This is an automated email from the git hooks/post-receive script.
apo pushed a commit to branch master
in repository libhibernate-validator-java.
commit 6cc019279593357c44a628ce1e7dc50dba8c5059
Author: Markus Koschany <a...@debian.org>
Date: Thu Jan 11 14:39:46 2018 +0100
Fix CVE-2017-7536.
Closes: #885577
Thanks: Salvatore Bonaccorso for the report.
---
debian/patches/CVE-2017-7536.patch | 84 ++++++++++++++++++++++++++++++++++++++
debian/patches/series | 1 +
2 files changed, 85 insertions(+)
diff --git a/debian/patches/CVE-2017-7536.patch
b/debian/patches/CVE-2017-7536.patch
new file mode 100644
index 0000000..c3216f1
--- /dev/null
+++ b/debian/patches/CVE-2017-7536.patch
@@ -0,0 +1,84 @@
+From: Markus Koschany <a...@debian.org>
+Date: Thu, 11 Jan 2018 14:39:09 +0100
+Subject: CVE-2017-7536
+
+Bug-Debian: https://bugs.debian.org/885577
+Origin:
https://github.com/hibernate/hibernate-validator/commit/0ed45f37c4680998167179e631113a2c9cb5d113
+---
+ .../validator/HibernateValidatorPermission.java | 29 ++++++++++++++++++++++
+ .../validator/internal/engine/ValidatorImpl.java | 6 +++++
+ .../util/privilegedactions/GetDeclaredField.java | 1 -
+ 3 files changed, 35 insertions(+), 1 deletion(-)
+ create mode 100644
engine/src/main/java/org/hibernate/validator/HibernateValidatorPermission.java
+
+diff --git
a/engine/src/main/java/org/hibernate/validator/HibernateValidatorPermission.java
b/engine/src/main/java/org/hibernate/validator/HibernateValidatorPermission.java
+new file mode 100644
+index 0000000..71b33b7
+--- /dev/null
++++
b/engine/src/main/java/org/hibernate/validator/HibernateValidatorPermission.java
+@@ -0,0 +1,29 @@
++/*
++ * Hibernate Validator, declare and validate application constraints
++ *
++ * License: Apache License, Version 2.0
++ * See the license.txt file in the root directory or
<http://www.apache.org/licenses/LICENSE-2.0>.
++ */
++package org.hibernate.validator;
++
++import java.security.BasicPermission;
++
++/**
++ * Our specific implementation of {@link BasicPermission} as we cannot define
additional {@link RuntimePermission}.
++ * <p>
++ * {@code HibernateValidatorPermission} is thread-safe and immutable.
++ *
++ * @author Guillaume Smet
++ */
++public class HibernateValidatorPermission extends BasicPermission {
++
++ public static final HibernateValidatorPermission ACCESS_PRIVATE_MEMBERS
= new HibernateValidatorPermission( "accessPrivateMembers" );
++
++ public HibernateValidatorPermission(String name) {
++ super( name );
++ }
++
++ public HibernateValidatorPermission(String name, String actions) {
++ super( name, actions );
++ }
++}
+diff --git
a/engine/src/main/java/org/hibernate/validator/internal/engine/ValidatorImpl.java
b/engine/src/main/java/org/hibernate/validator/internal/engine/ValidatorImpl.java
+index 02d2b97..00b78e2 100644
+---
a/engine/src/main/java/org/hibernate/validator/internal/engine/ValidatorImpl.java
++++
b/engine/src/main/java/org/hibernate/validator/internal/engine/ValidatorImpl.java
+@@ -64,6 +64,7 @@ import
org.hibernate.validator.internal.util.privilegedactions.SetAccessibility;
+ import org.hibernate.validator.method.MethodConstraintViolation;
+ import org.hibernate.validator.method.MethodValidator;
+ import org.hibernate.validator.method.metadata.TypeDescriptor;
++import org.hibernate.validator.HibernateValidatorPermission;
+
+ import static
org.hibernate.validator.internal.util.CollectionHelper.newArrayList;
+ import static
org.hibernate.validator.internal.util.CollectionHelper.newHashMap;
+@@ -1426,6 +1427,11 @@ public class ValidatorImpl implements Validator,
MethodValidator {
+ return member;
+ }
+
++ SecurityManager sm = System.getSecurityManager();
++ if ( sm != null ) {
++ sm.checkPermission(
HibernateValidatorPermission.ACCESS_PRIVATE_MEMBERS );
++ }
++
+ Class<?> clazz = original.getDeclaringClass();
+
+ if ( original instanceof Field ) {
+diff --git
a/engine/src/main/java/org/hibernate/validator/internal/util/privilegedactions/GetDeclaredField.java
b/engine/src/main/java/org/hibernate/validator/internal/util/privilegedactions/GetDeclaredField.java
+index 3617d63..8db6523 100644
+---
a/engine/src/main/java/org/hibernate/validator/internal/util/privilegedactions/GetDeclaredField.java
++++
b/engine/src/main/java/org/hibernate/validator/internal/util/privilegedactions/GetDeclaredField.java
+@@ -41,7 +41,6 @@ public final class GetDeclaredField implements
PrivilegedAction<Field> {
+ public Field run() {
+ try {
+ final Field field = clazz.getDeclaredField( fieldName );
+- field.setAccessible( true );
+ return field;
+ }
+ catch ( NoSuchFieldException e ) {
diff --git a/debian/patches/series b/debian/patches/series
index bc67171..0a06d89 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,3 @@
01-workaround-maven-repo-helper-bug.patch
jboss-logging-tools.patch
+CVE-2017-7536.patch
--
Alioth's /usr/local/bin/git-commit-notice on
/srv/git.debian.org/git/pkg-java/libhibernate-validator-java.git
_______________________________________________
pkg-java-commits mailing list
pkg-java-comm...@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-java-commits
