Package: release.debian.org Severity: normal Tags: trixie User: [email protected] Usertags: pu
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 [ Reason ] Address the following issue: * Fix CVE-2026-81523: validate db and collection names [ Impact ] Without this fix, users and applications integrating libmongocrypt components may be vulnerable to potential information modification or disclosure. [ Tests ] The affected/changed code went through upstream code reviews. Also, accompanying unit tests were implemented and executed in upstream's extensive CI environment. [ Risks ] Code changes are minimal (to the extent possible), extensively reviewed/tested, and low risk. There are no work arounds. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] Backport the following upstream change: https://github.com/mongodb/libmongocrypt/commit/0f8d744a8c5e1877e40efd1c8b440e4eed1e2462 [ Other info ] N/A -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEIYZ1DR4ae5UL01q7ldFmTdL1kUIFAmqTAvUACgkQldFmTdL1 kUKkkA//esD+6cjeZ1BQd02CK+fEKxbx0v6cAHB9BMH7193s/SWqe8f0gQo0r53h MHMw8l49riPzr/gabY+RgV1t1t+0QOs/6DxPfneR4WHonR8RCfZfhSocQSIexUov T9TJ3WyVAWxU401eIWhKapwDGNaszssut0kKH/Ii1kFk8cd1QMgPICz9YmFOshXk v8lW2YGpxusqqQUSfPVJ6gJEI30VDgei8X3g8LYFdkPXJsgPlKgE+RqvmBX6kxlC jMYpYDGN0SSYmKLvpn2QVCcPaPkcTSQQPYnVsHPcjnWG+aU6Ju+Xdpaj9EGfmIm4 mCMMw9nGff3+B9yC16ZKAz8HTEPadfBun3yzyDtabN3iUr1Fm1nNQgUGEkd8iXh4 srncjW6M1rvFZmfdgDnk0h4IWhIC8YC6T2TgtocUeur6Epq76Z46qGF51NtRPN5j AbAXPjbx8caztIpZUzF6oQyi5FnhfpcCKjUNKSRUeb4O7w4Ojahq4xU/ZiCSr9o9 cLAiNOQGb7o5237bzOX9SNd6vJqOFzSgoOzlggTur4R9IwAcH2IAVzlkyNuxXwW6 iwTMuNkF/Z67hcgOll2bkVe6AolCrzEzGOPFrdE2uErDca6C8VKC1Y39lqSqB5Go 6NiZNDheuH4uu4ECrcbrC0CEAoDIKhDQYV4ZUh/IyhnPm9mzEfA= =TYdC -----END PGP SIGNATURE-----
diff -Nru libmongocrypt-1.13.2/debian/changelog libmongocrypt-1.13.2/debian/changelog --- libmongocrypt-1.13.2/debian/changelog 2025-04-11 00:41:45.000000000 -0400 +++ libmongocrypt-1.13.2/debian/changelog 2026-08-29 11:20:33.000000000 -0400 @@ -1,3 +1,9 @@ +libmongocrypt (1.13.2-1+deb13u1) trixie; urgency=medium + + * Fix CVE-2026-81523: validate db and collection names + + -- Roberto C. Sanchez <[email protected]> Sat, 29 Aug 2026 11:20:33 -0400 + libmongocrypt (1.13.2-1) unstable; urgency=medium * New upstream release. diff -Nru libmongocrypt-1.13.2/debian/gbp.conf libmongocrypt-1.13.2/debian/gbp.conf --- libmongocrypt-1.13.2/debian/gbp.conf 2025-04-11 00:41:45.000000000 -0400 +++ libmongocrypt-1.13.2/debian/gbp.conf 2026-08-29 11:20:33.000000000 -0400 @@ -12,9 +12,9 @@ third_party_rm_files=\"$([ -d third-party ] && find third-party/ -mindepth 1 -maxdepth 1 -printf '%p ')\" && # Create upstream tarball from reference, exclude items that do not belong pushd $GBP_GIT_DIR/.. && - git archive --format=tar --prefix=libmongocrypt-\${upstream_version}/ HEAD | tar -f - --delete libmongocrypt-\${upstream_version}/debian \$third_party_filter_files | gzip > $GBP_BUILD_DIR/../libmongocrypt_\${upstream_version}.orig.tar.gz && + ( [ -f $GBP_BUILD_DIR/../libmongocrypt_\${upstream_version}.orig.tar.gz ] || git archive --format=tar --prefix=libmongocrypt-\${upstream_version}/ HEAD | tar -f - --delete libmongocrypt-\${upstream_version}/debian \$third_party_filter_files | gzip > $GBP_BUILD_DIR/../libmongocrypt_\${upstream_version}.orig.tar.gz ) && popd && rm -rf \$third_party_rm_files" upstream-tag = %(version)s -debian-branch = debian/unstable +debian-branch = debian/trixie diff -Nru libmongocrypt-1.13.2/debian/patches/0001_CVE-2026-81523.patch libmongocrypt-1.13.2/debian/patches/0001_CVE-2026-81523.patch --- libmongocrypt-1.13.2/debian/patches/0001_CVE-2026-81523.patch 1969-12-31 19:00:00.000000000 -0500 +++ libmongocrypt-1.13.2/debian/patches/0001_CVE-2026-81523.patch 2026-08-29 11:20:33.000000000 -0400 @@ -0,0 +1,273 @@ +From 0f8d744a8c5e1877e40efd1c8b440e4eed1e2462 Mon Sep 17 00:00:00 2001 +From: Kevin Albertson <[email protected]> +Date: Wed, 19 Aug 2026 07:48:21 -0400 +Subject: [PATCH] MONGOCRYPT-977 validate db and collection + +Reject NUL and dot in db. +Reject NUL in collection. +--- + src/mc-schema-broker.c | 12 +++ + src/mongocrypt-ctx-encrypt.c | 29 ++++++++- + src/mongocrypt-private.h | 5 + + src/mongocrypt.c | 11 +++ + test/test-mongocrypt-ctx-encrypt.c | 114 +++++++++++++++++++++++++++++++++++++ + 5 files changed, 165 insertions(+), 6 deletions(-) + +--- a/src/mc-schema-broker.c ++++ b/src/mc-schema-broker.c +@@ -323,7 +323,11 @@ + CLIENT_ERR("failed to find 'name' in collinfo in database: %s", sb->db); + return false; + } +- coll = bson_iter_utf8(&name_iter, NULL); ++ uint32_t coll_len; ++ coll = bson_iter_utf8(&name_iter, &coll_len); ++ if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "collection name in collinfo", status)) { ++ return false; ++ } + } + + // Cache the received collinfo. +@@ -511,7 +515,11 @@ + CLIENT_ERR("Failed to get collection name from command"); + return false; + } +- const char *coll = bson_iter_utf8(&iter, NULL); ++ uint32_t coll_len; ++ const char *coll = bson_iter_utf8(&iter, &coll_len); ++ if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "collection name", status)) { ++ return false; ++ } + + // Check if schema was requested. + mc_schema_entry_t *found = NULL; +--- a/src/mongocrypt-ctx-encrypt.c ++++ b/src/mongocrypt-ctx-encrypt.c +@@ -2017,7 +2017,11 @@ + return false; + } + +- const char *target_ns = bson_iter_utf8(&ns_iter, NULL /* length */); ++ uint32_t target_ns_len; ++ const char *target_ns = bson_iter_utf8(&ns_iter, &target_ns_len); ++ if (!_mongocrypt_check_no_embedded_nul(target_ns, target_ns_len, "namespace in `bulkWrite` command", status)) { ++ return false; ++ } + // Parse `target_ns` into "<db>.