug #793128. Debdiff against current version in jessie is below.</div><div class=""><br class=""></div><div class="">I can write a DSA if needed, or upload the package if you instruct so.</div><div class=""><br class=""></div><div class="">Let me know which is the preferred process from now on.</div><div class=""><br class=""></div><div class="">Best regards,</div><div class=""><br class=""></div><div class="">L</div><div class=""><br class=""><div class="">
<div class=""><div style="font-family: Helvetica; orphans: 2; widows: 2;" class=""><span style="font-family: Verdana;" class="">--</span></div><div style="font-family: Helvetica; orphans: 2; widows: 2;" class=""><span style="font-family: Verdana;" class="">Luigi Gangitano -- <</span><a href="mailto:luigi@debian.org" style="font-family: Verdana;" class="">luigi@debian.org</a><span style="font-family: Verdana;" class="">> -- <</span><a href="mailto:gangitano@lugroma3.org" style="font-family: Verdana;" class="">gangitano@lugroma3.org</a><span style="font-family: Verdana;" class="">></span></div><div style="font-family: Helvetica; orphans: 2; widows: 2;" class=""><div style="font-family: Verdana;" class="">GPG: 1024D/924C0C26: 12F8 9C03 89D3 DB4A 9972 C24A F19B A618 924C 0C26</div><div style="font-family: Verdana;" class="">GPG: 4096R/2BA97CED: 8D48 5A35 FF1E 6EB7 90E5 0F6D 0284 F20C 2BA9 7CED</div></div></div>
</div><div class=""><br class="webkit-block-placeholder"></div><div class="">dpkg-source: warning: extracting unsigned source package (/home/luigi/debian/squid3/build-area/squid3_3.4.8-6+deb8u1.dsc)<br class="">diff -Nru squid3-3.4.8/debian/changelog squid3-3.4.8/debian/changelog<br class="">--- squid3-3.4.8/debian/changelog<span class="Apple-tab-span" style="white-space:pre"> </span>2015-01-28 12:59:07.000000000 +0100<br class="">+++ squid3-3.4.8/debian/changelog<span class="Apple-tab-span" style="white-space:pre"> </span>2015-07-22 19:35:30.000000000 +0200<br class="">@@ -1,3 +1,12 @@<br class="">+squid3 (3.4.8-6+deb8u1) jessie-security; urgency=high<br class="">+<br class="">+ [ Luigi Gangitano <<a href="mailto:luigi@debian.org" class="">luigi@debian.org</a>> ]<br class="">+ * debian/patches/36-squid-3.4-13225.patch<br class="">+ - Added upstream patch fixing Improper Protection of Alternate Path<br class="">+ (Ref: SQUID-2015:2, CVE-2015-5400) (Closes: #793128)<br class="">+<br class="">+ -- Luigi Gangitano <<a href="mailto:luigi@debian.org" class="">luigi@debian.org</a>> Wed, 22 Jul 2015 18:36:08 +0200<br class="">+<br class=""> squid3 (3.4.8-6) unstable; urgency=medium<br class=""> <br class=""> [ Luigi Gangitano <<a href="mailto:luigi@debian.org" class="">luigi@debian.org</a>> ]<br class="">diff -Nru squid3-3.4.8/debian/patches/36-squid-3.4-13225.patch squid3-3.4.8/debian/patches/36-squid-3.4-13225.patch<br class="">--- squid3-3.4.8/debian/patches/36-squid-3.4-13225.patch<span class="Apple-tab-span" style="white-space:pre"> </span>1970-01-01 01:00:00.000000000 +0100<br class="">+++ squid3-3.4.8/debian/patches/36-squid-3.4-13225.patch<span class="Apple-tab-span" style="white-space:pre"> </span>2015-07-22 19:35:30.000000000 +0200<br class="">@@ -0,0 +1,237 @@<br class="">+--- a/src/<a href="http://tunnel.cc" class="">tunnel.cc</a><br class="">++++ b/src/<a href="http://tunnel.cc" class="">tunnel.cc</a><br class="">+@@ -122,6 +122,10 @@<br class="">+ (request->flags.interceptTproxy || request->flags.intercepted));<br class="">+ }<br class="">+ <br class="">++ /// Sends "502 Bad Gateway" error response to the client,<br class="">++ /// if it is waiting for Squid CONNECT response, closing connections.