NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

package/shellinabox: fix CVE-2018-16789

Browse Source 
libhttp/url.c in shellinabox through 2.20 has an implementation flaw in
the HTTP request parsing logic. By sending a crafted multipart/form-data
HTTP request, an attacker could exploit this to force shellinaboxd into
an infinite loop, exhausting available CPU resources and taking the
service down.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This commit is contained in:
Fabrice Fontaine 2020-02-29 23:55:11 +01:00 committed by Yann E. MORIN
parent 2914843b39
commit 5553223297
2 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
package/shellinabox/0002-CVE-2018-16789-fix-for-broken-multipart-form-data.patch Normal file
View File

@ -0,0 +1,26 @@
From 7f47efe1717c381f86566fabe0b1ced8cb98fe8f Mon Sep 17 00:00:00 2001
From: irsl <irsl@users.noreply.github.com>
Date: Fri, 26 Oct 2018 11:51:15 +0200
Subject: [PATCH] fix for broken multipart/form-data
Malformed multipart/form-data payload results in infinite loop and thus denial of service
[Upstream status: https://github.com/shellinabox/shellinabox/pull/446]
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
libhttp/url.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/libhttp/url.c b/libhttp/url.c
index ed29475..4177871 100644
--- a/libhttp/url.c
+++ b/libhttp/url.c
@@ -312,6 +312,9 @@ static void urlParsePostBody(struct URL *url,
}
}
}
+ } else {
+ warn("[http] broken multipart/form-data!");
+ break;
}
}
if (lastPart) {

3
package/shellinabox/shellinabox.mk
View File

@ -9,6 +9,9 @@ SHELLINABOX_SITE = $(call github,shellinabox,shellinabox,v$(SHELLINABOX_VERSION)
SHELLINABOX_LICENSE = GPL-2.0 with OpenSSL exception
SHELLINABOX_LICENSE_FILES = COPYING GPL-2
# 0002-CVE-2018-16789-fix-for-broken-multipart-form-data.patch
SHELLINABOX_IGNORE_CVES += CVE-2018-16789
# Fetching from Github, and patching Makefile.am, so we need to autoreconf
SHELLINABOX_AUTORECONF = YES