forked from buildroot/buildroot
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
package/netsnmp: revert back to 5.9.3, backport security fix
In commit 13fc9dc, netsnmp was bumped from 5.9.3 to 5.9.4 to fix two CVEs. However, even though it's a minor version bump, there are actually 163 commits upstream between those two minor releases, and some of them are breaking existing use-cases. In particular upstream a2cb167514ac0c7e1b04e8f151e0b015501362e0 now requires that config_() macros in MIB files are terminated with a semicolon, causing a build breakage with existing MIB files that were totally valid with 5.9.3. This commit therefore proposes to revert back to 5.9.3, by reverting those two commits: 56caafc package/netsnmp: fix musl build 13fc9dc package/netsnmp: security bump to version 5.9.4 and instead backport the one upstream commit that fixes both CVEs. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> [yann.morin.1998@free.fr: fix typo as reported by Baruch] Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
- Loading branch information
1 parent
acd833c
commit 44243b4
Showing
4 changed files
with
80 additions
and
42 deletions.
There are no files selected for viewing
38 changes: 0 additions & 38 deletions
38
package/netsnmp/0001-Fix-configuration-of-NETSNMP_FD_MASK_TYPE.patch
This file was deleted.
Oops, something went wrong.
72 changes: 72 additions & 0 deletions
72
package/netsnmp/0001-snmp_agent-disallow-SET-with-NULL-varbind.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| From b07627fa67c686b07d1eab123cf3e4887a2a93aa Mon Sep 17 00:00:00 2001 | ||
| From: Bill Fenner <fenner@gmail.com> | ||
| Date: Fri, 25 Nov 2022 08:41:24 -0800 | ||
| Subject: [PATCH] snmp_agent: disallow SET with NULL varbind | ||
|
|
||
| Upstream: https://github.com/net-snmp/net-snmp/commit/4589352dac3ae111c7621298cf231742209efd9b | ||
|
|
||
| [Thomas: this commit was merged as part of | ||
| https://github.com/net-snmp/net-snmp/pull/490/commits, which fixes | ||
| https://github.com/net-snmp/net-snmp/issues/474 (CVE-2022-44792) and | ||
| https://github.com/net-snmp/net-snmp/issues/475 (CVE-2022-44793). The | ||
| other two commits merged as part of this pull request are related to | ||
| adding a non-regression test for this, which is not relevant for the | ||
| security fix itself.] | ||
|
|
||
| Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> | ||
| --- | ||
| agent/snmp_agent.c | 32 ++++++++++++++++++++++++++++++++ | ||
| 1 file changed, 32 insertions(+) | ||
|
|
||
| diff --git a/agent/snmp_agent.c b/agent/snmp_agent.c | ||
| index 867d0c166f..3f678fe2df 100644 | ||
| --- a/agent/snmp_agent.c | ||
| +++ b/agent/snmp_agent.c | ||
| @@ -3719,12 +3719,44 @@ netsnmp_handle_request(netsnmp_agent_session *asp, int status) | ||
| return 1; | ||
| } | ||
|
|
||
| +static int | ||
| +check_set_pdu_for_null_varbind(netsnmp_agent_session *asp) | ||
| +{ | ||
| + int i; | ||
| + netsnmp_variable_list *v = NULL; | ||
| + | ||
| + for (i = 1, v = asp->pdu->variables; v != NULL; i++, v = v->next_variable) { | ||
| + if (v->type == ASN_NULL) { | ||
| + /* | ||
| + * Protect SET implementations that do not protect themselves | ||
| + * against wrong type. | ||
| + */ | ||
| + DEBUGMSGTL(("snmp_agent", "disallowing SET with NULL var for varbind %d\n", i)); | ||
| + asp->index = i; | ||
| + return SNMP_ERR_WRONGTYPE; | ||
| + } | ||
| + } | ||
| + return SNMP_ERR_NOERROR; | ||
| +} | ||
| + | ||
| int | ||
| handle_pdu(netsnmp_agent_session *asp) | ||
| { | ||
| int status, inclusives = 0; | ||
| netsnmp_variable_list *v = NULL; | ||
|
|
||
| +#ifndef NETSNMP_NO_WRITE_SUPPORT | ||
| + /* | ||
| + * Check for ASN_NULL in SET request | ||
| + */ | ||
| + if (asp->pdu->command == SNMP_MSG_SET) { | ||
| + status = check_set_pdu_for_null_varbind(asp); | ||
| + if (status != SNMP_ERR_NOERROR) { | ||
| + return status; | ||
| + } | ||
| + } | ||
| +#endif /* NETSNMP_NO_WRITE_SUPPORT */ | ||
| + | ||
| /* | ||
| * for illegal requests, mark all nodes as ASN_NULL | ||
| */ | ||
| -- | ||
| 2.41.0 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| # Locally calculated after checking pgp signature at | ||
| # https://sourceforge.net/projects/net-snmp/files/net-snmp/5.9.4/net-snmp-5.9.4.tar.gz.asc | ||
| # using key 6E6718AEF1EB5C65C32D1B2A356BC0B552D53CAB | ||
| sha256 8b4de01391e74e3c7014beb43961a2d6d6fa03acc34280b9585f4930745b0544 net-snmp-5.9.4.tar.gz | ||
| # https://sourceforge.net/projects/net-snmp/files/net-snmp/5.9.3/net-snmp-5.9.3.tar.gz.asc | ||
| # using key D0F8F495DA6160C44EFFBF10F07B9D2DACB19FD6 | ||
| sha256 2097f29b7e1bf3f1300b4bae52fa2308d0bb8d5d3998dbe02f9462a413a2ef0a net-snmp-5.9.3.tar.gz | ||
|
|
||
| # Hash for license file | ||
| sha256 ed869ea395a1f125819a56676385ab0557a21507764bf56f2943302011381e59 COPYING |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters