From 7bb34ef7fcebcd4e816f701b47b507c7915ebb01 Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Mon, 5 Jun 2017 19:57:52 +0200 Subject: [PATCH] freeradius3: fix CVE-2017-9148 This takes the fix for CVE-2017-9148 from Debian. Signed-off-by: Hauke Mehrtens --- net/freeradius3/Makefile | 2 +- .../patches/001-fix-cert-expiry.patch | 2 +- ...-disable-session-cache-CVE-2017-9148.patch | 47 +++++++++++++++++++ 3 files changed, 49 insertions(+), 2 deletions(-) create mode 100644 net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch diff --git a/net/freeradius3/Makefile b/net/freeradius3/Makefile index 48c083536f..20d1dc5e2e 100644 --- a/net/freeradius3/Makefile +++ b/net/freeradius3/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=freeradius3 PKG_VERSION:=release_3_0_11 -PKG_RELEASE:=2 +PKG_RELEASE:=3 PKG_SOURCE:=$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://github.com/FreeRADIUS/freeradius-server/archive diff --git a/net/freeradius3/patches/001-fix-cert-expiry.patch b/net/freeradius3/patches/001-fix-cert-expiry.patch index b30b01279a..578bbbc0eb 100644 --- a/net/freeradius3/patches/001-fix-cert-expiry.patch +++ b/net/freeradius3/patches/001-fix-cert-expiry.patch @@ -22,7 +22,7 @@ preserve = no --- a/raddb/certs/server.cnf +++ b/raddb/certs/server.cnf -@@ -14,7 +14,7 @@ private_key = $dir/ca.key +@@ -14,7 +14,7 @@ private_key = $dir/server.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default diff --git a/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch b/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch new file mode 100644 index 0000000000..458eeba212 --- /dev/null +++ b/net/freeradius3/patches/002-disable-session-cache-CVE-2017-9148.patch @@ -0,0 +1,47 @@ +Description: disable session caching in the server (as opposed to in the + config, which would be way harder to get right) to address + https://security-tracker.debian.org/tracker/CVE-2017-9148 +Author: Michael Stapelberg +Forwarded: not-needed +Last-Update: 2017-05-30 + +--- + +--- a/src/main/tls.c ++++ b/src/main/tls.c +@@ -369,7 +369,7 @@ tls_session_t *tls_new_session(TALLOC_CT + * + * FIXME: Also do it every N sessions? + */ +- if (conf->session_cache_enable && ++ if (/*conf->session_cache_enable*/0 && + ((conf->session_last_flushed + ((int)conf->session_timeout * 1800)) <= request->timestamp)){ + RDEBUG2("Flushing SSL sessions (of #%ld)", SSL_CTX_sess_number(conf->ctx)); + +@@ -463,7 +463,7 @@ tls_session_t *tls_new_session(TALLOC_CT + state->mtu = vp->vp_integer; + } + +- if (conf->session_cache_enable) state->allow_session_resumption = true; /* otherwise it's false */ ++ if (/*conf->session_cache_enable*/0) state->allow_session_resumption = true; /* otherwise it's false */ + + return state; + } +@@ -2675,7 +2675,7 @@ post_ca: + /* + * Callbacks, etc. for session resumption. + */ +- if (conf->session_cache_enable) { ++ if (/*conf->session_cache_enable*/0) { + /* + * Cache sessions on disk if requested. + */ +@@ -2745,7 +2745,7 @@ post_ca: + /* + * Setup session caching + */ +- if (conf->session_cache_enable) { ++ if (/*conf->session_cache_enable*/0) { + /* + * Create a unique context Id per EAP-TLS configuration. + */