--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:goaccess
User: [email protected]
Usertags: pu
[ Reason ]
This update includes 3 upstream patches fixing 3 CVEs published for
goaccess.
[ Impact ]
goaccess is a web server log analysis tool. Specially crafted requests
can explore those vulnerabilities and cause it to overwrite memory or
crash.
[ Tests ]
There is no regression in the (admittedly simple) autopkgtests.
[ Risks ]
The changes were cherry-picked from upstream, applied cleanly over the
trixie branch, and are very targeted and localized.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
The main change is adding 3 upstream patches cherry-picked from the
latest upstream release. The change to debian/salsa-ci.yml is necessary
to prevent a failure on Salsa CI related to uscan (debian/watch is fixed
in the sid/forky version of the package).
[ Other info ]
This was marked as no-DSA by the Security team so I'm going with a
stable update.
I'm attaching both the full diff against the version in trixie, and the
actual patches since those are easier to read than the diff-in-diff
version in the full diff.
diff --git c/debian/changelog w/debian/changelog
index 6a55b588..08592661 100644
--- c/debian/changelog
+++ w/debian/changelog
@@ -1,3 +1,17 @@
+goaccess (1:1.9.3-1+deb13u1) trixie; urgency=high
+
+ * Apply security updates (Closes: #1143181)
+ Includes fixes for the following vulnerabilities:
+ - CVE-2026-54715: Heap Out-of-Bounds Write in GoAccess `parse_browser()`
+ - CVE-2026-55768: GoAccess WebSocket server: signed 32 bit truncation of
+ the 64 bit frame length causes a remote pre authentication denial of
+ service
+ - CVE-2026-55777: Out-of-bounds heap read in parse_ios() via crafted
+ User-Agent (opesys.c:323) lead to remote crash/DoS
+ * debian/salsa-ci.yml: disable uscan test for this branch
+
+ -- Antonio Terceiro <[email protected]> Mon, 17 Aug 2026 18:49:23 -0300
+
goaccess (1:1.9.3-1) unstable; urgency=medium
* New upstream version 1.9.3
diff --git c/debian/patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch w/debian/patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch
new file mode 100644
index 00000000..c6f244ab
--- /dev/null
+++ w/debian/patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch
@@ -0,0 +1,37 @@
+From: Gerardo O <[email protected]>
+Date: Sun, 7 Jun 2026 23:13:31 -0500
+Subject: Fix heap buffer overflow in parse_browser() Opera handling
+
+Anchor the offset to the actual 'Opera' position and require the slash to be at
+or after the byte following it (op + 5 <= slh) so the destination can never run
+past the buffer's NUL terminator.
+
+(cherry picked from commit 81f90d9dafd6956c188dea9f944d24946d3d3351)
+---
+ src/browsers.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/browsers.c b/src/browsers.c
+index de0b56b..20f6fa7 100644
+--- a/src/browsers.c
++++ b/src/browsers.c
+@@ -525,7 +525,7 @@ check_http_crawler (const char *str) {
+ * Otherwise the parsed browser is returned. */
+ static char *
+ parse_browser (char *match, char *type, int i, char ***hash) {
+- char *b = NULL, *ptr = NULL, *slh = NULL;
++ char *b = NULL, *ptr = NULL, *slh = NULL, *op = NULL;
+ size_t cnt = 0, space = 0;
+
+ match = char_replace (match, '+', '-');
+@@ -547,8 +547,8 @@ parse_browser (char *match, char *type, int i, char ***hash) {
+ return parse_opera (slh);
+ }
+ /* Opera has the version number at the end */
+- if (strstr (match, "Opera") && (slh = strrchr (match, '/')) && match < slh) {
+- memmove (match + 5, slh, strlen (slh) + 1);
++ if ((op = strstr (match, "Opera")) && (slh = strrchr (match, '/')) && op + 5 <= slh) {
++ memmove (op + 5, slh, strlen (slh) + 1);
+ }
+ /* IE Old */
+ if (strstr (match, "MSIE") != NULL) {
diff --git c/debian/patches/0002-Tighten-websocket-payload-length-handling.patch w/debian/patches/0002-Tighten-websocket-payload-length-handling.patch
new file mode 100644
index 00000000..b22792a0
--- /dev/null
+++ w/debian/patches/0002-Tighten-websocket-payload-length-handling.patch
@@ -0,0 +1,46 @@
+From: Gerardo O <[email protected]>
+Date: Mon, 15 Jun 2026 16:56:06 -0500
+Subject: Tighten websocket payload length handling.
