Skip to content

Commit 1af2b08

Browse files
CBL-Mariner-BotKanishk-BansalKanishk Bansal
authored
[AUTO-CHERRYPICK] Patch syslog-ng for CVE-2024-47619 [High] - branch main (#13776)
Signed-off-by: Kanishk-Bansal <[email protected]> Co-authored-by: Kanishk Bansal <[email protected]> Co-authored-by: Kanishk Bansal <[email protected]>
1 parent 6da0c9a commit 1af2b08

File tree

2 files changed

+297
-1
lines changed

2 files changed

+297
-1
lines changed

‎SPECS/syslog-ng/CVE-2024-47619.patch

Lines changed: 291 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,291 @@
1+
From 7c7690e8396597b4b309d02efb7f972baa789975 Mon Sep 17 00:00:00 2001
2+
From: Kanishk-Bansal <[email protected]>
3+
Date: Fri, 9 May 2025 20:55:33 +0000
4+
Subject: [PATCH] CVE-2024-47619
5+
6+
Patch is applied to different files than the upstream patch as func tls_wildcard_match is present there in the version 3.33.2
7+
8+
Upstream Patch Reference: https://github.com/syslog-ng/syslog-ng/commit/dadfdbecde5bfe710b0a6ee5699f96926b3f9006
9+
---
10+
lib/tlscontext.c | 86 +++++++++++++--
11+
lib/tlscontext.h | 1 +
12+
lib/transport/tests/CMakeLists.txt | 1 +
13+
lib/transport/tests/Makefile.am | 9 +-
14+
lib/transport/tests/test_tls_wildcard_match.c | 104 ++++++++++++++++++
15+
5 files changed, 189 insertions(+), 12 deletions(-)
16+
create mode 100644 lib/transport/tests/test_tls_wildcard_match.c
17+
18+
diff --git a/lib/tlscontext.c b/lib/tlscontext.c
19+
index 8a88eec..bf4d800 100644
20+
--- a/lib/tlscontext.c
21+
+++ b/lib/tlscontext.c
22+
@@ -1,4 +1,6 @@
23+
/*
24+
+ * Copyright (c) 2024 One Identity LLC.
25+
+ * Copyright (c) 2024 Franco Fichtner
26+
* Copyright (c) 2002-2011 Balabit
27+
* Copyright (c) 1998-2011 Balázs Scheidler
28+
*
29+
@@ -1097,7 +1099,7 @@ tls_log_certificate_validation_progress(int ok, X509_STORE_CTX *ctx)
30+
g_string_free(issuer_name, TRUE);
31+
}
32+
33+
-static gboolean
34+
+gboolean
35+
tls_wildcard_match(const gchar *host_name, const gchar *pattern)
36+
{
37+
gchar **pattern_parts, **hostname_parts;
38+
@@ -1108,22 +1110,84 @@ tls_wildcard_match(const gchar *host_name, const gchar *pattern)
39+
40+
pattern_parts = g_strsplit(pattern, ".", 0);
41+
hostname_parts = g_strsplit(host_name, ".", 0);
42+
- for (i = 0; pattern_parts[i]; i++)
43+
+
44+
+ if(g_strrstr(pattern, "\?"))
45+
+ {
46+
+ /* Glib would treat any question marks as jokers */
47+
+ success = FALSE;
48+
+ }
49+
+ else if (g_hostname_is_ip_address(host_name))
50+
{
51+
- if (!hostname_parts[i])
52+
+ /* no wildcards in IP */
53+
+ if (g_strrstr(pattern, "*"))
54+
{
55+
- /* number of dot separated entries is not the same in the hostname and the pattern spec */
56+
- goto exit;
57+
+ success = FALSE;
58+
}
59+
+ else
60+
+ {
61+
+ struct in6_addr host_buffer, pattern_buffer;
62+
+ gint INET_TYPE, INET_ADDRLEN;
63+
+ if(strstr(host_name, ":"))
64+
+ {
65+
+ INET_TYPE = AF_INET6;
66+
+ INET_ADDRLEN = INET6_ADDRSTRLEN;
67+
+ }
68+
+ else
69+
+ {
70+
+ INET_TYPE = AF_INET;
71+
+ INET_ADDRLEN = INET_ADDRSTRLEN;
72+
+ }
73+
+ char host_ip[INET_ADDRLEN], pattern_ip[INET_ADDRLEN];
74+
+ gint host_ip_ok = inet_pton(INET_TYPE, host_name, &host_buffer);
75+
+ gint pattern_ip_ok = inet_pton(INET_TYPE, pattern, &pattern_buffer);
76+
+ inet_ntop(INET_TYPE, &host_buffer, host_ip, INET_ADDRLEN);
77+
+ inet_ntop(INET_TYPE, &pattern_buffer, pattern_ip, INET_ADDRLEN);
78+
+ success = (host_ip_ok && pattern_ip_ok && strcmp(host_ip, pattern_ip) == 0);
79+
+ }
80+
+ }
81+
+ else
82+
+ {
83+
+ if (pattern_parts[0] == NULL)
84+
+ {
85+
+ if (hostname_parts[0] == NULL)
86+
+ success = TRUE;
87+
+ else
88+
+ success = FALSE;
89+
+ }
90+
+ else
91+
+ {
92+
+ success = TRUE;
93+
+ for (i = 0; pattern_parts[i]; i++)
94+
+ {
95+
+ if (hostname_parts[i] == NULL)
96+
+ {
97+
+ /* number of dot separated entries is not the same in the hostname and the pattern spec */
98+
+ success = FALSE;
99+
+ break;
100+
+ }
101+
+ char *wildcard_matched = g_strrstr(pattern_parts[i], "*");
102+
+ if (wildcard_matched && (i != 0 || wildcard_matched != strstr(pattern_parts[i], "*")))
103+
+ {
104+
+ /* wildcard only on leftmost part and never as multiple wildcards as per both RFC 6125 and 9525 */
105+
+ success = FALSE;
106+
+ break;
107+
+ }
108+
109+
