Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:socat
User: [email protected]
Usertags: pu
Fixes a low severity security issue. All tests in debusine look
good and the patch has been reviewed by the maintainer as well.
debdiff below.
Cheers,
Moritz
diff -Nru socat-1.8.0.3/debian/changelog socat-1.8.0.3/debian/changelog
--- socat-1.8.0.3/debian/changelog 2025-03-31 22:50:04.000000000 +0200
+++ socat-1.8.0.3/debian/changelog 2026-09-03 22:58:48.000000000 +0200
@@ -1,3 +1,9 @@
+socat (1.8.0.3-1+deb13u1) trixie; urgency=medium
+
+ * CVE-2026-56123
+
+ -- Moritz Mühlenhoff <[email protected]> Thu, 03 Sep 2026 22:58:48 +0200
+
socat (1.8.0.3-1) unstable; urgency=medium
[ Bastian Germann <[email protected]> ]
diff -Nru socat-1.8.0.3/debian/patches/CVE-2026-56123.patch
socat-1.8.0.3/debian/patches/CVE-2026-56123.patch
--- socat-1.8.0.3/debian/patches/CVE-2026-56123.patch 1970-01-01
01:00:00.000000000 +0100
+++ socat-1.8.0.3/debian/patches/CVE-2026-56123.patch 2026-09-03
22:57:59.000000000 +0200
@@ -0,0 +1,122 @@
+From d44cd1cc4fbb70a9ae9e71890024ae8367fcb912 Mon Sep 17 00:00:00 2001
+From: Gerhard Rieger <[email protected]>
+Date: Thu, 25 Jun 2026 14:55:59 +0200
+Subject: [PATCH] Version 1.8.1.2 - fixed SOCKS5 client buffer overflow
+ (CVE-2026-56123)
+
+From af5388c898c7bb60997935aee93c223deba60c4a Mon Sep 17 00:00:00 2001
+From: Gerhard Rieger <[email protected]>
+Date: Fri, 26 Jun 2026 07:53:54 +0200
+Subject: [PATCH] Version 1.8.1.3 - corrected test for non-bash
+
+
+--- socat-1.8.0.3.orig/test.sh
++++ socat-1.8.0.3/test.sh
+@@ -615,6 +615,9 @@ rm -rf "$TD" || (echo "cannot rm $TD" >&
+ mkdir -p "$TD"
+ #trap "rm -r $TD" 0 3
+
++BINDIR=$td/bin
++mkdir -p $BINDIR
++
+ echo "Using temp directory $TD"
+
+ RESULTS="$TD/results.txt" # file for list of results
+@@ -20412,6 +20415,77 @@ PROXY tcp CONNECT 127.0.0.1:80 proxyp
+ # test combined 4_6/6_4 with retry and fork
+
+
++# Above tests introduced with 1.8.1.0 (none with 1.8.1.1)
++#==============================================================================
++# Below tests introduced with 1.8.1.2
++
++
++# Test socks5 client buffer overflow (CVE-2026-56123)
++NAME=SOCKS5_OVERFL
++case "$TESTS" in
++*%$N%*|*%functions%*|*%bugs%*|*%security%*|*%socks5%*|*%socks%*|*%%*|*%%*|*%socket%*|*%$NAME%*)
++#*%internet%*|*%root%*|*%listen%*|*%fork%*|*%ip4%*|*%tcp4%*|*%bug%*|...
++TEST="$NAME: socks5 client buffer overflow"
++# Start a listener that emulates a malicious socks5 server, using a temporary
++# shell script;
++# connect using Socat with socks5 client;
++# when is terminates with rc=0 the test succeeded (not vulnerable)
++if ! eval $NUMCOND; then :
++# Check if this test can be performed meaningfully
++elif ! cond=$(checkconds \
++ "" \
++ "" \
++ "" \
++ "IP4 TCP LISTEN SHELL GOPEN SOCKS5" \
++ "TCP4-LISTEN SHELL GOPEN SOCKS5" \
++ "socksport" \
++ "tcp4" ); then
++ $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N
++ cant
++else
++ mkdir -p "$BINDIR"
++ tf="$td/test$N.stdout"
++ te="$td/test$N.stderr"
++ tdiff="$td/test$N.diff"
++ tsh="$BINDIR/test$N.sh"
++ cat >"$tsh" <<__EOF__
++#! /usr/bin/env bash
++$ECHO -n "\\x05\\x00"
++relsleep 1
++$ECHO -n
"\\x05\\x00\\x00\\x03\\xfdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
++__EOF__
++ chmod a+x "$tsh"
++ newport tcp4 # -> PORT
++ CMD0="$TRACE $SOCAT $opts TCP4-LISTEN:$PORT SHELL:$tsh"
++ CMD1="$TRACE $SOCAT $opts /dev/null
SOCKS5:$LOCALHOST4:17.34.51.68:85,socksport=$PORT"
++ printf "test $F_n $TEST... " $N
++ $CMD0 >/dev/null 2>"${te}0" &
++ pid0=$!
++ waittcp4port $PORT 1
++ $CMD1 >"${tf}1" 2>"${te}1"
++ rc1=$?
++ kill $pid0 2>/dev/null; wait
++ if [ "$rc1" -ne 0 ]; then
++ $PRINTF "$FAILED (rc1=$rc1)\n"
++ echo "$CMD0 &"
++ cat "${te}0" >&2
++ echo "$CMD1"
++ cat "${te}1" >&2
++ failed
++ else
++ $PRINTF "$OK\n"
++ if [ "$VERBOSE" ]; then echo "$CMD0 &"; fi
++ if [ "$DEBUG" ]; then cat "${te}0" >&2; fi
++ if [ "$VERBOSE" ]; then echo "$CMD1"; fi
++ if [ "$DEBUG" ]; then cat "${te}1" >&2; fi
++ ok
++ fi
++fi # NUMCOND
++ ;;
++esac
++N=$((N+1))
++
++
+ # end of common tests
+
+
##################################################################################
+--- socat-1.8.0.3.orig/xio-socks5.h
++++ socat-1.8.0.3/xio-socks5.h
+@@ -23,7 +23,7 @@ struct socks5_request {
+ uint8_t command;
+ uint8_t reserved;
+ uint8_t address_type;
+- char dstdata[];
++ unsigned char dstdata[];
+ };
+
+ struct socks5_reply {
+@@ -31,7 +31,7 @@ struct socks5_reply {
+ uint8_t reply;
+ uint8_t reserved;
+ uint8_t address_type;
+- char dstdata[];
++ unsigned char dstdata[];
+ };
+
+ extern const struct addrdesc xioaddr_socks5_connect;
diff -Nru socat-1.8.0.3/debian/patches/series
socat-1.8.0.3/debian/patches/series
--- socat-1.8.0.3/debian/patches/series 2025-03-31 22:50:04.000000000 +0200
+++ socat-1.8.0.3/debian/patches/series 2026-09-03 22:57:15.000000000 +0200
@@ -5,3 +5,4 @@
07-compat-define-PATH_MAX.patch
08-test.sh-fixes.patch
09-xioinitialize.c.patch
+CVE-2026-56123.patch
