Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Harden hostname check during sibling sync #128

Open
wants to merge 1 commit into
base: SMT11-SP3
Choose a base branch
from
Open

Harden hostname check during sibling sync #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
NAME = smt
VERSION = 2.0.34
VERSION = 2.0.35
DESTDIR = /
PERL ?= perl
PERLMODDIR = $(shell $(PERL) -MConfig -e 'print $$Config{installvendorlib};')
Expand Down
7 changes: 7 additions & 0 deletions package/smt.changes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,10 @@
-------------------------------------------------------------------
Wed Nov 14 08:12:13 UTC 2018 - [email protected]

- version 2.0.35
- Harden hostname check during sibling check by forcing double
reverse lookup (CVE-2018-12472) (bsc#1104076)

-------------------------------------------------------------------
Tue Aug 14 08:36:09 UTC 2018 - [email protected]

Expand Down
2 changes: 1 addition & 1 deletion package/smt.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ Name: smt
BuildRequires: apache2
BuildRequires: apache2-mod_perl
BuildRequires: swig
Version: 2.0.34
Version: 2.0.35
Release: 0
Requires: createrepo
Requires: gpg2
Expand Down
3 changes: 2 additions & 1 deletion www/perl-lib/SMT/RegistrationSharing.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ use warnings;
use Apache2::Log;
use Apache2::RequestRec ();
use Apache2::ServerUtil ();
use Apache2::Const -compile => qw(REMOTE_DOUBLE_REV);
use DBI qw(:sql_types);
use File::Slurp;
use File::Temp;
Expand Down Expand Up @@ -534,7 +535,7 @@ sub _verifySenderAllowed
my $r = shift;

my $apache = Apache2::ServerUtil->server;
my $senderName = $r->connection()->get_remote_host();
my $senderName = $r->connection()->get_remote_host(Apache2::Const::REMOTE_DOUBLE_REV);
my $senderIP = $r->connection()->remote_ip();
my $msg = 'Received shared registration request from '
. $senderName
Expand Down