From d90671fd26a5d95b327ac74b0218b69447aa7a26 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Tue, 25 Aug 2026 19:31:22 +0000 Subject: [PATCH 1/3] Patch ntp for CVE-2026-63388, CVE-2026-63387, CVE-2026-63385, CVE-2026-63384, CVE-2026-63383, CVE-2026-63382, CVE-2026-63381, CVE-2026-63379 --- SPECS/ntp/CVE-2026-63379.patch | 103 +++++++++++ SPECS/ntp/CVE-2026-63381.patch | 40 +++++ SPECS/ntp/CVE-2026-63382.patch | 310 +++++++++++++++++++++++++++++++++ SPECS/ntp/CVE-2026-63383.patch | 42 +++++ SPECS/ntp/CVE-2026-63384.patch | 54 ++++++ SPECS/ntp/CVE-2026-63385.patch | 46 +++++ SPECS/ntp/CVE-2026-63387.patch | 43 +++++ SPECS/ntp/CVE-2026-63388.patch | 138 +++++++++++++++ SPECS/ntp/ntp.spec | 21 ++- 9 files changed, 796 insertions(+), 1 deletion(-) create mode 100644 SPECS/ntp/CVE-2026-63379.patch create mode 100644 SPECS/ntp/CVE-2026-63381.patch create mode 100644 SPECS/ntp/CVE-2026-63382.patch create mode 100644 SPECS/ntp/CVE-2026-63383.patch create mode 100644 SPECS/ntp/CVE-2026-63384.patch create mode 100644 SPECS/ntp/CVE-2026-63385.patch create mode 100644 SPECS/ntp/CVE-2026-63387.patch create mode 100644 SPECS/ntp/CVE-2026-63388.patch diff --git a/SPECS/ntp/CVE-2026-63379.patch b/SPECS/ntp/CVE-2026-63379.patch new file mode 100644 index 00000000000..fa9db79beae --- /dev/null +++ b/SPECS/ntp/CVE-2026-63379.patch @@ -0,0 +1,103 @@ +From ccda1bf8a67beef6fe22fc7bb64a8bab334b5034 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 11:04:48 -0400 +Subject: [PATCH] http: Discard trailers. + +Previously, we would insert any trailers directly into the header +list. But this was incorrect, since trailers are not supposed to be +treated as normal headers. This behavior could lead to conflicting +interpretation between HTTP servers and proxies, and enable +different kinds of attacks. + +Fixes GHSA-2gmv-p5m7-98p6. + +Reported by @sebastianosrt. + +Tracking: X13. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636.patch +--- + sntp/libevent/http.c | 26 +++++++++++++++++++++----- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c +index 8428656..a146b39 100644 +--- a/sntp/libevent/http.c ++++ b/sntp/libevent/http.c +@@ -182,6 +182,10 @@ static evutil_socket_t create_bind_socket_nonblock(struct evutil_addrinfo *, int + static evutil_socket_t bind_socket(const char *, ev_uint16_t, int reuse); + static void name_from_addr(struct sockaddr *, ev_socklen_t, char **, char **); + static struct evhttp_uri *evhttp_uri_parse_authority(char *source_uri); ++static enum message_read_status evhttp_parse_headers_impl_( ++ struct evhttp_request *req, ++ struct evbuffer *buffer, ++ struct evkeyvalq *headers); + static int evhttp_associate_new_request_with_connection( + struct evhttp_connection *evcon); + static void evhttp_connection_start_detectclose( +@@ -998,8 +1002,10 @@ static void + evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) + { + struct evbuffer *buf = bufferevent_get_input(evcon->bufev); ++ struct evkeyvalq tmp_headers; ++ TAILQ_INIT(&tmp_headers); + +- switch (evhttp_parse_headers_(req, buf)) { ++ switch (evhttp_parse_headers_impl_(req, buf, &tmp_headers)) { + case DATA_CORRUPTED: + case DATA_TOO_LONG: + evhttp_connection_fail_(evcon, EVREQ_HTTP_DATA_TOO_LONG); +@@ -1013,6 +1019,8 @@ evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) + default: + break; + } ++ ++ evhttp_clear_headers(&tmp_headers); + } + + static void +@@ -2117,14 +2125,17 @@ evhttp_append_to_last_header(struct evkeyvalq *headers, char *line) + return (0); + } + +-enum message_read_status +-evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) ++/* As `evhttp_parse_headers_`, but put any headers we find into `headers`. */ ++static enum message_read_status ++evhttp_parse_headers_impl_( ++ struct evhttp_request *req, ++ struct evbuffer *buffer, ++ struct evkeyvalq *headers) + { + enum message_read_status errcode = DATA_CORRUPTED; + char *line; + enum message_read_status status = MORE_DATA_EXPECTED; + +- struct evkeyvalq* headers = req->input_headers; + size_t len; + while ((line = evbuffer_readln(buffer, &len, EVBUFFER_EOL_CRLF)) + != NULL) { +@@ -2180,7 +2191,6 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) + return (errcode); + } + +- + /* Return true if 'ch' is a single linear WS character (per the HTTP spec). + * We reject CR and LF elsewhere. */ + #define IS_LWS(ch) \ +@@ -2301,6 +2311,12 @@ evhttp_validate_len_and_encoding_(struct evhttp_request *req) + } + + ++enum message_read_status ++evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer *buffer) ++{ ++ return evhttp_parse_headers_impl_(req, buffer, req->input_headers); ++} ++ + static int + evhttp_get_body_length(struct evhttp_request *req) + { +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63381.patch b/SPECS/ntp/CVE-2026-63381.patch new file mode 100644 index 00000000000..38a71854dc5 --- /dev/null +++ b/SPECS/ntp/CVE-2026-63381.patch @@ -0,0 +1,40 @@ +From fb1f037d829a7dd74f6a535c622ae17fca8ffc86 Mon Sep 17 00:00:00 2001 +From: Alexis +Date: Tue, 9 Jun 2026 15:09:05 +0200 +Subject: [PATCH] Fix a dangling pointer in evbuffer_add_buffer_reference. + +If `evbuffer_add_buffer_reference` was called to add a reference to +an empty buffer, the resulting code would produce dangling pointers +that could later lead to a use-after-free. + +Fixes GHSA-c2pj-cg4r-88c8. + +Tracking: X8. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c.patch +--- + sntp/libevent/buffer.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sntp/libevent/buffer.c b/sntp/libevent/buffer.c +index 3524b35..f68f31c 100644 +--- a/sntp/libevent/buffer.c ++++ b/sntp/libevent/buffer.c +@@ -1038,8 +1038,13 @@ evbuffer_add_buffer_reference(struct evbuffer *outbuf, struct evbuffer *inbuf) + + if (out_total_len == 0) { + /* There might be an empty chain at the start of outbuf; free +- * it. */ ++ * it. Reset the chain pointers afterwards so the subsequent ++ * APPEND_CHAIN_MULTICAST does not dereference the freed chain ++ * through outbuf->first / last_with_datap. */ + evbuffer_free_all_chains(outbuf->first); ++ outbuf->first = NULL; ++ outbuf->last = NULL; ++ outbuf->last_with_datap = &outbuf->first; + } + APPEND_CHAIN_MULTICAST(outbuf, inbuf); + +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63382.patch b/SPECS/ntp/CVE-2026-63382.patch new file mode 100644 index 00000000000..3ab95aaf7f1 --- /dev/null +++ b/SPECS/ntp/CVE-2026-63382.patch @@ -0,0 +1,310 @@ +From 5fcbb539abe9715994bfb76b4d57f46341bb310d Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 08:32:25 -0400 +Subject: [PATCH 1/2] http: Treat CRLF strictly in HTTP chunks. + +According to RFC 9112, we can't treat LF alone as a terminator in +the chunked encoding. + +Reported by @xclow3n + +Part of GHSA-q39v-w2g7-gr8j + +Tracking: X11 +--- + sntp/libevent/http.