<coll>" + const char *dot = strstr(target_ns, "."); + if (!dot) { +@@ -2089,7 +2093,12 @@ + } + + if (BSON_ITER_HOLDS_UTF8(&target_coll_iter)) { +- *target_coll = bson_strdup(bson_iter_utf8(&target_coll_iter, NULL)); ++ uint32_t target_coll_len; ++ const char *target_coll_str = bson_iter_utf8(&target_coll_iter, &target_coll_len); ++ if (!_mongocrypt_check_no_embedded_nul(target_coll_str, target_coll_len, "collection name", status)) { ++ return false; ++ } ++ *target_coll = bson_strdup(target_coll_str); + } else { + *target_coll = NULL; + } +@@ -2277,7 +2286,11 @@ + stage_key); + return false; + } +- const char *from = bson_iter_utf8(&lookup_iter, NULL); ++ uint32_t from_len; ++ const char *from = bson_iter_utf8(&lookup_iter, &from_len); ++ if (!_mongocrypt_check_no_embedded_nul(from, from_len, "'from' collection name", status)) { ++ return false; ++ } + if (!mc_schema_broker_request(sb, db, from, status)) { + return false; + } +@@ -2336,7 +2349,11 @@ + stage_key); + return false; + } +- const char *coll = bson_iter_utf8(&unionWith_iter, NULL); ++ uint32_t coll_len; ++ const char *coll = bson_iter_utf8(&unionWith_iter, &coll_len); ++ if (!_mongocrypt_check_no_embedded_nul(coll, coll_len, "'coll' collection name", status)) { ++ return false; ++ } + if (!mc_schema_broker_request(sb, db, coll, status)) { + return false; + } +@@ -2428,6 +2445,10 @@ + return _mongocrypt_ctx_fail_w_msg(ctx, "invalid db"); + } + ++ if (strchr(ectx->cmd_db, '.')) { ++ return _mongocrypt_ctx_fail_w_msg(ctx, "invalid db: must not contain a dot"); ++ } ++ + if (0 == strcmp(ectx->cmd_name, "bulkWrite")) { + // Handle `bulkWrite` as a special case. + // `bulkWrite` includes the target namespaces in an `nsInfo` field. +--- a/src/mongocrypt-private.h ++++ b/src/mongocrypt-private.h +@@ -153,6 +153,11 @@ + + bool _mongocrypt_validate_and_copy_string(const char *in, int32_t in_len, char **out) MONGOCRYPT_WARN_UNUSED_RESULT; + ++/* _mongocrypt_check_no_embedded_nul returns false and sets @status if @str contains an embedded null byte. See ++ * MONGOCRYPT-977. */ ++bool _mongocrypt_check_no_embedded_nul(const char *str, uint32_t len, const char *what, mongocrypt_status_t *status) ++ MONGOCRYPT_WARN_UNUSED_RESULT; ++ + char *_mongocrypt_new_string_from_bytes(const void *in, int len); + + char *_mongocrypt_new_json_string_from_binary(mongocrypt_binary_t *binary); +--- a/src/mongocrypt.c ++++ b/src/mongocrypt.c +@@ -985,6 +985,17 @@ + return crypt->csfle.get_version(); + } + ++bool _mongocrypt_check_no_embedded_nul(const char *str, uint32_t len, const char *what, mongocrypt_status_t *status) { ++ BSON_ASSERT_PARAM(str); ++ BSON_ASSERT_PARAM(what); ++ ++ if (strlen(str) != (size_t)len) { ++ CLIENT_ERR("%s must not contain an embedded null byte", what); ++ return false; ++ } ++ return true; ++} ++ + bool _mongocrypt_validate_and_copy_string(const char *in, int32_t in_len, char **out) { + BSON_ASSERT_PARAM(out); + +--- a/test/test-mongocrypt-ctx-encrypt.c ++++ b/test/test-mongocrypt-ctx-encrypt.c +@@ -360,6 +360,119 @@ + mongocrypt_destroy(crypt); + } + ++/* Test