mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-10-20 07:41:47 -09:00
package/gpsd: backport security fixes for CVE-2026-58459
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8cfad4f0f4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This commit is contained in:
Yann E. MORIN
committed by
Raphaël Mélotte
Raphaël Mélotte
parent
e1f54e6c73
commit
23a89f0245
@@ -0,0 +1,50 @@
|
||||
From 5581ba196d826a984fbfaf792b7d58535f9911ce Mon Sep 17 00:00:00 2001
|
||||
Message-ID: <5581ba196d826a984fbfaf792b7d58535f9911ce.1791178679.git.yann.morin@orange.com>
|
||||
From: "Gary E. Miller" <gem@rellim.com>
|
||||
Date: Wed, 1 Jul 2026 17:55:57 -0700
|
||||
Subject: [PATCH] clients/gpsprof.py.in: Quote double quotes in title.
|
||||
|
||||
Someone could use the double quote to break out of the
|
||||
string and add gnuplot commnds.
|
||||
|
||||
For issue 404.
|
||||
Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
|
||||
Upstream: https://gitlab.com/gpsd/gpsd/-/commit/5581ba196d826a984fbfaf792b7d58535f9911ce
|
||||
CVE: CVE-2026-58459
|
||||
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
|
||||
|
||||
---
|
||||
clients/gpsprof.py.in | 8 ++++++--
|
||||
1 file changed, 6 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
|
||||
index 5c18f50ff..261e72665 100644
|
||||
--- a/clients/gpsprof.py.in
|
||||
+++ b/clients/gpsprof.py.in
|
||||
@@ -198,6 +198,10 @@ class plotter(object):
|
||||
if 'subtype' in self.device:
|
||||
desc += "\\n%s" % self.device['subtype']
|
||||
|
||||
+ # escape ", and \n, for gnuplot, to not break strings
|
||||
+ desc = desc.replace('"', '\\042')
|
||||
+ desc = desc.replace('\n', '')
|
||||
+
|
||||
return desc
|
||||
|
||||
def collect(self, verb, log_fp=None):
|
||||
@@ -1262,10 +1266,10 @@ if __name__ == '__main__':
|
||||
# Ship the plot to standard output
|
||||
if not options.title:
|
||||
options.title = plot.whatami()
|
||||
- # escape " for gnuplot
|
||||
- options.title = options.title.replace('"', '\\"')
|
||||
if options.subtitle:
|
||||
options.title += '\\n' + options.subtitle
|
||||
+ # escape " for gnuplot, to not break strings
|
||||
+ options.title = options.title.replace('"', '\\042')
|
||||
term_opts = ""
|
||||
truecolor_terms = ['png', 'sixelgd', 'wxt']
|
||||
if options.terminal in truecolor_terms:
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@@ -0,0 +1,48 @@
|
||||
From 1a6bb7bcbdf58aa940132e630870af061dc88537 Mon Sep 17 00:00:00 2001
|
||||
Message-ID: <1a6bb7bcbdf58aa940132e630870af061dc88537.1791178680.git.yann.morin@orange.com>
|
||||
From: "Gary E. Miller" <gem@rellim.com>
|
||||
Date: Tue, 7 Jul 2026 13:41:54 -0700
|
||||
Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title.
|
||||
|
||||
Someone could use the back tick to break out of the string and add
|
||||
gnuplot commnds.
|
||||
|
||||
For issue 404.