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c +index 4400abb..474d8c2 100644 +--- a/sntp/libevent/http.c ++++ b/sntp/libevent/http.c +@@ -925,7 +925,7 @@ evhttp_handle_chunked_read(struct evhttp_request *req, struct evbuffer *buf) + if (req->ntoread < 0) { + /* Read chunk size */ + ev_int64_t ntoread; +- char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF); ++ char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF_STRICT); + char *endp; + int error; + if (p == NULL) +-- +2.45.4 + + +From 2b8fd75033a99f90ba5e6ee0cb7b92dd22d0d01c Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 10:37:46 -0400 +Subject: [PATCH 2/2] http: Tighten acceptable headers to prevent request + smuggling. + +Previously, we accepted a wider variety of combinations of +Content-Length and Transfer-Encoding, and we didn't parse +Transfer-Encoding according to the full rules of the relevant RFC. +This made evhttp interpret these headers in a +non-standards-compliant way that had the potential to differ from +a more compliant proxy or HTTP server. Thus, when used _as_ an +HTTP proxy, evhttp had the potential to enable http smuggling +attacks. + +Fixes GHSA-q39v-w2g7-gr8j. + +Originally reported by @xclow3n; and then by @kodareef5, +@nstaller0490, @AsafMeizneer, and @yaotushaozhu (in that order). + +(Note that this fix assumes that we have _also_ disabled support for +CR and LF in header lines.) + +Tracking: X12. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6.patch https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0.patch +--- + sntp/libevent/http-internal.h | 14 +++ + sntp/libevent/http.c | 164 ++++++++++++++++++++++++++++++++-- + 2 files changed, 172 insertions(+), 6 deletions(-) + +diff --git a/sntp/libevent/http-internal.h b/sntp/libevent/http-internal.h +index feaf436..4d52504 100644 +--- a/sntp/libevent/http-internal.h ++++ b/sntp/libevent/http-internal.h +@@ -185,6 +185,20 @@ EVENT2_EXPORT_SYMBOL + void evhttp_connection_fail_(struct evhttp_connection *, + enum evhttp_request_error error); + ++enum evhttp_transfer_encoding_header_status { ++ /* This Transfer-Encoding line was invalid. ++ * (We consider all "chunked" encodings invalid except those at the end ++ * of the sequence.) */ ++ TE_INVALID, ++ /* This Transfer-Encoding line ended with the "chunked" encoding. */ ++ TE_ENDS_IN_CHUNKED, ++ /* This Transfer-Encoding line was valid and did not contain "chunked" */ ++ TE_NO_CHUNKED, ++}; ++int evhttp_str_is_chunked_(const char *value, const char *eos); ++enum evhttp_transfer_encoding_header_status ++evhttp_check_transfer_encoding_(const char *value); ++ + enum message_read_status; + + EVENT2_EXPORT_SYMBOL +diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c +index 474d8c2..8428656 100644 +--- a/sntp/libevent/http.c ++++ b/sntp/libevent/http.c +@@ -123,7 +123,6 @@ + #ifndef NI_NUMERICSERV + #define NI_NUMERICSERV 2 + #endif +- + static int + fake_getnameinfo(const struct sockaddr *sa, size_t salen, char *host, + size_t hostlen, char *serv, size_t servlen, int flags) +@@ -163,6 +162,8 @@ fake_getnameinfo(const struct sockaddr *sa, size_t salen, char *host, + + #endif + ++static int evhttp_validate_len_and_encoding_(struct evhttp_request *req); ++ + #define REQ_VERSION_BEFORE(req, major_v, minor_v) \ + ((req)->major < (major_v) || \ + ((req)->major == (major_v) && (req)->minor < (minor_v))) +@@ -1908,6 +1909,32 @@ evhttp_find_header(const struct