Skip to content

Commit d17f363

Browse files
CBL-Mariner-BotKanishk-BansalPawelWMS
authored
[AUTO-CHERRYPICK] Patch syslog-ng for CVE-2024-47619 [High] - branch 3.0-dev (#13774)
Signed-off-by: Kanishk-Bansal <kbkanishk975@gmail.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com>
1 parent e85006e commit d17f363

2 files changed

Lines changed: 294 additions & 1 deletion

File tree

‎SPECS/syslog-ng/CVE-2024-47619.patch‎

Lines changed: 289 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,289 @@
1+
From 3c570cd48e9e5bc51bc447e7675a7ed64b10e35c Mon Sep 17 00:00:00 2001
2+
From: Kanishk-Bansal <kbkanishk975@gmail.com>
3+
Date: Fri, 9 May 2025 20:38:48 +0000
4+
Subject: [PATCH] CVE-2024-47619
5+
6+
Upstream Patch Reference: https://github.com/syslog-ng/syslog-ng/commit/dadfdbecde5bfe710b0a6ee5699f96926b3f9006
7+
---
8+
lib/transport/tests/CMakeLists.txt | 1 +
9+
lib/transport/tests/Makefile.am | 9 +-
10+
lib/transport/tests/test_tls_wildcard_match.c | 104 ++++++++++++++++++
11+
lib/transport/tls-verifier.c | 86 +++++++++++++--
12+
lib/transport/tls-verifier.h | 2 +
13+
5 files changed, 190 insertions(+), 12 deletions(-)
14+
create mode 100644 lib/transport/tests/test_tls_wildcard_match.c
15+
16+
diff --git a/lib/transport/tests/CMakeLists.txt b/lib/transport/tests/CMakeLists.txt
17+
index 834f456..ce1d033 100644
18+
--- a/lib/transport/tests/CMakeLists.txt
19+
+++ b/lib/transport/tests/CMakeLists.txt
20+
@@ -3,3 +3,4 @@ add_unit_test(CRITERION TARGET test_transport_factory_id)
21+
add_unit_test(CRITERION TARGET test_transport_factory)
22+
add_unit_test(CRITERION TARGET test_transport_factory_registry)
23+
add_unit_test(CRITERION TARGET test_multitransport)
24+
+add_unit_test(CRITERION TARGET test_tls_wildcard_match)
25+
diff --git a/lib/transport/tests/Makefile.am b/lib/transport/tests/Makefile.am
26+
index 7eac994..e6ca7c5 100644
27+
--- a/lib/transport/tests/Makefile.am
28+
+++ b/lib/transport/tests/Makefile.am
29+
@@ -3,7 +3,8 @@ lib_transport_tests_TESTS = \
30+
lib/transport/tests/test_transport_factory_id \
31+
lib/transport/tests/test_transport_factory \
32+
lib/transport/tests/test_transport_factory_registry \
33+
- lib/transport/tests/test_multitransport
34+
+ lib/transport/tests/test_multitransport \
35+
+ lib/transport/tests/test_tls_wildcard_match
36+
37+
EXTRA_DIST += lib/transport/tests/CMakeLists.txt
38+
39+
@@ -38,3 +39,9 @@ lib_transport_tests_test_multitransport_CFLAGS = $(TEST_CFLAGS) \
40+
lib_transport_tests_test_multitransport_LDADD = $(TEST_LDADD)
41+
lib_transport_tests_test_multitransport_SOURCES = \
42+
lib/transport/tests/test_multitransport.c
43+
+
44+
+lib_transport_tests_test_tls_wildcard_match_CFLAGS = $(TEST_CFLAGS) \
45+
+ -I${top_srcdir}/lib/transport/tests
46+
+lib_transport_tests_test_tls_wildcard_match_LDADD = $(TEST_LDADD)
47+
+lib_transport_tests_test_tls_wildcard_match_SOURCES = \
48+
+ lib/transport/tests/test_tls_wildcard_match.c
49+
\ No newline at end of file
50+
diff --git a/lib/transport/tests/test_tls_wildcard_match.c b/lib/transport/tests/test_tls_wildcard_match.c
51+
new file mode 100644
52+
index 0000000..90cecb0
53+
--- /dev/null
54+
+++ b/lib/transport/tests/test_tls_wildcard_match.c
55+
@@ -0,0 +1,104 @@
56+
+/*
57+
+ * Copyright (c) 2024 One Identity LLC.
58+
+ * Copyright (c) 2024 Franco Fichtner
59+
+ *
60+
+ * This library is free software; you can redistribute it and/or
