Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package httpcomponents-client for
openSUSE:Factory checked in at 2026-08-30 19:06:27
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/httpcomponents-client (Old)
and /work/SRC/openSUSE:Factory/.httpcomponents-client.new.1265 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "httpcomponents-client"
Sun Aug 30 19:06:27 2026 rev:7 rq:1374482 version:4.5.14
Changes:
--------
---
/work/SRC/openSUSE:Factory/httpcomponents-client/httpcomponents-client.changes
2024-11-08 11:58:07.582325666 +0100
+++
/work/SRC/openSUSE:Factory/.httpcomponents-client.new.1265/httpcomponents-client.changes
2026-08-30 19:06:28.621416802 +0200
@@ -1,0 +2,10 @@
+Thu Aug 13 14:31:03 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Added patch:
+ * httpcomponents-client-CVE-2026-64607.patch
+ + backport of upstream patch fixing bsc#1273163, CVE-2026-64607:
+ improper release of underlying connection back to connection
+ manager when an invalid or unsupported "Content-Encoding"
+ header value in a response message
+
+-------------------------------------------------------------------
New:
----
_scmsync.obsinfo
build.specials.obscpio
httpcomponents-client-CVE-2026-64607.patch
----------(New B)----------
New:- Added patch:
* httpcomponents-client-CVE-2026-64607.patch
+ backport of upstream patch fixing bsc#1273163, CVE-2026-64607:
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ httpcomponents-client.spec ++++++
--- /var/tmp/diff_new_pack.Yw79zb/_old 2026-08-30 19:06:30.159470294 +0200
+++ /var/tmp/diff_new_pack.Yw79zb/_new 2026-08-30 19:06:30.163470433 +0200
@@ -1,7 +1,7 @@
#
# spec file for package httpcomponents-client
#
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -28,6 +28,7 @@
Source1: %{name}-build.tar.xz
Patch0: 0001-Use-system-copy-of-effective_tld_names.dat.patch
Patch1: %{name}-java8compat.patch
+Patch2: %{name}-CVE-2026-64607.patch
BuildRequires: ant
BuildRequires: apache-commons-codec
BuildRequires: apache-commons-logging
@@ -70,9 +71,7 @@
%{summary}.
%prep
-%setup -q -c -a1
-%patch -P 0 -p1
-%patch -P 1 -p1
+%autosetup -c -a1 -p1
# Remove optional build deps not available in openSUSE
%pom_disable_module httpclient-osgi
++++++ _scmsync.obsinfo ++++++
mtime: 1786631610
commit: 9d12158487512e4836e017c92757e1ec514c848dad6507cf3e3aaa8f62eb9811
url: https://src.opensuse.org/java-packages/httpcomponents-client
revision: 9d12158487512e4836e017c92757e1ec514c848dad6507cf3e3aaa8f62eb9811
projectscmsync: https://src.opensuse.org/java-packages/_ObsPrj
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-08-13 16:33:30.000000000 +0200
@@ -0,0 +1 @@
+.osc
++++++ httpcomponents-client-CVE-2026-64607.patch ++++++
>From 010bf16bf18f4b65ccf9ecb4922ef67b4da83f1f Mon Sep 17 00:00:00 2001
From: Fridrich Strba <[email protected]>
Date: Thu, 13 Aug 2026 15:55:36 +0200
Subject: [PATCH] ContentCompressionExec fails to close the underlying response
stream in case of an unexpected runtime or protocol exception
---
.../protocol/ResponseContentEncoding.java | 60 ++++++++++++-------
.../protocol/TestResponseContentEncoding.java | 43 +++++++++++++
2 files changed, 83 insertions(+), 20 deletions(-)
diff --git
a/httpclient/src/main/java/org/apache/http/client/protocol/ResponseContentEncoding.java
b/httpclient/src/main/java/org/apache/http/client/protocol/ResponseContentEncoding.java
index a40d03bf7..f61eb032b 100644
---
a/httpclient/src/main/java/org/apache/http/client/protocol/ResponseContentEncoding.java
+++
b/httpclient/src/main/java/org/apache/http/client/protocol/ResponseContentEncoding.java
@@ -26,6 +26,7 @@
*/
package org.apache.http.client.protocol;
+import java.io.Closeable;
import java.io.IOException;
import java.util.Locale;
@@ -45,6 +46,7 @@ import org.apache.http.client.entity.InputStreamFactory;
import org.apache.http.config.Lookup;
import org.apache.http.config.RegistryBuilder;
import org.apache.http.protocol.HttpContext;
+import org.apache.http.util.EntityUtils;
/**
* {@link HttpResponseInterceptor} responsible for processing Content-Encoding
@@ -106,31 +108,49 @@ public class ResponseContentEncoding implements
HttpResponseInterceptor {
public void process(
final HttpResponse response,
final HttpContext context) throws HttpException, IOException {
- final HttpEntity entity = response.getEntity();
+ try {
+ final HttpEntity entity = response.getEntity();
- final HttpClientContext clientContext =
HttpClientContext.adapt(context);
- final RequestConfig requestConfig = clientContext.getRequestConfig();
- // entity can be null in case of 304 Not Modified, 204 No Content or
similar
- // check for zero length entity.