|
||||
Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
|
||||
Upstream: https://gitlab.com/gpsd/gpsd/-/commit/1a6bb7bcbdf58aa940132e630870af061dc88537
|
||||
CVE: CVE-2026-58459
|
||||
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
|
||||
|
||||
---
|
||||
clients/gpsprof.py.in | 6 ++++--
|
||||
1 file changed, 4 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
|
||||
index 261e72665..202214769 100644
|
||||
--- a/clients/gpsprof.py.in
|
||||
+++ b/clients/gpsprof.py.in
|
||||
@@ -198,8 +198,9 @@ class plotter(object):
|
||||
if 'subtype' in self.device:
|
||||
desc += "\\n%s" % self.device['subtype']
|
||||
|
||||
- # escape ", and \n, for gnuplot, to not break strings
|
||||
+ # escape ", `, and \n, for gnuplot, to not break strings
|
||||
desc = desc.replace('"', '\\042')
|
||||
+ desc = desc.replace('`', '\\140')
|
||||
desc = desc.replace('\n', '')
|
||||
|
||||
return desc
|
||||
@@ -1268,8 +1269,9 @@ if __name__ == '__main__':
|
||||
options.title = plot.whatami()
|
||||
if options.subtitle:
|
||||
options.title += '\\n' + options.subtitle
|
||||
- # escape " for gnuplot, to not break strings
|
||||
+ # escape ", and`, for gnuplot, to not break strings
|
||||
options.title = options.title.replace('"', '\\042')
|
||||
+ options.title = options.title.replace('"', '\\140')
|
||||
term_opts = ""
|
||||
truecolor_terms = ['png', 'sixelgd', 'wxt']
|
||||
if options.terminal in truecolor_terms:
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@@ -0,0 +1,60 @@
|
||||
From 4c06658e988f4ced1a7a574ce082a22ef625df56 Mon Sep 17 00:00:00 2001
|
||||
Message-ID: <4c06658e988f4ced1a7a574ce082a22ef625df56.1791178681.git.yann.morin@orange.com>
|
||||
From: "Gary E. Miller" <gem@rellim.com>
|
||||
Date: Tue, 7 Jul 2026 14:23:56 -0700
|
||||
Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title.
|
||||
|
||||
Second try. Also quote "terminal".
|
||||
|
||||
Someone could use the back tick to break out of the string and add
|
||||
gnuplot commnds.
|
||||
|
||||
For issue 404.
|
||||
Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
|
||||
Upstream: https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56
|
||||
CVE: CVE-2026-58459
|
||||
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
|
||||
|
||||
---
|
||||
clients/gpsprof.py.in | 14 ++++++++++----
|
||||
1 file changed, 10 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
|
||||
index 202214769..e91367ee3 100644
|
||||
--- a/clients/gpsprof.py.in
|
||||
+++ b/clients/gpsprof.py.in
|
||||
@@ -200,7 +200,7 @@ class plotter(object):
|
||||
|
||||
# escape ", `, and \n, for gnuplot, to not break strings
|
||||
desc = desc.replace('"', '\\042')
|
||||
- desc = desc.replace('`', '\\140')
|
||||
+ desc = desc.replace("\x60", '\\140')
|
||||
desc = desc.replace('\n', '')
|
||||
|
||||
return desc
|
||||
@@ -1271,13 +1271,19 @@ if __name__ == '__main__':
|
||||
options.title += '\\n' + options.subtitle
|
||||
# escape ", and`, for gnuplot, to not break strings
|
||||
options.title = options.title.replace('"', '\\042')
|
||||
- options.title = options.title.replace('"', '\\140')
|
||||
+ options.title = options.title.replace("\x60", '\\140')
|
||||
term_opts = ""
|
||||
truecolor_terms = ['png', 'sixelgd', 'wxt']
|
||||
if options.terminal in truecolor_terms:
|
||||
term_opts = 'truecolor'
|
||||
- sys.stdout.write("set terminal %s size 800,950 %s\n"
|
||||
- "set termoption enhanced\n"
|
||||
+
|
||||
+ # escape ", `, and \n, for gnuplot, to not break strings
|
||||
+ options.terminal = options.terminal.replace('"', '\\042')
|
||||
+ options.terminal = options.terminal.replace("\x60", '\\140')
|
||||
+ options.terminal = options.terminal.replace('\n', '')
|
||||
+
|
||||
+ sys.stdout.write('set terminal "%s" size 800,950 %s\n'
|
||||
+ 'set termoption enhanced\n'
|
||||
% (options.terminal, term_opts))
|
||||
# double quotes on title so \n is parsed by gnuplot
|
||||
sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title)
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@@ -9,6 +9,12 @@ GPSD_SITE = http://download-mirror.savannah.gnu.org/releases/gpsd
|
||||
GPSD_LICENSE = BSD-2-Clause
|
||||
GPSD_LICENSE_FILES = COPYING
|
||||
GPSD_CPE_ID_VALID = YES
|
||||
|
||||
# 0001-clients-gpsprof.py.in-Quote-double-quotes-in-title.patch
|
||||
# 0002-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch
|
||||
# 0003-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch
|
||||
GPSD_IGNORE_CVES = CVE-2026-58459
|
||||
|
||||
GPSD_SELINUX_MODULES = gpsd
|
||||
GPSD_INSTALL_STAGING = YES
|
||||
|
||||
|
||||
Reference in New Issue
Block a user