community/libosinfo: fix CVE-2019-13313

2 files changed, 211 insertions, 4 deletions

diff --git a/community/libosinfo/APKBUILD b/community/libosinfo/APKBUILD
index ba1bf0f80ae..14f36ab2e88 100644
--- a/community/libosinfo/APKBUILD
+++ b/community/libosinfo/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libosinfo
 pkgver=1.5.0
-pkgrel=0
+pkgrel=1
 pkgdesc="A library for managing OS information for virtualization"
 url="http://libosinfo.org/"
 arch="all"
@@ -10,9 +10,15 @@ license="LGPL-2.0-or-later"
 depends="hwdata osinfo-db"
 makedepends="glib-dev libsoup-dev libxml2-dev libxslt-dev vala intltool
 	gobject-introspection-dev check-dev perl-dev
-	automake autoconf libtool"
+	automake autoconf libtool xz"
 subpackages="$pkgname-dev $pkgname-doc $pkgname-lang"
-source="https://releases.pagure.org/$pkgname/$pkgname-$pkgver.tar.gz"
+source="https://releases.pagure.org/$pkgname/$pkgname-$pkgver.tar.gz
+	CVE-2019-13313.patch
+	"
+
+# secfixes:
+#   1.5.0-r1:
+#     - CVE-2019-13313
 
 prepare() {
 	default_prepare
@@ -43,4 +49,5 @@ package() {
 	make DESTDIR="$pkgdir" install
 }
 