- lower_pattern = g_ascii_strdown(pattern_parts[i], -1);
110+
- lower_hostname = g_ascii_strdown(hostname_parts[i], -1);
111+
+ lower_pattern = g_ascii_strdown(pattern_parts[i], -1);
112+
+ lower_hostname = g_ascii_strdown(hostname_parts[i], -1);
113+
114+
- if (!g_pattern_match_simple(lower_pattern, lower_hostname))
115+
- goto exit;
116+
+ if (!g_pattern_match_simple(lower_pattern, lower_hostname))
117+
+ {
118+
+ success = FALSE;
119+
+ break;
120+
+ }
121+
+ }
122+
+ if (hostname_parts[i])
123+
+ /* hostname has more parts than the pattern */
124+
+ success = FALSE;
125+
+ }
126+
}
127+
- success = TRUE;
128+
-exit:
129+
+
130+
g_free(lower_pattern);
131+
g_free(lower_hostname);
132+
g_strfreev(pattern_parts);
133+
diff --git a/lib/tlscontext.h b/lib/tlscontext.h
134+
index acca919..fa34444 100644
135+
--- a/lib/tlscontext.h
136+
+++ b/lib/tlscontext.h
137+
@@ -132,6 +132,7 @@ EVTTAG *tls_context_format_location_tag(TLSContext *self);
138+
139+
void tls_log_certificate_validation_progress(int ok, X509_STORE_CTX *ctx);
140+
gboolean tls_verify_certificate_name(X509 *cert, const gchar *hostname);
141+
+gboolean tls_wildcard_match(const gchar *host_name, const gchar *pattern);
142+
143+
void tls_x509_format_dn(X509_NAME *name, GString *dn);
144+
145+
diff --git a/lib/transport/tests/CMakeLists.txt b/lib/transport/tests/CMakeLists.txt
146+
index 834f456..ce1d033 100644
147+
--- a/lib/transport/tests/CMakeLists.txt
148+
+++ b/lib/transport/tests/CMakeLists.txt
149+
@@ -3,3 +3,4 @@ add_unit_test(CRITERION TARGET test_transport_factory_id)
150+
add_unit_test(CRITERION TARGET test_transport_factory)
151+
add_unit_test(CRITERION TARGET test_transport_factory_registry)
152+
add_unit_test(CRITERION TARGET test_multitransport)
153+
+add_unit_test(CRITERION TARGET test_tls_wildcard_match)
154+
diff --git a/lib/transport/tests/Makefile.am b/lib/transport/tests/Makefile.am
155+
index 7eac994..e6ca7c5 100644
156+
--- a/lib/transport/tests/Makefile.am
157+
+++ b/lib/transport/tests/Makefile.am
158+
@@ -3,7 +3,8 @@ lib_transport_tests_TESTS = \
159+
lib/transport/tests/test_transport_factory_id \
160+
lib/transport/tests/test_transport_factory \
161+
lib/transport/tests/test_transport_factory_registry \
162+
- lib/transport/tests/test_multitransport
163+
+ lib/transport/tests/test_multitransport \
164+
+ lib/transport/tests/test_tls_wildcard_match
165+
166+
EXTRA_DIST += lib/transport/tests/CMakeLists.txt
167+
168+
@@ -38,3 +39,9 @@ lib_transport_tests_test_multitransport_CFLAGS = $(TEST_CFLAGS) \
169+
lib_transport_tests_test_multitransport_LDADD = $(TEST_LDADD)
170+
lib_transport_tests_test_multitransport_SOURCES = \
171+
lib/transport/tests/test_multitransport.c
172+
+
173+
+lib_transport_tests_test_tls_wildcard_match_CFLAGS = $(TEST_CFLAGS) \
174+
+ -I${top_srcdir}/lib/transport/tests
175+
+lib_transport_tests_test_tls_wildcard_match_LDADD = $(TEST_LDADD)
176+
+lib_transport_tests_test_tls_wildcard_match_SOURCES = \
177+
+ lib/transport/tests/test_tls_wildcard_match.c
178+
\ No newline at end of file
179+
diff --git a/lib/transport/tests/test_tls_wildcard_match.c b/lib/transport/tests/test_tls_wildcard_match.c
180+
new file mode 100644
181+
index 0000000..92311d5
182+
--- /dev/null
183+
+++ b/lib/transport/tests/test_tls_wildcard_match.c
184+
@@ -0,0 +1,104 @@
185+
+/*
186+
+ * Copyright (c) 2024 One Identity LLC.
187+
+ * Copyright (c) 2024 Franco Fichtner
188+
+ *
189+
+ * This library is free software; you can redistribute it and/or
190+
+ * modify it under the terms of the GNU Lesser General Public
191+
+ * License as published by the Free Software Foundation; either
192+
+ * version 2.1 of the License, or (at your option) any later version.
193+
+ *
194+
+ * This library is distributed in the hope that it will be useful,
195+
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
196+
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
197+
+ * Lesser General Public License for more details.
198+
+ *
199+
+ * You should have received a copy of the GNU Lesser General Public
200+
+ * License along with this library; if not, write to the Free Software
201+
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
202+
+ *
203+
+ * As an additional exemption you are allowed to compile & link against the