+
+(cherry picked from commit ea74b87254d0adc675c087ff49bddd2d60dc01d5)
+---
+ src/websocket.c | 5 ++++-
+ src/websocket.h | 2 +-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/src/websocket.c b/src/websocket.c
+index 8088921..8da1da9 100644
+--- a/src/websocket.c
++++ b/src/websocket.c
+@@ -2027,7 +2027,7 @@ ws_get_frm_header (WSClient *client) {
+ ws_set_payloadlen ((*frm), (*frm)->buf);
+ ws_set_masking_key ((*frm), (*frm)->buf);
+
+- if ((*frm)->payloadlen > wsconfig.max_frm_size) {
++ if ((*frm)->payloadlen > (uint64_t) wsconfig.max_frm_size) {
+ ws_error (client, WS_CLOSE_TOO_LARGE, "Frame is too big");
+ return ws_set_status (client, WS_ERR | WS_CLOSE, bytes);
+ }
+@@ -2049,6 +2049,9 @@ ws_realloc_frm_payload (WSFrame *frm, WSMessage *msg) {
+ uint64_t newlen = 0;
+
+ newlen = msg->payloadsz + frm->payloadlen;
++ if (newlen > (uint64_t) wsconfig.max_frm_size)
++ return 1;
++
+ tmp = realloc (msg->payload, newlen);
+ if (tmp == NULL && newlen > 0) {
+ free (msg->payload);
+diff --git a/src/websocket.h b/src/websocket.h
+index 2846d6b..bd575a0 100644
+--- a/src/websocket.h
++++ b/src/websocket.h
+@@ -195,7 +195,7 @@ typedef struct WSFrame_ {
+ unsigned char mask[4]; /* mask key */
+ uint8_t res; /* extensions */
+ int payload_offset; /* end of header/start of payload */
+- int payloadlen; /* payload length (for each frame) */
++ uint64_t payloadlen; /* payload length (for each frame) */
+
+ /* status flags */
+ int reading; /* still reading frame's header part? */
diff --git c/debian/patches/0003-Tighten-iOS-user-agent-parsing.patch w/debian/patches/0003-Tighten-iOS-user-agent-parsing.patch
new file mode 100644
index 00000000..21fc3f96
--- /dev/null
+++ w/debian/patches/0003-Tighten-iOS-user-agent-parsing.patch
@@ -0,0 +1,23 @@
+From: Gerardo O <[email protected]>
+Date: Mon, 15 Jun 2026 19:49:17 -0500
+Subject: Tighten iOS user agent parsing
+
+(cherry picked from commit ba813ed97d998dbdcb8d87e178799a4bb2da9e81)
+---
+ src/opesys.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/opesys.c b/src/opesys.c
+index f83d0c3..ca05690 100644
+--- a/src/opesys.c
++++ b/src/opesys.c
+@@ -303,7 +303,8 @@ parse_ios (char *agent, int tlen) {
+ goto out;
+
+ *q = 0;
+- memmove (agent + tlen, agent + offset, offset);
++ /* Move the version suffix to sit immediately after the matched keyword. */
++ memmove (agent + tlen, p, (size_t) (q - p) + 1);
+ return char_replace (agent, '_', '.');
+
+ out:
diff --git c/debian/patches/series w/debian/patches/series
new file mode 100644
index 00000000..6453687c
--- /dev/null
+++ w/debian/patches/series
@@ -0,0 +1,3 @@
+0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch
+0002-Tighten-websocket-payload-length-handling.patch
+0003-Tighten-iOS-user-agent-parsing.patch
diff --git c/debian/salsa-ci.yml w/debian/salsa-ci.yml
index 33c3a640..9a157201 100644
--- c/debian/salsa-ci.yml
+++ w/debian/salsa-ci.yml
@@ -2,3 +2,6 @@
include:
- https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
- https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml
+
+variables:
+ SALSA_CI_DISABLE_USCAN: 1
From: Gerardo O <[email protected]>
Date: Sun, 7 Jun 2026 23:13:31 -0500
Subject: Fix heap buffer overflow in parse_browser() Opera handling
Anchor the offset to the actual 'Opera' position and require the slash to be at
or after the byte following it (op + 5 <= slh) so the destination can never run
past the buffer's NUL terminator.