-sha512sums="d5d5749eac1dbba0450fdff732c99c5c66b78b0889679cb9f3fd58e119fea4dd1c730013f4cad887b413abe21399143abb89b9d9554b906f117ba0cfc6685e5e  libosinfo-1.5.0.tar.gz"
+sha512sums="d5d5749eac1dbba0450fdff732c99c5c66b78b0889679cb9f3fd58e119fea4dd1c730013f4cad887b413abe21399143abb89b9d9554b906f117ba0cfc6685e5e  libosinfo-1.5.0.tar.gz
+f13e0f79609d210ecb3c9e88f59d4ab423bd5ebae04695c622da9ea21f0231c806625338e05460d6f7e733c2e2809b7fb3b1752b5aa6fe1e50177e40db3ca476  CVE-2019-13313.patch"
diff --git a/community/libosinfo/CVE-2019-13313.patch b/community/libosinfo/CVE-2019-13313.patch
new file mode 100644
index 00000000000..452ec0d581c
--- /dev/null
+++ b/community/libosinfo/CVE-2019-13313.patch
@@ -0,0 +1,200 @@
+Let's add a new option so users can set their config from a file,
+instead of directly passing the values via command-line.
+
+Signed-off-by: Fabiano Fidêncio <fidencio redhat com>
+---
+ tools/osinfo-install-script.c | 100 +++++++++++++++++++++++++++++++++-
+ 1 file changed, 97 insertions(+), 3 deletions(-)
+
+diff --git a/tools/osinfo-install-script.c b/tools/osinfo-install-script.c
+index 15af48d..efa96ee 100644
+--- a/tools/osinfo-install-script.c
++++ b/tools/osinfo-install-script.c
+@@ -37,6 +37,34 @@ static gboolean list_profile = FALSE;
+ static gboolean list_inj_method = FALSE;
+ static gboolean quiet = FALSE;
+ 
++static const gchar *configs[] = {
++    OSINFO_INSTALL_CONFIG_PROP_HARDWARE_ARCH,
++    OSINFO_INSTALL_CONFIG_PROP_L10N_TIMEZONE,
++    OSINFO_INSTALL_CONFIG_PROP_L10N_LANGUAGE,
++    OSINFO_INSTALL_CONFIG_PROP_L10N_KEYBOARD,
++    OSINFO_INSTALL_CONFIG_PROP_ADMIN_PASSWORD,
++    OSINFO_INSTALL_CONFIG_PROP_USER_PASSWORD,
++    OSINFO_INSTALL_CONFIG_PROP_USER_LOGIN,
++    OSINFO_INSTALL_CONFIG_PROP_USER_REALNAME,
++    OSINFO_INSTALL_CONFIG_PROP_USER_AUTOLOGIN,
++    OSINFO_INSTALL_CONFIG_PROP_USER_ADMIN,
++    OSINFO_INSTALL_CONFIG_PROP_REG_LOGIN,
++    OSINFO_INSTALL_CONFIG_PROP_REG_PASSWORD,
++    OSINFO_INSTALL_CONFIG_PROP_REG_PRODUCTKEY,
++    OSINFO_INSTALL_CONFIG_PROP_HOSTNAME,
++    OSINFO_INSTALL_CONFIG_PROP_TARGET_DISK,
++    OSINFO_INSTALL_CONFIG_PROP_SCRIPT_DISK,
++    OSINFO_INSTALL_CONFIG_PROP_AVATAR_LOCATION,
++    OSINFO_INSTALL_CONFIG_PROP_AVATAR_DISK,
++    OSINFO_INSTALL_CONFIG_PROP_PRE_INSTALL_DRIVERS_DISK,
++    OSINFO_INSTALL_CONFIG_PROP_PRE_INSTALL_DRIVERS_LOCATION,
++    OSINFO_INSTALL_CONFIG_PROP_POST_INSTALL_DRIVERS_DISK,
++    OSINFO_INSTALL_CONFIG_PROP_POST_INSTALL_DRIVERS_LOCATION,
++    OSINFO_INSTALL_CONFIG_PROP_DRIVER_SIGNING,
++    OSINFO_INSTALL_CONFIG_PROP_INSTALLATION_URL,
++    NULL
++};
++
+ static OsinfoInstallConfig *config;
+ 
+ static gboolean handle_config(const gchar *option_name G_GNUC_UNUSED,
+@@ -65,6 +93,47 @@ static gboolean handle_config(const gchar *option_name G_GNUC_UNUSED,
+ }
+ 
+ 
++static gboolean handle_config_file(const gchar *option_name G_GNUC_UNUSED,
++                                   const gchar *value,
++                                   gpointer data G_GNUC_UNUSED,
++                                   GError **error)
++{
++    GKeyFile *key_file = NULL;
++    gchar *val = NULL;
++    gsize i;
++    gboolean ret = FALSE;
++
++    key_file = g_key_file_new();
++    if (!g_key_file_load_from_file(key_file, value, G_KEY_FILE_NONE, error))
++        goto error;
++
++    for (i = 0; configs[i] != NULL; i++) {
++        val = g_key_file_get_string(key_file, "install-script", configs[i], error);
++        if (val == NULL) {
++            if (g_error_matches(*error, G_KEY_FILE_ERROR,
++                                G_KEY_FILE_ERROR_KEY_NOT_FOUND)) {
++                g_clear_error(error);
++                continue;
++            }
++
++            goto error;
++        }
++
++        osinfo_entity_set_param(OSINFO_ENTITY(config),
++                                configs[i],
++                                val);
++        g_free(val);
++    }
++
++    ret = TRUE;
++
++error:
++    g_key_file_unref(key_file);
++
++    return ret;
++}
++
++
+ static GOptionEntry entries[] =
+ {
+     { "profile", 'p', 0, G_OPTION_ARG_STRING, (void*)&profile,
+@@ -78,6 +147,9 @@ static GOptionEntry entries[] =
+     { "config", 'c', 0, G_OPTION_ARG_CALLBACK,
+       handle_config,
+       N_("Set configuration parameter"), "key=value" },
++    { "config-file", 'f', 0, G_OPTION_ARG_CALLBACK,
++      handle_config_file,
++      N_("Set configuration parameters"), "file:///path/to/config/file" },
+     { "list-config", '\0', 0, G_OPTION_ARG_NONE, (void*)&list_config,
+       N_("List configuration parameters"), NULL },
+     { "list-profiles", '\0', 0, G_OPTION_ARG_NONE, (void*)&list_profile,
+@@ -448,6 +520,10 @@ script. Defaults to C<media>, but can also be C<network>.
+ 
+ Set the configuration parameter C<key> to C<value>.
+ 
++=item B<--config-file=config-file>
++
++Set the configurations parameters according to the config-file passed.
++
+ =back
+ 
+ =head1 CONFIGURATION KEYS
+@@ -510,18 +586,36 @@ The software registration user password
+ 
+ =back
+ 
++=head1 CONFIGURATION FILE FORMAT
++
++The configuration file must consist in a file which contains a
++`install-script` group and, under this group, C<key>=C<value>
++pairs, as shown below:
++
++[install-script]
++l10n-timezone=GMT
++l10n-keyboard=uk
++l10n-language=en_GB
++admin-password=123456
++user-login=berrange
++user-password=123456
++user-realname="Daniel P Berrange"
++
+ =head1 EXAMPLE USAGE
+ 
+-The following usage generates a Fedora 16 kickstart script
++The following usages generates a Fedora 16 kickstart script
++
++  # osinfo-install-script \
++         --profile jeos \
++         --config-file /path/to/the/config/file \
++         fedora16
+ 
+   # osinfo-install-script \
+          --profile jeos \
+          --config l10n-timezone=GMT \
+          --config l10n-keyboard=uk \
+          --config l10n-language=en_GB \
+-         --config admin-password=123456 \
+          --config user-login=berrange \
+-         --config user-password=123456 \
+          --config user-realname="Daniel P Berrange" \
+          fedora16
+ 
+-- 
+2.21.0
+
+As passing user & admin password via command line is a low impact CVE,
+let's error out when it's done and advertise the users to use
+--config-file instead.
+
+Signed-off-by: Fabiano Fidêncio <fidencio redhat com>
+---
+ tools/osinfo-install-script.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/tools/osinfo-install-script.c b/tools/osinfo-install-script.c
+index efa96ee..3da4a69 100644
+--- a/tools/osinfo-install-script.c
++++ b/tools/osinfo-install-script.c
+@@ -85,6 +85,15 @@ static gboolean handle_config(const gchar *option_name G_GNUC_UNUSED,
+     val++;
+     key = g_strndup(value, len);
+ 
++    if (g_str_equal(key, OSINFO_INSTALL_CONFIG_PROP_USER_PASSWORD) ||
++        g_str_equal(key, OSINFO_INSTALL_CONFIG_PROP_ADMIN_PASSWORD)) {
++        g_set_error(error, OSINFO_ERROR, 0,
++                    _("When setting user or admin password, use "
++                      "--config-file instead.\n"));
++        g_free(key);
++        return FALSE;
++    }
++
+     osinfo_entity_set_param(OSINFO_ENTITY(config),
+                             key,
+                             val);
+@@ -520,6 +529,8 @@ script. Defaults to C<media>, but can also be C<network>.
+ 
+ Set the configuration parameter C<key> to C<value>.
+ 
++Note: this option has been deprecated, use B<--config-file=> instead.
++
+ =item B<--config-file=config-file>
+ 
+ Set the configurations parameters according to the config-file passed.
+-- 
+2.21.0
+