204+
+ * OpenSSL libraries as published by the OpenSSL project. See the file
205+
+ * COPYING for details.
206+
+ *
207+
+ */
208+
+
209+
+
210+
+#include <criterion/criterion.h>
211+
+
212+
+#include "lib/tlscontext.h"
213+
+
214+
+TestSuite(tls_wildcard, .init = NULL, .fini = NULL);
215+
+
216+
+Test(tls_wildcard, test_wildcard_match_pattern_acceptance)
217+
+{
218+
+ cr_assert_eq(tls_wildcard_match("test", "test"), TRUE);
219+
+ cr_assert_eq(tls_wildcard_match("test", "*"), TRUE);
220+
+ cr_assert_eq(tls_wildcard_match("test", "t*t"), TRUE);
221+
+ cr_assert_eq(tls_wildcard_match("test", "t*"), TRUE);
222+
+ cr_assert_eq(tls_wildcard_match("", ""), TRUE);
223+
+ cr_assert_eq(tls_wildcard_match("test.one", "test.one"), TRUE);
224+
+ cr_assert_eq(tls_wildcard_match("test.one.two", "test.one.two"), TRUE);
225+
+ cr_assert_eq(tls_wildcard_match("192.0.2.0", "192.0.2.0"), TRUE);
226+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "2001:0000:130F:0000:0000:09C0:876A:130B"),
227+
+ TRUE);
228+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "2001:0:130F:0:0:9C0:876A:130B"), TRUE);
229+
+ cr_assert_eq(tls_wildcard_match("2001:0:130F:0:0:9C0:876A:130B", "2001:0000:130F:0000:0000:09C0:876A:130B"), TRUE);
230+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F::09C0:876A:130B", "2001:0000:130F:0000:0000:09C0:876A:130B"), TRUE);
231+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "2001:0000:130F::09C0:876A:130B"), TRUE);
232+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "2001:0:130F::9C0:876A:130B"), TRUE);
233+
+ cr_assert_eq(tls_wildcard_match("2001:0:130F::9C0:876A:130B", "2001:0000:130F:0000:0000:09C0:876A:130B"), TRUE);
234+
+}
235+
+
236+
+Test(tls_wildcard, test_wildcard_match_wildcard_rejection)
237+
+{
238+
+ cr_assert_eq(tls_wildcard_match("test", "**"), FALSE);
239+
+ cr_assert_eq(tls_wildcard_match("test", "*es*"), FALSE);
240+
+ cr_assert_eq(tls_wildcard_match("test", "t*?"), FALSE);
241+
+}
242+
+
243+
+Test(tls_wildcard, test_wildcard_match_pattern_rejection)
244+
+{
245+
+ cr_assert_eq(tls_wildcard_match("test", "tset"), FALSE);
246+
+ cr_assert_eq(tls_wildcard_match("test", "set"), FALSE);
247+
+ cr_assert_eq(tls_wildcard_match("", "*"), FALSE);
248+
+ cr_assert_eq(tls_wildcard_match("test", ""), FALSE);
249+
+ cr_assert_eq(tls_wildcard_match("test.two", "test.one"), FALSE);
250+
+}
251+
+
252+
+Test(tls_wildcard, test_wildcard_match_format_rejection)
253+
+{
254+
+ cr_assert_eq(tls_wildcard_match("test.two", "test.*"), FALSE);
255+
+ cr_assert_eq(tls_wildcard_match("test.two", "test.t*o"), FALSE);
256+
+ cr_assert_eq(tls_wildcard_match("test", "test.two"), FALSE);
257+
+ cr_assert_eq(tls_wildcard_match("test.two", "test"), FALSE);
258+
+ cr_assert_eq(tls_wildcard_match("test.one.two", "test.one"), FALSE);
259+
+ cr_assert_eq(tls_wildcard_match("test.one", "test.one.two"), FALSE);
260+
+ cr_assert_eq(tls_wildcard_match("test.three", "three.test"), FALSE);
261+
+ cr_assert_eq(tls_wildcard_match("test.one.two", "test.one.*"), FALSE);
262+
+}
263+
+
264+
+Test(tls_wildcard, test_wildcard_match_complex_rejection)
265+
+{
266+
+ cr_assert_eq(tls_wildcard_match("test.two", "test.???"), FALSE);
267+
+ cr_assert_eq(tls_wildcard_match("test.one.two", "test.one.?wo"), FALSE);
268+
+}
269+
+
270+
+Test(tls_wildcard, test_ip_wildcard_rejection)
271+
+{
272+
+ cr_assert_eq(tls_wildcard_match("192.0.2.0", "*.0.2.0"), FALSE);
273+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "*:0000:130F:0000:0000:09C0:876A:130B"),
274+
+ FALSE);
275+
+ cr_assert_eq(tls_wildcard_match("2001:0:130F::9C0:876A:130B", "*:0000:130F:0000:0000:09C0:876A:130B"), FALSE);
276+
+}
277+
+
278+
+Test(tls_wildcard, test_case_insensivity)
279+
+{
280+
+ cr_assert_eq(tls_wildcard_match("test", "TEST"), TRUE);
281+
+ cr_assert_eq(tls_wildcard_match("TEST", "test"), TRUE);
282+
+ cr_assert_eq(tls_wildcard_match("TeST", "TEst"), TRUE);
283+
+ cr_assert_eq(tls_wildcard_match("test.one", "test.ONE"), TRUE);
284+
+ cr_assert_eq(tls_wildcard_match("test.TWO", "test.two"), TRUE);
285+
+ cr_assert_eq(tls_wildcard_match("test.three", "*T.three"), TRUE);
286+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "2001:0000:130f:0000:0000:09c0:876a:130b"),
287+
+ TRUE);
288+
+}
289+
--
290+
2.45.2
291+