61+
+ * modify it under the terms of the GNU Lesser General Public
62+
+ * License as published by the Free Software Foundation; either
63+
+ * version 2.1 of the License, or (at your option) any later version.
64+
+ *
65+
+ * This library is distributed in the hope that it will be useful,
66+
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
67+
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
68+
+ * Lesser General Public License for more details.
69+
+ *
70+
+ * You should have received a copy of the GNU Lesser General Public
71+
+ * License along with this library; if not, write to the Free Software
72+
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
73+
+ *
74+
+ * As an additional exemption you are allowed to compile & link against the
75+
+ * OpenSSL libraries as published by the OpenSSL project. See the file
76+
+ * COPYING for details.
77+
+ *
78+
+ */
79+
+
80+
+
81+
+#include <criterion/criterion.h>
82+
+
83+
+#include "transport/tls-verifier.h"
84+
+
85+
+TestSuite(tls_wildcard, .init = NULL, .fini = NULL);
86+
+
87+
+Test(tls_wildcard, test_wildcard_match_pattern_acceptance)
88+
+{
89+
+ cr_assert_eq(tls_wildcard_match("test", "test"), TRUE);
90+
+ cr_assert_eq(tls_wildcard_match("test", "*"), TRUE);
91+
+ cr_assert_eq(tls_wildcard_match("test", "t*t"), TRUE);
92+
+ cr_assert_eq(tls_wildcard_match("test", "t*"), TRUE);
93+
+ cr_assert_eq(tls_wildcard_match("", ""), TRUE);
94+
+ cr_assert_eq(tls_wildcard_match("test.one", "test.one"), TRUE);
95+
+ cr_assert_eq(tls_wildcard_match("test.one.two", "test.one.two"), TRUE);
96+
+ cr_assert_eq(tls_wildcard_match("192.0.2.0", "192.0.2.0"), TRUE);
97+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "2001:0000:130F:0000:0000:09C0:876A:130B"),
98+
+ TRUE);
99+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "2001:0:130F:0:0:9C0:876A:130B"), TRUE);
100+
+ cr_assert_eq(tls_wildcard_match("2001:0:130F:0:0:9C0:876A:130B", "2001:0000:130F:0000:0000:09C0:876A:130B"), TRUE);
101+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F::09C0:876A:130B", "2001:0000:130F:0000:0000:09C0:876A:130B"), TRUE);
102+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "2001:0000:130F::09C0:876A:130B"), TRUE);
103+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "2001:0:130F::9C0:876A:130B"), TRUE);
104+
+ cr_assert_eq(tls_wildcard_match("2001:0:130F::9C0:876A:130B", "2001:0000:130F:0000:0000:09C0:876A:130B"), TRUE);
105+
+}
106+
+
107+
+Test(tls_wildcard, test_wildcard_match_wildcard_rejection)
108+
+{
109+
+ cr_assert_eq(tls_wildcard_match("test", "**"), FALSE);
110+
+ cr_assert_eq(tls_wildcard_match("test", "*es*"), FALSE);
111+
+ cr_assert_eq(tls_wildcard_match("test", "t*?"), FALSE);
112+
+}
113+
+
114+
+Test(tls_wildcard, test_wildcard_match_pattern_rejection)
115+
+{
116+
+ cr_assert_eq(tls_wildcard_match("test", "tset"), FALSE);
117+
+ cr_assert_eq(tls_wildcard_match("test", "set"), FALSE);
118+
+ cr_assert_eq(tls_wildcard_match("", "*"), FALSE);
119+
+ cr_assert_eq(tls_wildcard_match("test", ""), FALSE);
120+
+ cr_assert_eq(tls_wildcard_match("test.two", "test.one"), FALSE);
121+
+}
122+
+
123+
+Test(tls_wildcard, test_wildcard_match_format_rejection)
124+
+{
125+
+ cr_assert_eq(tls_wildcard_match("test.two", "test.*"), FALSE);
126+
+ cr_assert_eq(tls_wildcard_match("test.two", "test.t*o"), FALSE);
127+
+ cr_assert_eq(tls_wildcard_match("test", "test.two"), FALSE);
