From eba17b1ac6c1a86452d4bcad425765929be3d99f Mon Sep 17 00:00:00 2001 From: starlet-dx <15929766099@163.com> Date: Tue, 21 Dec 2021 09:54:03 +0800 Subject: [PATCH] fix CVE-2021-38153 --- CVE-2021-38153-1.patch | 154 +++++++++++++++++++++++++++++++++++++++++ CVE-2021-38153-2.patch | 31 +++++++++ kafka.spec | 9 ++- 3 files changed, 193 insertions(+), 1 deletion(-) create mode 100644 CVE-2021-38153-1.patch create mode 100644 CVE-2021-38153-2.patch diff --git a/CVE-2021-38153-1.patch b/CVE-2021-38153-1.patch new file mode 100644 index 0000000..1f8bda4 --- /dev/null +++ b/CVE-2021-38153-1.patch @@ -0,0 +1,154 @@ +From 86ac6401e8242316160a338005c7f593480c7a43 Mon Sep 17 00:00:00 2001 +From: Randall Hauch +Date: Fri, 30 Jul 2021 17:48:03 -0500 +Subject: [PATCH] MINOR: Use time constant algorithms when comparing passwords + or keys (#10978) + +Author: Randall Hauch +Reviewers: Manikumar Reddy , Rajini Sivaram , Mickael Maison , Ismael Juma +--- + .../internals/PlainServerCallbackHandler.java | 4 +- + .../scram/internals/ScramSaslClient.java | 3 +- + .../scram/internals/ScramSaslServer.java | 3 +- + .../token/delegation/DelegationToken.java | 3 +- + .../org/apache/kafka/common/utils/Utils.java | 36 ++++++++++++++++ + .../apache/kafka/common/utils/UtilsTest.java | 43 +++++++++++++++++++ + 6 files changed, 87 insertions(+), 5 deletions(-) + +diff --git a/clients/src/main/java/org/apache/kafka/common/security/plain/internals/PlainServerCallbackHandler.java b/clients/src/main/java/org/apache/kafka/common/security/plain/internals/PlainServerCallbackHandler.java +index 842f986..10f5817 100644 +--- a/clients/src/main/java/org/apache/kafka/common/security/plain/internals/PlainServerCallbackHandler.java ++++ b/clients/src/main/java/org/apache/kafka/common/security/plain/internals/PlainServerCallbackHandler.java +@@ -22,9 +22,9 @@ import org.apache.kafka.common.security.auth.AuthenticateCallbackHandler; + import org.apache.kafka.common.KafkaException; + import org.apache.kafka.common.security.plain.PlainAuthenticateCallback; + import org.apache.kafka.common.security.plain.PlainLoginModule; ++import org.apache.kafka.common.utils.Utils; + + import java.io.IOException; +-import java.util.Arrays; + import java.util.List; + import java.util.Map; + +@@ -65,7 +65,7 @@ public class PlainServerCallbackHandler implements AuthenticateCallbackHandler { + String expectedPassword = JaasContext.configEntryOption(jaasConfigEntries, + JAAS_USER_PREFIX + username, + PlainLoginModule.class.getName()); +- return expectedPassword != null && Arrays.equals(password, expectedPassword.toCharArray()); ++ return expectedPassword != null && Utils.isEqualConstantTime(password, expectedPassword.toCharArray()); + } + } + +diff --git a/clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslClient.java b/clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslClient.java +index c21a52e..2e6191b 100644 +--- a/clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslClient.java ++++ b/clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslClient.java +@@ -18,6 +18,7 @@ package org.apache.kafka.common.security.scram.internals; + + import java.nio.charset.StandardCharsets; + import java.security.InvalidKeyException; ++import java.security.MessageDigest; + import java.security.NoSuchAlgorithmException; + import java.util.Arrays; + import java.util.Collection; +@@ -204,7 +205,7 @@ public class ScramSaslClient implements SaslClient { + try { + byte[] serverKey = formatter.serverKey(saltedPassword); + byte[] serverSignature = formatter.serverSignature(serverKey, clientFirstMessage, serverFirstMessage, clientFinalMessage); +- if (!Arrays.equals(signature, serverSignature)) ++ if (!MessageDigest.isEqual(signature, serverSignature)) + throw new SaslException("Invalid server signature in server final message"); + } catch (InvalidKeyException e) { + throw new SaslException("Sasl server signature verification failed", e); +diff --git a/clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslServer.java b/clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslServer.java +index f6286a6..3cc8ff0 100644 +--- a/clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslServer.java ++++ b/clients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslServer.java +@@ -17,6 +17,7 @@ + package org.apache.kafka.common.security.scram.internals; + + import java.security.InvalidKeyException; ++import java.security.MessageDigest; + import java.security.NoSuchAlgorithmException; + import java.util.Arrays; + import java.util.Collection; +@@ -226,7 +227,7 @@ public class ScramSaslServer implements SaslServer { + byte[] expectedStoredKey = scramCredential.storedKey(); + byte[] clientSignature = formatter.clientSignature(expectedStoredKey, clientFirstMessage, serverFirstMessage, clientFinalMessage); + byte[] computedStoredKey = formatter.storedKey(clientSignature, clientFinalMessage.proof()); +- if (!Arrays.equals(computedStoredKey, expectedStoredKey)) ++ if (!MessageDigest.isEqual(computedStoredKey, expectedStoredKey)) + throw new SaslException("Invalid client credentials"); + } catch (InvalidKeyException e) { + throw new SaslException("Sasl client verification failed", e); +diff --git a/clients/src/main/java/org/apache/kafka/common/security/token/delegation/DelegationToken.java b/clients/src/main/java/org/apache/kafka/common/security/token/delegation/DelegationToken.java +index b389a19..a2141b5 100644 +--- a/clients/src/main/java/org/apache/kafka/common/security/token/delegation/DelegationToken.java ++++ b/clients/src/main/java/org/apache/kafka/common/security/token/delegation/DelegationToken.java +@@ -18,6 +18,7 @@ package org.apache.kafka.common.security.token.delegation; + + import org.apache.kafka.common.annotation.InterfaceStability; + ++import java.security.MessageDigest; + import java.util.Arrays; + import java.util.Base64; + import java.util.Objects; +@@ -59,7 +60,7 @@ public class DelegationToken { + + DelegationToken token = (DelegationToken) o; + +- return Objects.equals(tokenInformation, token.tokenInformation) && Arrays.equals(hmac, token.hmac); ++ return Objects.equals(tokenInformation, token.tokenInformation) && MessageDigest.isEqual(hmac, token.hmac); + } + + @Override +diff --git a/clients/src/main/java/org/apache/kafka/common/utils/Utils.java b/clients/src/main/java/org/apache/kafka/common/utils/Utils.java +index c7b70af..7922ee4 100755 +--- a/clients/src/main/java/org/apache/kafka/common/utils/Utils.java ++++ b/clients/src/main/java/org/apache/kafka/common/utils/Utils.java +@@ -287,6 +287,42 @@ public final class Utils { + return Arrays.copyOf(src, src.length); + } + ++ /** ++ * Compares two character arrays for equality using a constant-time algorithm, which is needed ++ * for comparing passwords. Two arrays are equal if they have the same length and all ++ * characters at corresponding positions are equal. ++ * ++ * All characters in the first array are examined to determine equality. ++ * The calculation time depends only on the length of this first character array; it does not ++ * depend on the length of