<br class="">++ void informUserOfPeerError(const char *errMsg);<br class="">++<br class="">+ class Connection<br class="">+ {<br class="">+ <br class="">+@@ -139,13 +143,14 @@<br class="">+ <br class="">+ void error(int const xerrno);<br class="">+ int debugLevelForError(int const xerrno) const;<br class="">+- /// handles a non-I/O error associated with this Connection<br class="">+- void logicError(const char *errMsg);<br class="">+ void closeIfOpen();<br class="">+ void dataSent (size_t amount);<br class="">++ /// writes 'b' buffer, setting the 'writer' member to 'callback'.<br class="">++ void write(const char *b, int size, AsyncCall::Pointer &callback, FREE * free_func);<br class="">+ int len;<br class="">+ char *buf;<br class="">+ int64_t *size_ptr;<span class="Apple-tab-span" style="white-space:pre"> </span>/* pointer to size in an ConnStateData for logging */<br class="">++ AsyncCall::Pointer writer; ///< pending Comm::Write callback<br class="">+ <br class="">+ Comm::ConnectionPointer conn; ///< The currently connected connection.<br class="">+ <br class="">+@@ -195,13 +200,14 @@<br class="">+ TunnelStateData *tunnelState = (TunnelStateData *)params.data;<br class="">+ debugs(26, 3, HERE << tunnelState->server.conn);<br class="">+ tunnelState->server.conn = NULL;<br class="">++ tunnelState->server.writer = NULL;<br class="">+ <br class="">+ if (tunnelState->noConnections()) {<br class="">+ delete tunnelState;<br class="">+ return;<br class="">+ }<br class="">+ <br class="">+- if (!tunnelState->server.len) {<br class="">++ if (!tunnelState->client.writer) {<br class="">+ tunnelState->client.conn->close();<br class="">+ return;<br class="">+ }<br class="">+@@ -213,13 +219,14 @@<br class="">+ TunnelStateData *tunnelState = (TunnelStateData *)params.data;<br class="">+ debugs(26, 3, HERE << tunnelState->client.conn);<br class="">+ tunnelState->client.conn = NULL;<br class="">++ tunnelState->client.writer = NULL;<br class="">+ <br class="">+ if (tunnelState->noConnections()) {<br class="">+ delete tunnelState;<br class="">+ return;<br class="">+ }<br class="">+ <br class="">+- if (!tunnelState->client.len) {<br class="">++ if (!tunnelState->server.writer) {<br class="">+ tunnelState->server.conn->close();<br class="">+ return;<br class="">+ }<br class="">+@@ -343,6 +350,23 @@<br class="">+ handleConnectResponse(len);<br class="">+ }<br class="">+ <br class="">++void<br class="">++TunnelStateData::informUserOfPeerError(const char *errMsg)<br class="">++{<br class="">++ server.len = 0;<br class="">++ if (!clientExpectsConnectResponse()) {<br class="">++ // closing the connection is the best we can do here<br class="">++ debugs(50, 3, server.conn << " closing on error: " << errMsg);<br class="">++ server.conn->close();<br class="">++ return;<br class="">++ }<br class="">++ ErrorState *err = new ErrorState(ERR_CONNECT_FAIL, Http::scBadGateway, request.getRaw());<br class="">++ err->callback = tunnelErrorComplete;<br class="">++ err->callback_data = this;<br class="">++ *status_ptr = Http::scBadGateway;<br class="">++ errorSend(http->getConn()->clientConnection, err);<br class="">++}<br class="">++<br class="">+ /* Read from client side and queue it for writing to the server */<br class="">+ void<br class="">+ TunnelStateData::ReadConnectResponseDone(const Comm::ConnectionPointer &, char *buf, size_t len, comm_err_t errcode, int xerrno, void *data)<br class="">+@@ -374,7 +398,7 @@<br class="">+ const bool parsed = rep.parse(connectRespBuf, eof, &parseErr);<br class="">+ if (!parsed) {<br class="">+ if (parseErr > 0) { // unrecoverable parsing error<br class="">+- server.logicError("malformed CONNECT response from peer");<br class="">++ informUserOfPeerError("malformed CONNECT response from peer");<br class="">+ return;<br class="">+ }<br class="">+ <br class="">+@@ -383,7 +407,7 @@<br class="">+ assert(!parseErr);<br class="">+ <br class="">+ if (!connectRespBuf->hasSpace()) {<br class="">+- server.logicError("huge CONNECT response from peer");<br class="">++ informUserOfPeerError("huge CONNECT response from peer");<br class="">+ return;<br class="">+ }<br class="">+ <br class="">+@@ -397,7 +421,8 @@<br class="">+ <br class="">+ // bail if we did not get an HTTP 200 (Connection Established) response<br class="">+ if (rep.sline.status() != Http::scOkay) {<br class="">+- server.logicError("unsupported CONNECT response status code");<br class="">++ // if we ever decide to reuse the peer connection, we must extract the error response first<br class="">++ informUserOfPeerError("unsupported CONNECT response status code");<br class="">+ return;<br class="">+ }<br class="">+ <br class="">+@@ -416,13 +441,6 @@<br class="">+ }<br class="">+ <br class="">+ void<br class="">+-TunnelStateData::Connection::logicError(const char *errMsg)<br class="">+-{<br class="">+- debugs(50, 3, conn << " closing on error: " << errMsg);<br class="">+- conn->close();<br class="">+-}<br class="">+-<br class="">+-void<br class="">+ TunnelStateData::Connection::error(int const xerrno)<br class="">+ {<br class="">+ /* XXX fixme xstrerror and xerrno... */<br class="">+@@ -517,7 +535,7 @@<br class="">+ debugs(26, 3, HERE << "Schedule Write");<br class="">+ AsyncCall::Pointer call = commCbCall(5,5, "TunnelBlindCopyWriteHandler",<br class="">+ CommIoCbPtrFun(completion, this));<br class="">+- Comm::Write(to.conn, from.buf, len, call, NULL);<br class="">++ to.write(from.buf, len, call, NULL);<br class="">+ }<br class="">+ <br class="">+ /* Writes data from the client buffer to the server side */<br class="">+@@ -526,6 +544,7 @@<br class="">+ {<br class="">+ TunnelStateData *tunnelState = (TunnelStateData *)data;<br class="">+ assert (cbdataReferenceValid (tunnelState));<br class="">++ tunnelState->server.writer = NULL;<br class="">+ <br class="">+ tunnelState->writeServerDone(buf, len, flag, xerrno);<br class="">+ }<br class="">+@@ -575,6 +594,7 @@<br class="">+ {<br class="">+ TunnelStateData *tunnelState = (TunnelStateData *)data;<br class="">+ assert (cbdataReferenceValid (tunnelState));<br class="">++ tunnelState->client.writer = NULL;<br class="">+ <br class="">+ tunnelState->writeClientDone(buf, len, flag, xerrno);<br class="">+ }<br class="">+@@ -592,7 +612,14 @@<br class="">+ }<br class="">+ <br class="">+ void<br class="">+-TunnelStateData::writeClientDone(char *buf, size_t len, comm_err_t flag, int xerrno)<br class="">++TunnelStateData::Connection::write(const char *b, int size, AsyncCall::Pointer &callback, FREE * free_func)<br class="">++{<br class="">++ writer = callback;<br class="">++ Comm::Write(conn, b, size, callback, free_func);<br class="">++}<br class="">++<br class="">++void<br class="">++TunnelStateData::writeClientDone(char *, size_t len, comm_err_t flag, int xerrno)<br class="">+ {<br class="">+ debugs(26, 3, HERE << client.conn << ", " << len << " bytes written, flag=" << flag);<br class="">+ <br class="">+@@ -712,6 +739,7 @@<br class="">+ {<br class="">+ TunnelStateData *tunnelState = (TunnelStateData *)data;<br class="">+ debugs(26, 3, HERE << conn << ", flag=" << flag);<br class="">++ tunnelState->client.writer = NULL;<br class="">+ <br class="">+ if (flag != COMM_OK) {<br class="">+ *tunnelState->status_ptr = Http::scInternalServerError;<br class="">+@@ -728,6 +756,7 @@<br class="">+ {<br class="">+ TunnelStateData *tunnelState = (TunnelStateData *)data;<br class="">+ debugs(26, 3, conn << ", flag=" << flag);<br class="">++ tunnelState->server.writer = NULL;<br class="">+ assert(tunnelState->waitingForConnectRequest());<br class="">+ <br class="">+ if (flag != COMM_OK) {<br class="">+@@ -768,7 +797,7 @@<br class="">+ else {<br class="">+ AsyncCall::Pointer call = commCbCall(5,5, "tunnelConnectedWriteDone",<br class="">+ CommIoCbPtrFun(tunnelConnectedWriteDone, tunnelState));<br class="">+- Comm::Write(tunnelState->client.conn, conn_established, strlen(conn_established), call, NULL);<br class="">++ tunnelState->client.write(conn_established, strlen(conn_established), call, NULL);<br class="">+ }<br class="">+ }<br class="">+ <br class="">+@@ -955,29 +984,20 @@<br class="">+ debugs(11, 2, "Tunnel Server REQUEST: " << tunnelState->server.conn << ":\n----------\n" <<<br class="">+ Raw("tunnelRelayConnectRequest", mb.content(), mb.contentSize()) << "\n----------");<br class="">+ <br class="">+- if (tunnelState->clientExpectsConnectResponse()) {<br class="">+- // hack: blindly tunnel peer response (to our CONNECT request) to the client as ours.<br class="">+- AsyncCall::Pointer writeCall = commCbCall(5,5, "tunnelConnectedWriteDone",<br class="">+- CommIoCbPtrFun(tunnelConnectedWriteDone, tunnelState));<br class="">+- Comm::Write(srv, &mb, writeCall);<br class="">+- } else {<br class="">+- // we have to eat the connect response from the peer (so that the client<br class="">+- // does not see it) and only then start shoveling data to the client<br class="">+- AsyncCall::Pointer writeCall = commCbCall(5,5, "tunnelConnectReqWriteDone",<br class="">+- CommIoCbPtrFun(tunnelConnectReqWriteDone,<br class="">+- tunnelState));<br class="">+- Comm::Write(srv, &mb, writeCall);<br class="">+- tunnelState->connectReqWriting = true;<br class="">+-<br class="">+- tunnelState->connectRespBuf = new MemBuf;<br class="">+- // SQUID_TCP_SO_RCVBUF: we should not accumulate more than regular I/O buffer<br class="">+- // can hold since any CONNECT response leftovers have to fit into server.buf.<br class="">+- // 2*SQUID_TCP_SO_RCVBUF: HttpMsg::parse() zero-terminates, which uses space.<br class="">+- tunnelState->connectRespBuf->init(SQUID_TCP_SO_RCVBUF, 2*SQUID_TCP_SO_RCVBUF);<br class="">+- tunnelState->readConnectResponse();<br class="">++ AsyncCall::Pointer writeCall = commCbCall(5,5, "tunnelConnectReqWriteDone",<br class="">++ CommIoCbPtrFun(tunnelConnectReqWriteDone, tunnelState));<br class="">+ <br class="">+- assert(tunnelState->waitingForConnectExchange());<br class="">+- }<br class="">++ tunnelState->server.write(mb.buf, mb.size, writeCall, mb.freeFunc());<br class="">++ tunnelState->connectReqWriting = true;<br class="">++<br class="">++ tunnelState->connectRespBuf = new MemBuf;<br class="">++ // SQUID_TCP_SO_RCVBUF: we should not accumulate more than regular I/O buffer<br class="">++ // can hold since any CONNECT response leftovers have to fit into server.buf.<br class="">++ // 2*SQUID_TCP_SO_RCVBUF: HttpMsg::parse() zero-terminates, which uses space.<br class="">++ tunnelState->connectRespBuf->init(SQUID_TCP_SO_RCVBUF, 2*SQUID_TCP_SO_RCVBUF);<br class="">++ tunnelState->readConnectResponse();<br class="">++<br class="">++ assert(tunnelState->waitingForConnectExchange());<br class="">+ <br class="">+ AsyncCall::Pointer timeoutCall = commCbCall(5, 4, "tunnelTimeout",<br class="">+ CommTimeoutCbPtrFun(tunnelTimeout, tunnelState));<br class="">diff -Nru squid3-3.4.8/debian/patches/series squid3-3.4.8/debian/patches/series<br class="">--- squid3-3.4.8/debian/patches/series<span class="Apple-tab-span" style="white-space:pre"> </span>2015-01-28 12:59:07.000000000 +0100<br class="">+++ squid3-3.4.8/debian/patches/series<span class="Apple-tab-span" style="white-space:pre"> </span>2015-07-22 19:35:30.000000000 +0200<br class="">@@ -9,3 +9,4 @@<br class=""> 33-squid-3.4-13211.patch<br class=""> 34-squid-3.4-13213.patch<br class=""> 35-squid-3.4-13203.patch <br class="">+36-squid-3.4-13225.patch</div>
<br class=""></div></body></html>