that a db name containing a dot or an embedded NUL is rejected. ++ * A db name like "a.b" would otherwise produce the namespace "a.b.coll", ++ * retargeting the operation at database "a" and collection "b.coll". ++ * Regression test for MONGOCRYPT-977. */ ++static void _test_encrypt_init_invalid_db_collection(_mongocrypt_tester_t *tester) { ++ mongocrypt_t *crypt = _mongocrypt_tester_mongocrypt(TESTER_MONGOCRYPT_DEFAULT); ++ ++ { ++ /* Dot in db name. */ ++ mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt); ++ ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "a.b", -1, TEST_FILE("./test/example/cmd.json")), ++ ctx, ++ "invalid db"); ++ mongocrypt_ctx_destroy(ctx); ++ } ++ ++ { ++ /* Embedded NUL in db name. */ ++ const char db[] = "a\0b"; ++ mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt); ++ ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, db, 3, TEST_FILE("./test/example/cmd.json")), ctx, "invalid db"); ++ mongocrypt_ctx_destroy(ctx); ++ } ++ ++ { ++ /* A dot in a collection name is legal, and must keep working. */ ++ mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt); ++ ASSERT_OK(mongocrypt_ctx_encrypt_init(ctx, "test", -1, TEST_BSON("{'find': 'a.b'}")), ctx); ++ mongocrypt_ctx_destroy(ctx); ++ } ++ ++ { ++ /* Embedded NUL in the collection name of the command. */ ++ bson_t *cmd = bson_new(); ++ BSON_ASSERT(bson_append_utf8(cmd, "find", -1, "a\0b", 3)); ++ mongocrypt_binary_t *bin = mongocrypt_binary_new_from_data((uint8_t *)bson_get_data(cmd), cmd->len); ++ mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt); ++ ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "test", -1, bin), ++ ctx, ++ "collection name must not contain an embedded null byte"); ++ mongocrypt_ctx_destroy(ctx); ++ mongocrypt_binary_destroy(bin); ++ bson_destroy(cmd); ++ } ++ ++ { ++ /* Embedded NUL in the `bulkWrite` nsInfo namespace. */ ++ bson_t *cmd = bson_new(); ++ bson_array_builder_t *nsInfo; ++ bson_t ns0; ++ BSON_ASSERT(BSON_APPEND_INT32(cmd, "bulkWrite", 1)); ++ BSON_ASSERT(BSON_APPEND_ARRAY_BUILDER_BEGIN(cmd, "nsInfo", &nsInfo)); ++ BSON_ASSERT(bson_array_builder_append_document_begin(nsInfo, &ns0)); ++ BSON_ASSERT(bson_append_utf8(&ns0, "ns", -1, "db.coll\0evil", 12)); ++ BSON_ASSERT(bson_array_builder_append_document_end(nsInfo, &ns0)); ++ BSON_ASSERT(bson_append_array_builder_end(cmd, nsInfo)); ++ mongocrypt_binary_t *bin = mongocrypt_binary_new_from_data((uint8_t *)bson_get_data(cmd), cmd->len); ++ mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt); ++ ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "test", -1, bin), ctx, "must not contain an embedded null byte"); ++ mongocrypt_ctx_destroy(ctx); ++ mongocrypt_binary_destroy(bin); ++ bson_destroy(cmd); ++ } ++ ++ { ++ /* Embedded NUL in a $lookup 'from' collection name. */ ++ bson_t *cmd = bson_new(); ++ bson_array_builder_t *pipeline; ++ bson_t stage, lookup; ++ BSON_ASSERT(BSON_APPEND_UTF8(cmd, "aggregate", "coll")); ++ BSON_ASSERT(BSON_APPEND_ARRAY_BUILDER_BEGIN(cmd, "pipeline", &pipeline)); ++ BSON_ASSERT(bson_array_builder_append_document_begin(pipeline, &stage)); ++ BSON_ASSERT(BSON_APPEND_DOCUMENT_BEGIN(&stage, "$lookup", &lookup)); ++ BSON_ASSERT(bson_append_utf8(&lookup, "from", -1, "a\0b", 3)); ++ BSON_ASSERT(bson_append_document_end(&stage, &lookup)); ++ BSON_ASSERT(bson_array_builder_append_document_end(pipeline, &stage)); ++ BSON_ASSERT(bson_append_array_builder_end(cmd, pipeline)); ++ mongocrypt_binary_t *bin = mongocrypt_binary_new_from_data((uint8_t *)bson_get_data(cmd), cmd->len); ++ mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt); ++ ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "test", -1, bin), ++ ctx, ++ "'from' collection name must not contain an embedded null byte"); ++ mongocrypt_ctx_destroy(ctx); ++ mongocrypt_binary_destroy(bin); ++ bson_destroy(cmd); ++ } ++ ++ { ++ /* Embedded NUL in a $unionWith 'coll' collection name. */ ++ bson_t *cmd = bson_new(); ++ bson_array_builder_t *pipeline; ++ bson_t stage, unionWith; ++ BSON_ASSERT(BSON_APPEND_UTF8(cmd, "aggregate", "coll")); ++ BSON_ASSERT(BSON_APPEND_ARRAY_BUILDER_BEGIN(cmd, "pipeline", &pipeline)); ++ BSON_ASSERT(bson_array_builder_append_document_begin(pipeline, &stage)); ++ BSON_ASSERT(BSON_APPEND_DOCUMENT_BEGIN(&stage, "$unionWith", &unionWith)); ++ BSON_ASSERT(bson_append_utf8(&unionWith, "coll", -1, "a\0b", 3)); ++ BSON_ASSERT(bson_append_document_end(&stage, &unionWith)); ++ BSON_ASSERT(bson_array_builder_append_document_end(pipeline, &stage)); ++ BSON_ASSERT(bson_append_array_builder_end(cmd, pipeline)); ++ mongocrypt_binary_t *bin = mongocrypt_binary_new_from_data((uint8_t *)bson_get_data(cmd), cmd->len); ++ mongocrypt_ctx_t *ctx = mongocrypt_ctx_new(crypt); ++ ASSERT_FAILS(mongocrypt_ctx_encrypt_init(ctx, "test", -1, bin), ++ ctx, ++ "'coll' collection name must not contain an embedded null byte"); ++ mongocrypt_ctx_destroy(ctx); ++ mongocrypt_binary_destroy(bin); ++ bson_destroy(cmd); ++ } ++ ++ mongocrypt_destroy(crypt); ++} ++ + static void _test_encrypt_need_collinfo(_mongocrypt_tester_t *tester) { + mongocrypt_t *crypt; + mongocrypt_ctx_t *ctx; +@@ -5796,6 +5909,7 @@ + void _mongocrypt_tester_install_ctx_encrypt(_mongocrypt_tester_t *tester) { + INSTALL_TEST(_test_explicit_encrypt_init); + INSTALL_TEST(_test_encrypt_init); ++ INSTALL_TEST(_test_encrypt_init_invalid_db_collection); + INSTALL_TEST(_test_encrypt_need_collinfo); + INSTALL_TEST(_test_encrypt_need_markings); + INSTALL_TEST(_test_encrypt_csfle_no_needs_markings); diff -Nru libmongocrypt-1.13.2/debian/patches/series libmongocrypt-1.13.2/debian/patches/series --- libmongocrypt-1.13.2/debian/patches/series 1969-12-31 19:00:00.000000000 -0500 +++ libmongocrypt-1.13.2/debian/patches/series 2026-08-29 11:20:33.000000000 -0400 @@ -0,0 +1 @@ +0001_CVE-2026-81523.patch