evkeyvalq *headers, const char *key) + return (NULL); + } + ++/* Like evhttp_find_header, but set *duplicate to 1 if the header appears ++ * more than once, and to 0 otherwise. ++ */ ++static const char * ++evhttp_find_unique_header(const struct evkeyvalq *headers, const char *key, ++ int *duplicate) ++{ ++ const char *result = NULL; ++ struct evkeyval *header; ++ ++ *duplicate = 0; ++ ++ TAILQ_FOREACH(header, headers, next) { ++ if (evutil_ascii_strcasecmp(header->key, key) == 0) { ++ if (result == NULL) { ++ result = header->value; ++ } else { ++ *duplicate = 1; ++ break; ++ } ++ } ++ } ++ ++ return (result); ++} ++ + void + evhttp_clear_headers(struct evkeyvalq *headers) + { +@@ -2153,6 +2180,127 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) + return (errcode); + } + ++ ++/* Return true if 'ch' is a single linear WS character (per the HTTP spec). ++ * We reject CR and LF elsewhere. */ ++#define IS_LWS(ch) \ ++ (((ch) == ' ' ) || ((ch) == '\t')) ++ ++/* Returns true when the string beginning at `value` and ending at `eos` ++ * (non-inclusive) is a `transfer-coding` "chunked". Case insensitive. ++ */ ++int ++evhttp_str_is_chunked_(const char *value, const char *eos) ++{ ++ /* the end of the encoding. */ ++ const char *end; ++ ++ if (eos == NULL) { ++ eos = value + strlen(value); ++ } ++ ++ while (value < eos && IS_LWS(*value)) { ++ ++value; ++ } ++ end = value; ++ /* A transfer-coding can end with OWS ; OWS to indicate a ++ * transfer-parameter. (See RFC 9110) ++ */ ++ while (end < eos && !IS_LWS(*end) && *end != ';') { ++ ++end; ++ } ++ ++ return (end - value) == strlen("chunked") ++ && evutil_ascii_strncasecmp(value, "chunked", strlen("chunked")) == 0; ++} ++ ++/* Check a single Transfer-Encoding header value. ++ * ++ * Returns an evhttp_transfer_encoding_header_status value depending ++ * on its contents. ++ */ ++enum evhttp_transfer_encoding_header_status ++evhttp_check_transfer_encoding_(const char *value) ++{ ++ const char *comma; ++ ++ while ((comma = strchr(value, ',')) != NULL) { ++ if (evhttp_str_is_chunked_(value, comma)) { ++ /* If we find that an encoding is chunked ++ * and it is followed by a comma, it is not the final ++ * encoding ++ */ ++ return TE_INVALID; ++ } ++ value = comma + 1; ++ } ++ ++ if (evhttp_str_is_chunked_(value, NULL)) { ++ return TE_ENDS_IN_CHUNKED; ++ } else { ++ return TE_NO_CHUNKED; ++ } ++} ++ ++ ++/* Return 0 if the Transfer-Encoding and Content-Length heeaders appear to be consistent, ++ * and -1 otherwise. ++ * ++ * Sets "req->chunked" if appropriate. ++ * ++ * Used to prevent request smuggling. ++ */ ++static int ++evhttp_validate_len_and_encoding_(struct evhttp_request *req) ++{ ++ struct evkeyvalq *headers = req->input_headers; ++ struct evkeyval *h = NULL; ++ int is_chunked = 0; ++ int dup_cl = 0; ++ ++ if (evhttp_find_header(headers, "Transfer-Encoding") != NULL && ++ evhttp_find_unique_header(headers, "Content-Length", &dup_cl) != NULL) { ++ /* Both TE and CL were present: Not allowed. */ ++ return -1; ++ } ++ if (dup_cl) { ++ /* CL was present twice: Not allowed. ++ * (Technically we can permit this if the values are the same, ++ * but we don't.) */ ++ return -1; ++ } ++ ++ /* Now walk through the Transfer-Encoding headers. */ ++ TAILQ_FOREACH(h, headers, next) { ++ if (evutil_ascii_strcasecmp(h->key, "Transfer-Encoding") == 0) { ++ if (is_chunked) { ++ /* We already encountered