128+
+ cr_assert_eq(tls_wildcard_match("test.two", "test"), FALSE);
129+
+ cr_assert_eq(tls_wildcard_match("test.one.two", "test.one"), FALSE);
130+
+ cr_assert_eq(tls_wildcard_match("test.one", "test.one.two"), FALSE);
131+
+ cr_assert_eq(tls_wildcard_match("test.three", "three.test"), FALSE);
132+
+ cr_assert_eq(tls_wildcard_match("test.one.two", "test.one.*"), FALSE);
133+
+}
134+
+
135+
+Test(tls_wildcard, test_wildcard_match_complex_rejection)
136+
+{
137+
+ cr_assert_eq(tls_wildcard_match("test.two", "test.???"), FALSE);
138+
+ cr_assert_eq(tls_wildcard_match("test.one.two", "test.one.?wo"), FALSE);
139+
+}
140+
+
141+
+Test(tls_wildcard, test_ip_wildcard_rejection)
142+
+{
143+
+ cr_assert_eq(tls_wildcard_match("192.0.2.0", "*.0.2.0"), FALSE);
144+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "*:0000:130F:0000:0000:09C0:876A:130B"),
145+
+ FALSE);
146+
+ cr_assert_eq(tls_wildcard_match("2001:0:130F::9C0:876A:130B", "*:0000:130F:0000:0000:09C0:876A:130B"), FALSE);
147+
+}
148+
+
149+
+Test(tls_wildcard, test_case_insensivity)
150+
+{
151+
+ cr_assert_eq(tls_wildcard_match("test", "TEST"), TRUE);
152+
+ cr_assert_eq(tls_wildcard_match("TEST", "test"), TRUE);
153+
+ cr_assert_eq(tls_wildcard_match("TeST", "TEst"), TRUE);
154+
+ cr_assert_eq(tls_wildcard_match("test.one", "test.ONE"), TRUE);
155+
+ cr_assert_eq(tls_wildcard_match("test.TWO", "test.two"), TRUE);
156+
+ cr_assert_eq(tls_wildcard_match("test.three", "*T.three"), TRUE);
157+
+ cr_assert_eq(tls_wildcard_match("2001:0000:130F:0000:0000:09C0:876A:130B", "2001:0000:130f:0000:0000:09c0:876a:130b"),
158+
+ TRUE);
159+
+}
160+
diff --git a/lib/transport/tls-verifier.c b/lib/transport/tls-verifier.c
161+
index 606ad02..dde00d9 100644
162+
--- a/lib/transport/tls-verifier.c
163+
+++ b/lib/transport/tls-verifier.c
164+
@@ -1,4 +1,6 @@
165+
/*
166+
+ * Copyright (c) 2024 One Identity LLC.
167+
+ * Copyright (c) 2024 Franco Fichtner
168+
* Copyright (c) 2002-2011 Balabit
169+
* Copyright (c) 1998-2011 Balázs Scheidler
170+
*
171+
@@ -75,7 +77,7 @@ tls_verifier_unref(TLSVerifier *self)
172+
173+
/* helper functions */
174+
175+
-static gboolean
176+
+gboolean
177+
tls_wildcard_match(const gchar *host_name, const gchar *pattern)
178+
{
179+
gchar **pattern_parts, **hostname_parts;
180+
@@ -86,22 +88,84 @@ tls_wildcard_match(const gchar *host_name, const gchar *pattern)
181+
182+
pattern_parts = g_strsplit(pattern, ".", 0);
183+
hostname_parts = g_strsplit(host_name, ".", 0);
184+
- for (i = 0; pattern_parts[i]; i++)
185+
+
186+
+ if(g_strrstr(pattern, "\?"))
187+
+ {
188+
+ /* Glib would treat any question marks as jokers */
189+
+ success = FALSE;
190+
+ }
191+
+ else if (g_hostname_is_ip_address(host_name))
192+
+ {
193+
+ /* no wildcards in IP */
194+
+ if (g_strrstr(pattern, "*"))
195+
+ {
196+
+ success = FALSE;
197+
+ }
198+
+ else
199+
+ {
200+
+ struct in6_addr host_buffer, pattern_buffer;
201+
+ gint INET_TYPE, INET_ADDRLEN;
202+
+ if(strstr(host_name, ":"))
203+
+ {
204+
+ INET_TYPE = AF_INET6;
205+
+ INET_ADDRLEN = INET6_ADDRSTRLEN;
206+
+ }
207+
+ else
208+
+ {
209+
+ INET_TYPE = AF_INET;
210+
+ INET_ADDRLEN = INET_ADDRSTRLEN;
211+
+ }
212+
+ char host_ip[INET_ADDRLEN], pattern_ip[INET_ADDRLEN];
213+
+ gint host_ip_ok = inet_pton(INET_TYPE, host_name, &host_buffer);
214+
+ gint pattern_ip_ok = inet_pton(INET_TYPE, pattern, &pattern_buffer);
