From 1f9cf3c3954b85f2bd36baf99f692e52e674c7c4 Mon Sep 17 00:00:00 2001 From: Funda Wang Date: Mon, 21 Jul 2025 00:45:10 +0800 Subject: [PATCH] fix CVE-2025-4476 --- backport-CVE-2025-4476.patch | 33 +++++++++++++++++++++++++++++++++ libsoup3.spec | 9 ++++++++- 2 files changed, 41 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2025-4476.patch diff --git a/backport-CVE-2025-4476.patch b/backport-CVE-2025-4476.patch new file mode 100644 index 0000000..7aaaa2b --- /dev/null +++ b/backport-CVE-2025-4476.patch @@ -0,0 +1,33 @@ +From e64c221f9c7d09b48b610c5626b3b8c400f0907c Mon Sep 17 00:00:00 2001 +From: Michael Catanzaro +Date: Thu, 8 May 2025 09:27:01 -0500 +Subject: [PATCH] auth-digest: fix crash in + soup_auth_digest_get_protection_space() + +We need to validate the Domain parameter in the WWW-Authenticate header. + +Unfortunately this crash only occurs when listening on default ports 80 +and 443, so there's no good way to test for this. The test would require +running as root. + +Fixes #440 +--- + libsoup/auth/soup-auth-digest.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libsoup/auth/soup-auth-digest.c b/libsoup/auth/soup-auth-digest.c +index d8bb2910..292f2045 100644 +--- a/libsoup/auth/soup-auth-digest.c ++++ b/libsoup/auth/soup-auth-digest.c +@@ -220,7 +220,7 @@ soup_auth_digest_get_protection_space (SoupAuth *auth, GUri *source_uri) + if (uri && + g_strcmp0 (g_uri_get_scheme (uri), g_uri_get_scheme (source_uri)) == 0 && + g_uri_get_port (uri) == g_uri_get_port (source_uri) && +- !strcmp (g_uri_get_host (uri), g_uri_get_host (source_uri))) ++ !g_strcmp0 (g_uri_get_host (uri), g_uri_get_host (source_uri))) + dir = g_strdup (g_uri_get_path (uri)); + else + dir = NULL; +-- +GitLab + diff --git a/libsoup3.spec b/libsoup3.spec index a5d27f7..c8449b1 100644 --- a/libsoup3.spec +++ b/libsoup3.spec @@ -2,7 +2,7 @@ Name: libsoup3 Version: 3.4.4 -Release: 4 +Release: 5 Summary: Soup, an HTTP library implementation License: LGPLv2 URL: https://wiki.gnome.org/Projects/libsoup @@ -11,6 +11,7 @@ Source0: https://download.gnome.org/sources/libsoup/3.4/libsoup-%{version} Patch0001: backport-CVE-2024-52532.patch Patch0002: backport-CVE-2024-52530.patch Patch0003: backport-CVE-2024-52531.patch +Patch0004: backport-CVE-2025-4476.patch BuildRequires: gcc meson gettext vala krb5-devel samba-winbind-clients BuildRequires: gi-docgen >= 2021.1 @@ -80,6 +81,12 @@ install -m 644 -D tests/libsoup.supp %{buildroot}%{_datadir}/libsoup-3.0/libsoup %{_datadir}/doc %changelog +* Mon Jul 21 2025 Funda Wang - 3.4.4-5 +- Type:CVE +- ID:CVE-2025-4476 +- SUG:NA +- DESC: fix CVE-2025-4476 + * Thu Dec 12 2024 renwang -3.4.4-4 - Type:CVE - ID:CVE-2024-52531 -- Gitee