Package: release.debian.org Severity: normal User: release.debian....@packages.debian.org Usertags: unblock
Please unblock package mercurial. It fixes #773640[0] (CVE-2014-9390: Errors in handling case-sensitive directories allow for remote code execution on pull). Upstream has confirmed[1] that the three patches that this update adds are the ones needed to fix it. See below the debdiff against 3.1.2-1, the version currently in jessie. [0] https://bugs.debian.org/773640 [1] http://selenic.com/pipermail/mercurial-packaging/2014-December/000133.html ---8<--- diff -Nru mercurial-3.1.2/debian/changelog mercurial-3.1.2/debian/changelog --- mercurial-3.1.2/debian/changelog 2014-10-03 00:34:41.000000000 +0200 +++ mercurial-3.1.2/debian/changelog 2014-12-23 16:01:50.000000000 +0100 @@ -1,3 +1,15 @@ +mercurial (3.1.2-2) unstable; urgency=high + + * Fix "CVE-2014-9390: Errors in handling case-sensitive directories + allow for remote code execution on pull" by adding patches + from_upstream__encoding_add_hfsignoreclean_to_clean_out_HFS-ignored_characters.patch, + from_upstream__pathauditor_check_for_codepoints_ignored_on_OS_X.patch, + and + from_upstream__pathauditor_check_for_Windows_shortname_aliases.patch + (Closes: #773640) + + -- Javi Merino <vi...@debian.org> Tue, 23 Dec 2014 16:01:50 +0100 + mercurial (3.1.2-1) unstable; urgency=medium * New upstream version diff -Nru mercurial-3.1.2/debian/patches/from_upstream__encoding_add_hfsignoreclean_to_clean_out_HFS-ignored_characters.patch mercurial-3.1.2/debian/patches/from_upstream__encoding_add_hfsignoreclean_to_clean_out_HFS-ignored_characters.patch --- mercurial-3.1.2/debian/patches/from_upstream__encoding_add_hfsignoreclean_to_clean_out_HFS-ignored_characters.patch 1970-01-01 01:00:00.000000000 +0100 +++ mercurial-3.1.2/debian/patches/from_upstream__encoding_add_hfsignoreclean_to_clean_out_HFS-ignored_characters.patch 2014-12-23 15:57:51.000000000 +0100 @@ -0,0 +1,44 @@ +Origin: http://selenic.com/repo/hg-stable/rev/885bd7c5c7e3 +Description: encoding: add hfsignoreclean to clean out HFS-ignored characters + According to Apple Technote 1150 (unavailable from Apple as far as I + can tell, but archived in several places online), HFS+ ignores sixteen + specific unicode runes when doing path normalization. We need to + handle those cases, so this function lets us efficiently strip the + offending characters from a UTF-8 encoded string (which is the only + way it seems to matter on OS X.) + . + This is a fix for CVE-2014-9390 +Applied-Upstream: 3.2.3 + +diff --git a/mercurial/encoding.py b/mercurial/encoding.py +--- a/mercurial/encoding.py ++++ b/mercurial/encoding.py +@@ -8,6 +8,28 @@ + import error + import unicodedata, locale, os + ++# These unicode characters are ignored by HFS+ (Apple Technote 1150, ++# "Unicode Subtleties"), so we need to ignore them in some places for ++# sanity. ++_ignore = [unichr(int(x, 16)).encode("utf-8") for x in ++ "200c 200d 200e 200f 202a 202b 202c 202d 202e " ++ "206a 206b 206c 206d 206e 206f feff".split()] ++# verify the next function will work ++assert set([i[0] for i in _ignore]) == set(["\xe2", "\xef"]) ++ ++def hfsignoreclean(s): ++ """Remove codepoints