215+
+ inet_ntop(INET_TYPE, &host_buffer, host_ip, INET_ADDRLEN);
216+
+ inet_ntop(INET_TYPE, &pattern_buffer, pattern_ip, INET_ADDRLEN);
217+
+ success = (host_ip_ok && pattern_ip_ok && strcmp(host_ip, pattern_ip) == 0);
218+
+ }
219+
+ }
220+
+ else
221+
{
222+
- if (!hostname_parts[i])
223+
+ if (pattern_parts[0] == NULL)
224+
{
225+
- /* number of dot separated entries is not the same in the hostname and the pattern spec */
226+
- goto exit;
227+
+ if (hostname_parts[0] == NULL)
228+
+ success = TRUE;
229+
+ else
230+
+ success = FALSE;
231+
}
232+
+ else
233+
+ {
234+
+ success = TRUE;
235+
+ for (i = 0; pattern_parts[i]; i++)
236+
+ {
237+
+ if (hostname_parts[i] == NULL)
238+
+ {
239+
+ /* number of dot separated entries is not the same in the hostname and the pattern spec */
240+
+ success = FALSE;
241+
+ break;
242+
+ }
243+
+ char *wildcard_matched = g_strrstr(pattern_parts[i], "*");
244+
+ if (wildcard_matched && (i != 0 || wildcard_matched != strstr(pattern_parts[i], "*")))
245+
+ {
246+
+ /* wildcard only on leftmost part and never as multiple wildcards as per both RFC 6125 and 9525 */
247+
+ success = FALSE;
248+
+ break;
249+
+ }
250+
251+
- lower_pattern = g_ascii_strdown(pattern_parts[i], -1);
252+
- lower_hostname = g_ascii_strdown(hostname_parts[i], -1);
253+
+ lower_pattern = g_ascii_strdown(pattern_parts[i], -1);
254+
+ lower_hostname = g_ascii_strdown(hostname_parts[i], -1);
255+
256+
- if (!g_pattern_match_simple(lower_pattern, lower_hostname))
257+
- goto exit;
258+
+ if (!g_pattern_match_simple(lower_pattern, lower_hostname))
259+
+ {
260+
+ success = FALSE;
261+
+ break;
262+
+ }
263+
+ }
264+
+ if (hostname_parts[i])
265+
+ /* hostname has more parts than the pattern */
266+
+ success = FALSE;
267+
+ }
268+
}
269+
- success = TRUE;
270+
-exit:
271+
+
272+
g_free(lower_pattern);
273+
g_free(lower_hostname);
274+
g_strfreev(pattern_parts);
275+
diff --git a/lib/transport/tls-verifier.h b/lib/transport/tls-verifier.h
276+
index 5642afa..98ab858 100644
277+
--- a/lib/transport/tls-verifier.h
278+
+++ b/lib/transport/tls-verifier.h
279+
@@ -44,5 +44,7 @@ void tls_verifier_unref(TLSVerifier *self);
280+
281+
gboolean tls_verify_certificate_name(X509 *cert, const gchar *hostname);
282+
283+
+gboolean tls_wildcard_match(const gchar *host_name, const gchar *pattern);
284+
+
285+
286+
#endif
287+
--
288+
2.45.2
289+

‎SPECS/syslog-ng/syslog-ng.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: Next generation system logger facilty
22
Name: syslog-ng
33
Version: 4.3.1
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: BSD AND GPLv2+ AND LGPLv2+
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -11,6 +11,7 @@ Source0: https://github.com/balabit/%{name}/releases/download/%{name}-%{v
1111
Source1: 60-syslog-ng-journald.conf
1212
Source2: syslog-ng.service
1313
Patch0: remove-hardcoded-python-module-versioning.patch
14+
Patch1: CVE-2024-47619.patch
1415
BuildRequires: glib-devel
1516
BuildRequires: json-c-devel
1617
BuildRequires: json-glib-devel
@@ -159,6 +160,9 @@ fi
159160
%{_libdir}/pkgconfig/*
160161

161162
%changelog
163+
* Fri May 09 2025 Kanishk Bansal <kanbansal@microsoft.com> - 4.3.1-3
164+
- Patch CVE-2024-47619
165+
162166
* Thu Mar 01 2024 Henry Li <lihl@microsoft.com> - 4.3.1-2
163167
- Remove check section as unit testing is disabled in source
164168

0 commit comments

Comments
 (0)