a chunked ++ encoding; no further encodings are allowed */ ++ return -1; ++ } ++ ++ switch (evhttp_check_transfer_encoding_(h->value)) ++ { ++ case TE_INVALID: ++ /* We found "chunked" somewhere not at the end. */ ++ return -1; ++ case TE_ENDS_IN_CHUNKED: ++ /* We found chunked at the end. */ ++ is_chunked = 1; ++ break; ++ case TE_NO_CHUNKED: ++ /* "chunked" didn't appear; this is fine. */ ++ break; ++ } ++ } ++ } ++ ++ req->chunked = is_chunked; ++ ++ return 0; ++} ++ ++ + static int + evhttp_get_body_length(struct evhttp_request *req) + { +@@ -2212,8 +2360,6 @@ evhttp_method_may_have_body(enum evhttp_cmd_type type) + static void + evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) + { +- const char *xfer_enc; +- + /* If this is a request without a body, then we are done */ + if (req->kind == EVHTTP_REQUEST && + !evhttp_method_may_have_body(req->type)) { +@@ -2221,9 +2367,8 @@ evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) + return; + } + evcon->state = EVCON_READING_BODY; +- xfer_enc = evhttp_find_header(req->input_headers, "Transfer-Encoding"); +- if (xfer_enc != NULL && evutil_ascii_strcasecmp(xfer_enc, "chunked") == 0) { +- req->chunked = 1; ++ ++ if (req->chunked) { + req->ntoread = -1; + } else { + if (evhttp_get_body_length(req) == -1) { +@@ -2309,6 +2454,13 @@ evhttp_read_header(struct evhttp_connection *evcon, + return; + } + ++ if (evhttp_validate_len_and_encoding_(req) < 0) { ++ event_debug(("%s: bad combination of headers on "EV_SOCK_FMT"\n", ++ __func__, EV_SOCK_ARG(fd))); ++ evhttp_connection_fail_(evcon, EVREQ_HTTP_INVALID_HEADER); ++ return; ++ } ++ + /* Callback can shut down connection with negative return value */ + if (req->header_cb != NULL) { + if ((*req->header_cb)(req, req->cb_arg) < 0) { +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63383.patch b/SPECS/ntp/CVE-2026-63383.patch new file mode 100644 index 00000000000..ed0f62362c2 --- /dev/null +++ b/SPECS/ntp/CVE-2026-63383.patch @@ -0,0 +1,42 @@ +From 51fb2062327ee48192fe82c1f17963196dfa5185 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:53:23 -0400 +Subject: [PATCH] evrpc: Fix out-of-bounds read in decode_tag_internal + +This bug could allow an attacker to cause an evrpc client or server +to read out of bounds when decoding a tag. + +Fixes GHSA-fj29-64w6-73h6. + +Reported by @Brubbish. + +Tracking: X5. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb.patch +--- + sntp/libevent/event_tagging.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sntp/libevent/event_tagging.c b/sntp/libevent/event_tagging.c +index 790dff3..9ee642b 100644 +--- a/sntp/libevent/event_tagging.c ++++ b/sntp/libevent/event_tagging.c +@@ -210,12 +210,13 @@ decode_tag_internal(ev_uint32_t *ptag, struct evbuffer *evbuf, int dodrain) + * the encoding of a number is at most one byte more than its + * storage size. however, it may also be much smaller. + */ ++ size_t pullup_len = len < sizeof(number) + 1 ? len : sizeof(number) + 1; + data = evbuffer_pullup( +- evbuf, len < sizeof(number) + 1 ? len : sizeof(number) + 1); ++ evbuf, pullup_len); + if (!data) + return (-1); + +- while (count++ < len) { ++ while (count++ < pullup_len) { + ev_uint8_t lower = *data++; + if (shift >= 28) { + /* Make sure it fits into 32 bits */ +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63384.patch b/SPECS/ntp/CVE-2026-63384.patch new file mode 100644 index 