‎SPECS/syslog-ng/syslog-ng.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Next generation system logger facilty
22
Name: syslog-ng
33
Version: 3.33.2
4-
Release: 7%{?dist}
4+
Release: 8%{?dist}
55
License: BSD AND GPLv2+ AND LGPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
@@ -11,6 +11,7 @@ Source0: https://github.com/balabit/%{name}/releases/download/%{name}-%{v
1111
Source1: 60-syslog-ng-journald.conf
1212
Source2: syslog-ng.service
1313
Patch0: CVE-2022-38725.patch
14+
Patch1: CVE-2024-47619.patch
1415
BuildRequires: glib-devel
1516
BuildRequires: json-c-devel
1617
BuildRequires: json-glib-devel
@@ -54,6 +55,7 @@ Requires: %{name} = %{version}-%{release}
5455
%autosetup -p1
5556
rm -rf ../p3dir
5657
cp -a . ../p3dir
58+
autoreconf -fiv
5759

5860
%build
5961
%configure \
@@ -149,6 +151,9 @@ fi
149151
%{_libdir}/pkgconfig/*
150152

151153
%changelog
154+
* Fri May 09 2025 Kanishk Bansal <[email protected]> - 3.33.2-8
155+
- Patch CVE-2024-47619
156+
152157
* Mon Nov 27 2023 Saul Paredes <[email protected]> - 3.33.2-7
153158
- Comment %check section
154159

0 commit comments

Comments
 (0)