(cherry picked from commit 81f90d9dafd6956c188dea9f944d24946d3d3351)
---
src/browsers.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/src/browsers.c b/src/browsers.c
index de0b56b..20f6fa7 100644
--- a/src/browsers.c
+++ b/src/browsers.c
@@ -525,7 +525,7 @@ check_http_crawler (const char *str) {
* Otherwise the parsed browser is returned. */
static char *
parse_browser (char *match, char *type, int i, char ***hash) {
- char *b = NULL, *ptr = NULL, *slh = NULL;
+ char *b = NULL, *ptr = NULL, *slh = NULL, *op = NULL;
size_t cnt = 0, space = 0;
match = char_replace (match, '+', '-');
@@ -547,8 +547,8 @@ parse_browser (char *match, char *type, int i, char ***hash) {
return parse_opera (slh);
}
/* Opera has the version number at the end */
- if (strstr (match, "Opera") && (slh = strrchr (match, '/')) && match < slh) {
- memmove (match + 5, slh, strlen (slh) + 1);
+ if ((op = strstr (match, "Opera")) && (slh = strrchr (match, '/')) && op + 5 <= slh) {
+ memmove (op + 5, slh, strlen (slh) + 1);
}
/* IE Old */
if (strstr (match, "MSIE") != NULL) {
From: Gerardo O <[email protected]>
Date: Mon, 15 Jun 2026 16:56:06 -0500
Subject: Tighten websocket payload length handling.
(cherry picked from commit ea74b87254d0adc675c087ff49bddd2d60dc01d5)
---
src/websocket.c | 5 ++++-
src/websocket.h | 2 +-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/src/websocket.c b/src/websocket.c
index 8088921..8da1da9 100644
--- a/src/websocket.c
+++ b/src/websocket.c
@@ -2027,7 +2027,7 @@ ws_get_frm_header (WSClient *client) {
ws_set_payloadlen ((*frm), (*frm)->buf);
ws_set_masking_key ((*frm), (*frm)->buf);
- if ((*frm)->payloadlen > wsconfig.max_frm_size) {
+ if ((*frm)->payloadlen > (uint64_t) wsconfig.max_frm_size) {
ws_error (client, WS_CLOSE_TOO_LARGE, "Frame is too big");
return ws_set_status (client, WS_ERR | WS_CLOSE, bytes);
}
@@ -2049,6 +2049,9 @@ ws_realloc_frm_payload (WSFrame *frm, WSMessage *msg) {
uint64_t newlen = 0;
newlen = msg->payloadsz + frm->payloadlen;
+ if (newlen > (uint64_t) wsconfig.max_frm_size)
+ return 1;
+
tmp = realloc (msg->payload, newlen);
if (tmp == NULL && newlen > 0) {
free (msg->payload);
diff --git a/src/websocket.h b/src/websocket.h
index 2846d6b..bd575a0 100644
--- a/src/websocket.h
+++ b/src/websocket.h
@@ -195,7 +195,7 @@ typedef struct WSFrame_ {
unsigned char mask[4]; /* mask key */
uint8_t res; /* extensions */
int payload_offset; /* end of header/start of payload */
- int payloadlen; /* payload length (for each frame) */
+ uint64_t payloadlen; /* payload length (for each frame) */
/* status flags */
int reading; /* still reading frame's header part? */
From: Gerardo O <[email protected]>
Date: Mon, 15 Jun 2026 19:49:17 -0500
Subject: Tighten iOS user agent parsing
(cherry picked from commit ba813ed97d998dbdcb8d87e178799a4bb2da9e81)
---
src/opesys.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/opesys.c b/src/opesys.c
index f83d0c3..ca05690 100644
--- a/src/opesys.c
+++ b/src/opesys.c
@@ -303,7 +303,8 @@ parse_ios (char *agent, int tlen) {
goto out;
*q = 0;
- memmove (agent + tlen, agent + offset, offset);
+ /* Move the version suffix to sit immediately after the matched keyword. */
+ memmove (agent + tlen, p, (size_t) (q - p) + 1);
return char_replace (agent, '_', '.');
out:
signature.asc
Description: PGP signature
--- End Message ---