ignored by HFS+ from s. ++ ++ >>> hfsignoreclean(u'.h\u200cg'.encode('utf-8')) ++ '.hg' ++ >>> hfsignoreclean(u'.h\ufeffg'.encode('utf-8')) ++ '.hg' ++ """ ++ if "\xe2" in s or "\xef" in s: ++ for c in _ignore: ++ s = s.replace(c, '') ++ return s ++ + def _getpreferredencoding(): + ''' + On darwin, getpreferredencoding ignores the locale environment and diff -Nru mercurial-3.1.2/debian/patches/from_upstream__pathauditor_check_for_codepoints_ignored_on_OS_X.patch mercurial-3.1.2/debian/patches/from_upstream__pathauditor_check_for_codepoints_ignored_on_OS_X.patch --- mercurial-3.1.2/debian/patches/from_upstream__pathauditor_check_for_codepoints_ignored_on_OS_X.patch 1970-01-01 01:00:00.000000000 +0100 +++ mercurial-3.1.2/debian/patches/from_upstream__pathauditor_check_for_codepoints_ignored_on_OS_X.patch 2014-12-23 15:57:51.000000000 +0100 @@ -0,0 +1,59 @@ +Origin: http://selenic.com/repo/hg-stable/rev/c02a05cc6f5e +Description: pathauditor: check for codepoints ignored on OS X + This is a fix for CVE-2014-9390 +Applied-Upstream: 3.2.3 + +--- a/mercurial/pathutil.py ++++ b/mercurial/pathutil.py +@@ -1,8 +1,12 @@ + import os, errno, stat + ++import encoding + import util + from i18n import _ + ++def _lowerclean(s): ++ return encoding.hfsignoreclean(s.lower()) ++ + class pathauditor(object): + '''ensure that a filesystem path contains no banned components. + the following properties of a path are checked: +@@ -39,11 +43,11 @@ class pathauditor(object): + raise util.Abort(_("path ends in directory separator: %s") % path) + parts = util.splitpath(path) + if (os.path.splitdrive(path)[0] +- or parts[0].lower() in ('.hg', '.hg.', '') ++ or _lowerclean(parts[0]) in ('.hg', '.hg.', '') + or os.pardir in parts): + raise util.Abort(_("path contains illegal component: %s") % path) +- if '.hg' in path.lower(): +- lparts = [p.lower() for p in parts] ++ if '.hg' in _lowerclean(path): ++ lparts = [_lowerclean(p.lower()) for p in parts] + for p in '.hg', '.hg.': + if p in lparts[1:]: + pos = lparts.index(p) +--- a/tests/test-commit.t ++++ b/tests/test-commit.t +@@ -418,4 +418,21 @@ commit copy + 0 0 6 ..... 0 26d3ca0dfd18 000000000000 000000000000 (re) + 1 6 7 ..... 1 d267bddd54f7 26d3ca0dfd18 000000000000 (re) + ++verify pathauditor blocks evil filepaths ++ $ cat > evil-commit.py <<EOF ++ > from mercurial import ui, hg, context, node ++ > notrc = u".h\u200cg".encode('utf-8') + '/hgrc' ++ > u = ui.ui() ++ > r = hg.repository(u, '.') ++ > def filectxfn(repo, memctx, path): ++ > return context.memfilectx(repo, path, '[hooks]\nupdate = echo owned') ++ > c = context.memctx(r, [r['tip'].node(), node.nullid], ++ > 'evil', [notrc], filectxfn, 0) ++ > r.commitctx(c) ++ > EOF ++ $ $PYTHON evil-commit.py ++ $ hg co --clean tip ++ abort: path contains illegal component: .h\xe2\x80\x8cg/hgrc (esc) ++ [255] ++ + $ cd .. diff -Nru mercurial-3.1.2/debian/patches/from_upstream__pathauditor_check_for_Windows_shortname_aliases.patch mercurial-3.1.2/debian/patches/from_upstream__pathauditor_check_for_Windows_shortname_aliases.patch --- mercurial-3.1.2/debian/patches/from_upstream__pathauditor_check_for_Windows_shortname_aliases.patch 1970-01-01 01:00:00.000000000 +0100 +++ mercurial-3.1.2/debian/patches/from_upstream__pathauditor_check_for_Windows_shortname_aliases.patch 2014-12-23 15:57:51.000000000 +0100 @@ -0,0 +1,63 @@ +Origin: http://selenic.com/repo/hg-stable/rev/6dad422ecc5a +Description: pathauditor: check for Windows shortname aliases + This is a fix for CVE-2014-9390 +Applied-Upstream: 3.2.3 + +--- a/mercurial/pathutil.py ++++ b/mercurial/pathutil.py +@@ -46,6 +46,13 @@ class pathauditor(object): + or _lowerclean(parts[0]) in ('.hg', '.hg.', '') + or os.pardir in parts): + raise util.Abort(_("path contains illegal component: %s") % path) ++ # Windows shortname aliases ++ for p in parts: ++ if "~" in p: ++ first, last = p.split("~", 1) ++ if last.isdigit() and first.upper() in ["HG", "HG8B6C"]: ++ raise util.Abort(_("path contains illegal component: %s") ++ % path) + if '.hg' in _lowerclean(path): + lparts = [_lowerclean(p.lower()) for p in parts] + for p in '.hg', '.hg.': +--- a/tests/test-commit.t ++++ b/tests/test-commit.t +@@ -435,4 +435,38 @@ verify pathauditor blocks evil filepaths + abort: path contains illegal component: .h\xe2\x80\x8cg/hgrc (esc) + [255] + +- $ cd .. ++ $ hg rollback -f ++ repository tip rolled back to revision 1 (undo commit) ++ $ cat > evil-commit.py <<EOF ++ > from mercurial import ui, hg, context, node ++ > notrc = "HG~1/hgrc" ++ > u = ui.ui() ++ > r = hg.repository(u, '.') ++ > def filectxfn(repo, memctx, path): ++ > return context.memfilectx(repo, path, '[hooks]\nupdate = echo owned') ++ > c = context.memctx(r, [r['tip'].node(), node.nullid], ++ > 'evil', [notrc], filectxfn, 0) ++ > r.commitctx(c) ++ > EOF ++ $ $PYTHON evil-commit.py ++ $ hg co --clean tip ++ abort: path contains illegal component: HG~1/hgrc ++ [255] ++ ++ $ hg rollback -f ++ repository tip rolled back to revision 1 (undo commit) ++ $ cat > evil-commit.py <<EOF ++ > from mercurial import ui, hg, context, node ++ > notrc = "HG8B6C~2/hgrc" ++ > u = ui.ui() ++ > r = hg.repository(u, '.') ++ > def filectxfn(repo, memctx, path): ++ > return context.memfilectx(repo, path, '[hooks]\nupdate = echo owned') ++ > c = context.memctx(r, [r['tip'].node(), node.nullid], ++ > 'evil', [notrc], filectxfn, 0) ++ > r.commitctx(c) ++ > EOF ++ $ $PYTHON evil-commit.py ++ $ hg co --clean tip ++ abort: path contains illegal component: HG8B6C~2/hgrc ++ [255] diff -Nru mercurial-3.1.2/debian/patches/series mercurial-3.1.2/debian/patches/series --- mercurial-3.1.2/debian/patches/series 2014-09-03 12:15:32.000000000 +0200 +++ mercurial-3.1.2/debian/patches/series 2014-12-23 15:57:51.000000000 +0100 @@ -9,3 +9,6 @@ for_upstream__dont_rm_usr_bin_python_when_running_testsuite.patch for_upstream__lenient_test-shelve.patch from_upstream__test-patchbomb_t_work_around_Python_change_d579866d6419_issue4188.patch +from_upstream__encoding_add_hfsignoreclean_to_clean_out_HFS-ignored_characters.patch +from_upstream__pathauditor_check_for_codepoints_ignored_on_OS_X.patch +from_upstream__pathauditor_check_for_Windows_shortname_aliases.patch ---8<--- unblock mercurial/3.1.2-2 -- System Information: Debian Release: 8.0 APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores) Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