- if (requestConfig.isContentCompressionEnabled() && entity != null &&
entity.getContentLength() != 0) {
- final Header ceheader = entity.getContentEncoding();
- if (ceheader != null) {
- final HeaderElement[] codecs = ceheader.getElements();
- for (final HeaderElement codec : codecs) {
- final String codecname =
codec.getName().toLowerCase(Locale.ROOT);
- final InputStreamFactory decoderFactory =
decoderRegistry.lookup(codecname);
- if (decoderFactory != null) {
- response.setEntity(new
DecompressingEntity(response.getEntity(), decoderFactory));
- response.removeHeaders("Content-Length");
- response.removeHeaders("Content-Encoding");
- response.removeHeaders("Content-MD5");
- } else {
- if (!"identity".equals(codecname) && !ignoreUnknown) {
- throw new HttpException("Unsupported
Content-Encoding: " + codec.getName());
+ final HttpClientContext clientContext =
HttpClientContext.adapt(context);
+ final RequestConfig requestConfig =
clientContext.getRequestConfig();
+ // entity can be null in case of 304 Not Modified, 204 No Content
or similar
+ // check for zero length entity.
+ if (requestConfig.isContentCompressionEnabled() && entity != null
&& entity.getContentLength() != 0) {
+ final Header ceheader = entity.getContentEncoding();
+ if (ceheader != null) {
+ final HeaderElement[] codecs = ceheader.getElements();
+ for (final HeaderElement codec : codecs) {
+ final String codecname =
codec.getName().toLowerCase(Locale.ROOT);
+ final InputStreamFactory decoderFactory =
decoderRegistry.lookup(codecname);
+ if (decoderFactory != null) {
+ response.setEntity(new
DecompressingEntity(response.getEntity(), decoderFactory));
+ response.removeHeaders("Content-Length");
+ response.removeHeaders("Content-Encoding");
+ response.removeHeaders("Content-MD5");
+ } else {
+ if (!"identity".equals(codecname) &&
!ignoreUnknown) {
+ throw new HttpException("Unsupported
Content-Encoding: " + codec.getName());
+ }
}
}
}
}
+ } catch (final HttpException | RuntimeException ex) {
+ if (response instanceof Closeable) {
+ try {
+ ((Closeable) response).close();
+ } catch (final IOException ignore) {
+ }
+ } else {
+ final HttpEntity entity = response.getEntity();
+ if (entity != null) {
+ try {
+ EntityUtils.consume(entity);
+ } catch (final IOException ignore) {
+ }
+ }
+ }
+ throw ex;
}
}
diff --git
a/httpclient/src/test/java/org/apache/http/client/protocol/TestResponseContentEncoding.java
b/httpclient/src/test/java/org/apache/http/client/protocol/TestResponseContentEncoding.java
index 217bd66c9..ac2fe89aa 100644
---
a/httpclient/src/test/java/org/apache/http/client/protocol/TestResponseContentEncoding.java
+++
b/httpclient/src/test/java/org/apache/http/client/protocol/TestResponseContentEncoding.java
@@ -34,12 +34,14 @@ import org.apache.http.HttpVersion;
import org.apache.http.client.config.RequestConfig;
import org.apache.http.client.entity.DecompressingEntity;
import org.apache.http.client.entity.GzipDecompressingEntity;
+import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.entity.StringEntity;
import org.apache.http.message.BasicHttpResponse;
import org.apache.http.protocol.BasicHttpContext;
import org.apache.http.protocol.HttpContext;
import org.junit.Assert;
import org.junit.Test;
+import org.mockito.Mockito;
public class TestResponseContentEncoding {
@@ -176,4 +178,45 @@ public class TestResponseContentEncoding {
Assert.assertFalse(entity instanceof GzipDecompressingEntity);
}
+ @Test
+ public void testUnknownContentEncodingCloseResponse() throws Exception {
+ final CloseableHttpResponse response =
Mockito.mock(CloseableHttpResponse.class);
+ final StringEntity original = new StringEntity("encoded stuff");
+ original.setContentEncoding("whatever");
+ Mockito.when(response.getEntity()).thenReturn(original);
+ final HttpContext context = new BasicHttpContext();
+
+ final HttpResponseInterceptor interceptor = new
ResponseContentEncoding(false);
+ try {
+ interceptor.process(response, context);
+ Assert.fail("HttpException expected");
+ } catch (final HttpException ex) {
+ // expected
+ }
+ Mockito.verify(response).close();
+ }
+
+ @Test
+ public void testUnknownContentEncodingConsumeEntity() throws Exception {
+ final HttpResponse response = Mockito.mock(HttpResponse.class);
+ final HttpEntity entity = Mockito.mock(HttpEntity.class);
+ final org.apache.http.Header header = new
org.apache.http.message.BasicHeader("Content-Encoding", "whatever");
+ Mockito.when(entity.getContentEncoding()).thenReturn(header);
+ Mockito.when(entity.getContentLength()).thenReturn(10L);
+ Mockito.when(entity.isStreaming()).thenReturn(true);
+ final java.io.InputStream instream =
Mockito.mock(java.io.InputStream.class);
+ Mockito.when(entity.getContent()).thenReturn(instream);
+ Mockito.when(response.getEntity()).thenReturn(entity);
+ final HttpContext context = new BasicHttpContext();
+
+ final HttpResponseInterceptor interceptor = new
ResponseContentEncoding(false);
+ try {
+ interceptor.process(response, context);
+ Assert.fail("HttpException expected");
+ } catch (final HttpException ex) {
+ // expected
+ }
+ Mockito.verify(instream).close();
+ }
+
}
--
2.55.0