the second character array or the contents of either array. ++ * ++ * @param first the first array to compare ++ * @param second the second array to compare ++ * @return true if the arrays are equal, or false otherwise ++ */ ++ public static boolean isEqualConstantTime(char[] first, char[] second) { ++ if (first == second) { ++ return true; ++ } ++ if (first == null || second == null) { ++ return false; ++ } ++ ++ if (second.length == 0) { ++ return first.length == 0; ++ } ++ ++ // time-constant comparison that always compares all characters in first array ++ boolean matches = first.length == second.length; ++ for (int i = 0; i < first.length; ++i) { ++ int j = i < second.length ? i : 0; ++ if (first[i] != second[j]) { ++ matches = false; ++ } ++ } ++ return matches; ++ } ++ + /** + * Sleep for a bit + * @param ms The duration of the sleep +-- +2.27.0 + diff --git a/CVE-2021-38153-2.patch b/CVE-2021-38153-2.patch new file mode 100644 index 0000000..ab54860 --- /dev/null +++ b/CVE-2021-38153-2.patch @@ -0,0 +1,31 @@ +From d7abd32f3569a65a4b59c7dd8a655b17ffa1b455 Mon Sep 17 00:00:00 2001 +From: Randall Hauch +Date: Fri, 18 Jun 2021 09:53:23 -0500 +Subject: [PATCH] MINOR: Use MessageDigest equals when comparing signature + (#10898) + +--- + .../kafka/connect/runtime/rest/InternalRequestSignature.java | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/connect/runtime/src/main/java/org/apache/kafka/connect/runtime/rest/InternalRequestSignature.java b/connect/runtime/src/main/java/org/apache/kafka/connect/runtime/rest/InternalRequestSignature.java +index d59425b13f6..3cee5774849 100644 +--- a/connect/runtime/src/main/java/org/apache/kafka/connect/runtime/rest/InternalRequestSignature.java ++++ b/connect/runtime/src/main/java/org/apache/kafka/connect/runtime/rest/InternalRequestSignature.java +@@ -24,6 +24,7 @@ + import javax.crypto.SecretKey; + import javax.ws.rs.core.HttpHeaders; + import java.security.InvalidKeyException; ++import java.security.MessageDigest; + import java.security.NoSuchAlgorithmException; + import java.util.Arrays; + import java.util.Base64; +@@ -108,7 +109,7 @@ public String keyAlgorithm() { + } + + public boolean isValid(SecretKey key) { +- return Arrays.equals(sign(mac, key, requestBody), requestSignature); ++ return MessageDigest.isEqual(sign(mac, key, requestBody), requestSignature); + } + + private static Mac mac(String signatureAlgorithm) throws NoSuchAlgorithmException { diff --git a/kafka.spec b/kafka.spec index 67e42e7..984814e 100644 --- a/kafka.spec +++ b/kafka.spec @@ -4,7 +4,7 @@ Name: kafka Version: 2.4.0 -Release: 4 +Release: 5 Summary: A Distributed Streaming Platform. License: Apache License, Version 2.0 @@ -14,6 +14,8 @@ Source2: https://raw.githubusercontent.com/gradle/gradle/v5.6.2/gradle/wrapper/g patch1: Modify-gradle-wrapper-to-local-source.patch patch2: Modify-maven-url-to-huaweicloud.patch patch3: Modify-gradle-url-to-huaweicloud.patch +Patch4: CVE-2021-38153-1.patch +Patch5: CVE-2021-38153-2.patch BuildRequires: systemd java-1.8.0-openjdk-devel Provides: kafka = %{version} @@ -37,6 +39,8 @@ exit 0 %patch1 -p1 %patch2 -p1 %patch3 -p1 +%patch4 -p1 +%patch5 -p1 cp %{SOURCE2} ./ echo `pwd` > absolute_prefix.log sed -i 's/\//\\\//g' absolute_prefix.log @@ -70,6 +74,9 @@ cp -n */*/build/dependant-libs*/* $RPM_BUILD_ROOT%{kafka_home}/libs rm -rf %{buildroot} %changelog +* Tue Dec 21 2021 yaoxin - 2.4.0-5 +- Fix CVE-2021-38153 + * Thu Jul 15 2021 liyanan - 2.4.0-4 - fix gradle url to huaweicloud - fix gradle wrapper to local source -- Gitee