00000000000..cc785267b6c --- /dev/null +++ b/SPECS/ntp/CVE-2026-63384.patch @@ -0,0 +1,54 @@ +From 6a098eae9f848b346cab7ac4634e143c9af1fee4 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 10:08:22 -0400 +Subject: [PATCH] evrpc: Fix integer overflow in evtag_unmarshal_header. + +On platforms where int is 32 bits, if this function tried to decode +a header declaring a payload longer than INT_MAX bytes long, this +function would return a negative value, which could cause incorrect +behaviors, incorrect allocations, or denial-of-service. + +We solve this (for now) by rejecting any payload length larger +than INT_MAX. + +Fixes GHSA-45c6-qx49-89m8 + +Reported by @Brubbish + +Tracking: X5 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416.patch +--- + sntp/libevent/event_tagging.c | 2 +- + sntp/libevent/include/event2/tag.h | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sntp/libevent/event_tagging.c b/sntp/libevent/event_tagging.c +index b021e8c..790dff3 100644 +--- a/sntp/libevent/event_tagging.c ++++ b/sntp/libevent/event_tagging.c +@@ -445,7 +445,7 @@ evtag_unmarshal_header(struct evbuffer *evbuf, ev_uint32_t *ptag) + + if (decode_tag_internal(ptag, evbuf, 1 /* dodrain */) == -1) + return (-1); +- if (evtag_decode_int(&len, evbuf) == -1) ++ if (evtag_decode_int(&len, evbuf) == -1 || len > INT_MAX) + return (-1); + + if (evbuffer_get_length(evbuf) < len) +diff --git a/sntp/libevent/include/event2/tag.h b/sntp/libevent/include/event2/tag.h +index 2f73bfc..ac13049 100644 +--- a/sntp/libevent/include/event2/tag.h ++++ b/sntp/libevent/include/event2/tag.h +@@ -64,6 +64,8 @@ void evtag_init(void); + /** + Unmarshals the header and returns the length of the payload + ++ Returns an error if the payload length is above INT_MAX. ++ + @param evbuf the buffer from which to unmarshal data + @param ptag a pointer in which the tag id is being stored + @returns -1 on failure or the number of bytes in the remaining payload. +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63385.patch b/SPECS/ntp/CVE-2026-63385.patch new file mode 100644 index 00000000000..3e7dc4a84aa --- /dev/null +++ b/SPECS/ntp/CVE-2026-63385.patch @@ -0,0 +1,46 @@ +From 1655dd6b0a7b72d1e0a16399a95c418526338e00 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 09:08:47 -0400 +Subject: [PATCH] http: Reject headers containing CRLF. + +This causes us to reject obfs-fold, which is deprecated in RFC 9112. + +Otherwise, we would have a header injection opportunity for +certain proxy chains. + +Reported by @AsafMeizner + +Part of GHSA-jcwh-pvf2-73p2 + +Tracking: X10. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2.patch +--- + sntp/libevent/http.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c +index 516f6f9..4400abb 100644 +--- a/sntp/libevent/http.c ++++ b/sntp/libevent/http.c +@@ -1955,13 +1955,11 @@ evhttp_header_is_valid_value(const char *value) + { + const char *p = value; + +- while ((p = strpbrk(p, "\r\n")) != NULL) { +- /* we really expect only one new line */ +- p += strspn(p, "\r\n"); +- /* we expect a space or tab for continuation */ +- if (*p != ' ' && *p != '\t') +- return (0); ++ if (strpbrk(p, "\r\n") != NULL) { ++ /* Reject any header containing CR or LF. */ ++ return (0); + } ++ + return (1); + } + +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63387.patch b/SPECS/ntp/CVE-2026-63387.patch new file mode 100644 index 00000000000..03dcf832cd9 --- /dev/null +++ b/SPECS/ntp/CVE-2026-63387.patch @@ -0,0 +1,43 @@ +From 42141e2ab363c9343291d80929df85d8ed0f65d5 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:08:43 -0400 +Subject: [PATCH] evdns: Fix out-of-bounds write in dnsname_to_labels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This bug would cause the program to write a single 0 byte off the +end of a stack buffer, if the code ever tried to make a DNS response +exactly 2^16 + 1 bytes long, ending with a DNS name. + +Resolves issue GHSA-58rx-7448-jw47. + +This issue was identified by Michał Majchrowicz and +Marcin Wyczechowski, members of the AFINE Team. + +Tracking: X1 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/377b9022c3ac61aa4540b5dc4b70c60bf74c663d.patch +--- + sntp/libevent/evdns.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sntp/libevent/evdns.c b/sntp/libevent/evdns.c +index a5b31a3..8ddff8b 100644 +--- a/sntp/libevent/evdns.c ++++ b/sntp/libevent/evdns.c +@@ -1671,7 +1671,10 @@ dnsname_to_labels(u8 *const buf, size_t buf_len, off_t j, + /* the labels must be terminated by a 0. */ + /* It's possible that the name ended in a . */ + /* in which case the zero is already there */ +- if (!j || buf[j-1]) buf[j++] = 0; ++ if ((size_t)j >= buf_len) ++ return -2; ++ if (!j || buf[j-1]) ++ buf[j++] = 0; + return j; + overflow: + return (-2); +-- +2.45.4 + diff --git a/SPECS/ntp/CVE-2026-63388.patch b/SPECS/ntp/CVE-2026-63388.patch new file mode 100644 index 00000000000..335be48997b --- /dev/null +++ b/SPECS/ntp/CVE-2026-63388.patch @@ -0,0 +1,138 @@ +From 011eb622b69f995c7d7a611e923f406d3747824e Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:33:02 -0400 +Subject: [PATCH] bufferevent: Fix heap out-of-bounds write via + AF_UNIX+http+NDEBUG + +When running an evhttp server over an AF_UNIX socket, +on a copy of libevent compiled with NDEBUG, +it was possible for an attacker to use a crafted AF_UNIX address to +cause a heap overflow when recording the address. + +This issue could also be triggered by direct calls +to the internal function bufferevent_socket_set_conn_address_ +on a copy of libevent compiled with NDEBUG. + +This bug still affected copies of libevent compiled without NDEBUG: +except that under those conditions, it would cause an assertion +failure with an abort() rather than a heap overflow. + +As a fix: + - We check the length of the provided address unconditionally + (regardless of NDEBUG) + - We handle failures caused by the provided address being too long. + - We allocate enough room to store an AF_UNIX address. + +Resolves GHSA-cvq5-vrvr-j338. + +Reported by @mat-mo. + +Tracking: X3 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72.patch +--- + sntp/libevent/bufferevent-internal.h | 11 ++++++----- + sntp/libevent/bufferevent_sock.c | 17 ++++++++++++----- + sntp/libevent/http.c | 4 +++- + 3 files changed, 21 insertions(+), 11 deletions(-) + +diff --git a/sntp/libevent/bufferevent-internal.h b/sntp/libevent/bufferevent-internal.h +index 87ab9ad..dfb6384 100644 +--- a/sntp/libevent/bufferevent-internal.h ++++ b/sntp/libevent/bufferevent-internal.h +@@ -34,6 +34,7 @@ extern "C" { + #include "event2/event_struct.h" + #include "evconfig-private.h" + #include "event2/util.h" ++#include "util-internal.h" + #include "defer-internal.h" + #include "evthread-internal.h" + #include "event2/thread.h" +@@ -224,10 +225,10 @@ struct