deepcrayon/buildroot
deepcrayon/buildroot
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

package/berkeleydb: add security fix for CVE-2017-10140

Browse source 
Fixes CVE-2017-10140: Berkeley DB reads DB_CONFIG from cwd

For more details, see:
https://security-tracker.debian.org/tracker/CVE-2017-10140

And add license hash while we are at it.

[Peter: extend commit message]
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Bernd Kuhls 2018-01-27 23:41:21 +01:00 committed by Peter Korsgaard
parent 0d77fd7e83
commit 0b368023f7
2 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
package/berkeleydb/0001-cwd-db_config.patch Normal file
View file

@ -0,0 +1,21 @@
Do not access DB_CONFIG when db_home is not set
Fixes CVE-2017-10140:
https://bugzilla.redhat.com/show_bug.cgi?id=1464032#c9
Downloaded from
http://pkgs.fedoraproject.org/cgit/rpms/libdb.git/commit/?id=8047fa8580659fcae740c25e91b490539b8453eb
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
--- db-5.3.28/src/env/env_open.c.old 2017-06-26 10:32:11.011419981 +0200
+++ db-5.3.28/src/env/env_open.c 2017-06-26 10:32:46.893721233 +0200
@@ -473,7 +473,7 @@
env->db_mode = mode == 0 ? DB_MODE_660 : mode;
/* Read the DB_CONFIG file. */
- if ((ret = __env_read_db_config(env)) != 0)
+ if (env->db_home != NULL && (ret = __env_read_db_config(env)) != 0)
return (ret);
/*

1
package/berkeleydb/berkeleydb.hash
View file

@ -1,2 +1,3 @@
# Locally calculated
sha256 76a25560d9e52a198d37a31440fd07632b5f1f8f9f2b6d5438f4bc3e7c9013ef db-5.3.28.NC.tar.gz
sha256 b78815181a53241f9347c6b47d1031fd669946f863e1edc807a291354cec024b LICENSE