From 23a89f02459f60432a2cb2af6704da62066ad940 Mon Sep 17 00:00:00 2001 From: "Yann E. MORIN" Date: Tue, 6 Oct 2026 07:16:17 +0200 Subject: [PATCH] package/gpsd: backport security fixes for CVE-2026-58459 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Yann E. MORIN Cc: Bernd Kuhls Signed-off-by: Thomas Petazzoni (cherry picked from commit 8cfad4f0f4b9fcb616b99b0fc6ae01e460d909d5) Signed-off-by: Raphaël Mélotte --- ...f.py.in-Quote-double-quotes-in-title.patch | 50 ++++++++++++++++ ...prof.py.in-Quote-back-ticks-in-title.patch | 48 +++++++++++++++ ...prof.py.in-Quote-back-ticks-in-title.patch | 60 +++++++++++++++++++ package/gpsd/gpsd.mk | 6 ++ 4 files changed, 164 insertions(+) create mode 100644 package/gpsd/0001-clients-gpsprof.py.in-Quote-double-quotes-in-title.patch create mode 100644 package/gpsd/0002-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch create mode 100644 package/gpsd/0003-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch diff --git a/package/gpsd/0001-clients-gpsprof.py.in-Quote-double-quotes-in-title.patch b/package/gpsd/0001-clients-gpsprof.py.in-Quote-double-quotes-in-title.patch new file mode 100644 index 0000000000..8be7040fa5 --- /dev/null +++ b/package/gpsd/0001-clients-gpsprof.py.in-Quote-double-quotes-in-title.patch @@ -0,0 +1,50 @@ +From 5581ba196d826a984fbfaf792b7d58535f9911ce Mon Sep 17 00:00:00 2001 +Message-ID: <5581ba196d826a984fbfaf792b7d58535f9911ce.1791178679.git.yann.morin@orange.com> +From: "Gary E. Miller" +Date: Wed, 1 Jul 2026 17:55:57 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote double quotes in title. + +Someone could use the double quote to break out of the +string and add gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks +Upstream: https://gitlab.com/gpsd/gpsd/-/commit/5581ba196d826a984fbfaf792b7d58535f9911ce +CVE: CVE-2026-58459 +Signed-off-by: Yann E. MORIN + +--- + clients/gpsprof.py.in | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 5c18f50ff..261e72665 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,6 +198,10 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + ++ # escape ", and \n, for gnuplot, to not break strings ++ desc = desc.replace('"', '\\042') ++ desc = desc.replace('\n', '') ++ + return desc + + def collect(self, verb, log_fp=None): +@@ -1262,10 +1266,10 @@ if __name__ == '__main__': + # Ship the plot to standard output + if not options.title: + options.title = plot.whatami() +- # escape " for gnuplot +- options.title = options.title.replace('"', '\\"') + if options.subtitle: + options.title += '\\n' + options.subtitle ++ # escape " for gnuplot, to not break strings ++ options.title = options.title.replace('"', '\\042') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: +-- +2.43.0 + diff --git a/package/gpsd/0002-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch b/package/gpsd/0002-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch new file mode 100644 index 0000000000..53e1cac1cc --- /dev/null +++ b/package/gpsd/0002-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch @@ -0,0 +1,48 @@ +From 1a6bb7bcbdf58aa940132e630870af061dc88537 Mon Sep 17 00:00:00 2001 +Message-ID: <1a6bb7bcbdf58aa940132e630870af061dc88537.1791178680.git.yann.morin@orange.com> +From: "Gary E. Miller" +Date: Tue, 7 Jul 2026 13:41:54 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title. + +Someone could use the back tick to break out of the string and add +gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks +Upstream: https://gitlab.com/gpsd/gpsd/-/commit/1a6bb7bcbdf58aa940132e630870af061dc88537 +CVE: CVE-2026-58459 +Signed-off-by: Yann E. MORIN + +--- + clients/gpsprof.py.in | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 261e72665..202214769 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,8 +198,9 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + +- # escape ", and \n, for gnuplot, to not break strings ++ # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') ++ desc = desc.replace('`', '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1268,8 +1269,9 @@ if __name__ == '__main__': + options.title = plot.whatami() + if options.subtitle: + options.title += '\\n' + options.subtitle +- # escape " for gnuplot, to not break strings ++ # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') ++ options.title = options.title.replace('"', '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: +-- +2.43.0 + diff --git a/package/gpsd/0003-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch b/package/gpsd/0003-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch new file mode 100644 index 0000000000..f2e875bb02 --- /dev/null +++ b/package/gpsd/0003-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch @@ -0,0 +1,60 @@ +From 4c06658e988f4ced1a7a574ce082a22ef625df56 Mon Sep 17 00:00:00 2001 +Message-ID: <4c06658e988f4ced1a7a574ce082a22ef625df56.1791178681.git.yann.morin@orange.com> +From: "Gary E. Miller" +Date: Tue, 7 Jul 2026 14:23:56 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title. + +Second try. Also quote "terminal". + +Someone could use the back tick to break out of the string and add +gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks +Upstream: https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56 +CVE: CVE-2026-58459 +Signed-off-by: Yann E. MORIN + +--- + clients/gpsprof.py.in | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 202214769..e91367ee3 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -200,7 +200,7 @@ class plotter(object): + + # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') +- desc = desc.replace('`', '\\140') ++ desc = desc.replace("\x60", '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1271,13 +1271,19 @@ if __name__ == '__main__': + options.title += '\\n' + options.subtitle + # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') +- options.title = options.title.replace('"', '\\140') ++ options.title = options.title.replace("\x60", '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: + term_opts = 'truecolor' +- sys.stdout.write("set terminal %s size 800,950 %s\n" +- "set termoption enhanced\n" ++ ++ # escape ", `, and \n, for gnuplot, to not break strings ++ options.terminal = options.terminal.replace('"', '\\042') ++ options.terminal = options.terminal.replace("\x60", '\\140') ++ options.terminal = options.terminal.replace('\n', '') ++ ++ sys.stdout.write('set terminal "%s" size 800,950 %s\n' ++ 'set termoption enhanced\n' + % (options.terminal, term_opts)) + # double quotes on title so \n is parsed by gnuplot + sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title) +-- +2.43.0 + diff --git a/package/gpsd/gpsd.mk b/package/gpsd/gpsd.mk index 7fd8cec8ab..b23bc4c065 100644 --- a/package/gpsd/gpsd.mk +++ b/package/gpsd/gpsd.mk @@ -9,6 +9,12 @@ GPSD_SITE = http://download-mirror.savannah.gnu.org/releases/gpsd GPSD_LICENSE = BSD-2-Clause GPSD_LICENSE_FILES = COPYING GPSD_CPE_ID_VALID = YES + +# 0001-clients-gpsprof.py.in-Quote-double-quotes-in-title.patch +# 0002-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch +# 0003-clients-gpsprof.py.in-Quote-back-ticks-in-title.patch +GPSD_IGNORE_CVES = CVE-2026-58459 + GPSD_SELINUX_MODULES = gpsd GPSD_INSTALL_STAGING = YES