bufferevent_private { + * So we need to save it, just after we connected to remote server, or + * after resolving (to avoid extra dns requests during retrying, since UDP + * is slow) */ +- union { +- struct sockaddr_in6 in6; +- struct sockaddr_in in; +- } conn_address; ++ /* NOTE: it might be nice to use fewer bytes here, but we need to store ++ * sockaddr_un sometimes in order to make AF_UNIX sockets work as expected ++ * with sntp/libevent/http.c. */ ++ struct sockaddr_storage conn_address; + + struct evdns_getaddrinfo_request *dns_request; + }; +@@ -449,7 +450,7 @@ void + bufferevent_socket_set_conn_address_fd_(struct bufferevent *bev, evutil_socket_t fd); + + EVENT2_EXPORT_SYMBOL +-void ++int + bufferevent_socket_set_conn_address_(struct bufferevent *bev, struct sockaddr *addr, size_t addrlen); + + +diff --git a/sntp/libevent/bufferevent_sock.c b/sntp/libevent/bufferevent_sock.c +index f40a8d9..543fce4 100644 +--- a/sntp/libevent/bufferevent_sock.c ++++ b/sntp/libevent/bufferevent_sock.c +@@ -116,13 +116,17 @@ bufferevent_socket_set_conn_address_fd_(struct bufferevent *bev, + getpeername(fd, addr, &len); + } + +-void ++int + bufferevent_socket_set_conn_address_(struct bufferevent *bev, + struct sockaddr *addr, size_t addrlen) + { + struct bufferevent_private *bev_p = BEV_UPCAST(bev); +- EVUTIL_ASSERT(addrlen <= sizeof(bev_p->conn_address)); +- memcpy(&bev_p->conn_address, addr, addrlen); ++ if (addrlen <= sizeof(bev_p->conn_address)) { ++ memcpy(&bev_p->conn_address, addr, addrlen); ++ return 0; ++ } else { ++ return EVUTIL_EAI_FAIL; ++ } + } + + static void +@@ -472,6 +476,11 @@ bufferevent_connect_getaddrinfo_cb(int result, struct evutil_addrinfo *ai, + bufferevent_decref_and_unlock_(bev); + return; + } ++ if (result == 0) { ++ /* XXX use the other addrinfos? */ ++ result = bufferevent_socket_set_conn_address_( ++ bev, ai->ai_addr, (int)ai->ai_addrlen); ++ } + if (result != 0) { + bev_p->dns_error = result; + bufferevent_run_eventcb_(bev, BEV_EVENT_ERROR, 0); +@@ -481,8 +490,6 @@ bufferevent_connect_getaddrinfo_cb(int result, struct evutil_addrinfo *ai, + return; + } + +- /* XXX use the other addrinfos? */ +- bufferevent_socket_set_conn_address_(bev, ai->ai_addr, (int)ai->ai_addrlen); + r = bufferevent_socket_connect(bev, ai->ai_addr, (int)ai->ai_addrlen); + if (r < 0) + bufferevent_run_eventcb_(bev, BEV_EVENT_ERROR, 0); +diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c +index 04f089b..516f6f9 100644 +--- a/sntp/libevent/http.c ++++ b/sntp/libevent/http.c +@@ -4273,7 +4273,9 @@ evhttp_get_request_connection( + goto err; + if (bufferevent_disable(evcon->bufev, EV_WRITE)) + goto err; +- bufferevent_socket_set_conn_address_(evcon->bufev, sa, salen); ++ if (bufferevent_socket_set_conn_address_(evcon->bufev, sa, salen)) { ++ goto err; ++ } + + return (evcon); + +-- +2.45.4 + diff --git a/SPECS/ntp/ntp.spec b/SPECS/ntp/ntp.spec index 9c99d30c37c..d71641cbebf 100644 --- a/SPECS/ntp/ntp.spec +++ b/SPECS/ntp/ntp.spec @@ -1,7 +1,7 @@ Summary: Network Time Protocol reference implementation Name: ntp Version: 4.2.8p17 -Release: 2%{?dist} +Release: 3%{?dist} License: BSD AND GPLv2+ AND LGPLv2+ AND MIT AND OpenLDAP AND Public Domain Vendor: Microsoft Corporation Distribution: Azure Linux @@ -17,6 +17,14 @@ Source5: ntpdate.sysconfig Source6: ntpdate.service Source7: ntpd.service Source8: LICENSE.PTR +Patch0: CVE-2026-63379.patch +Patch1: CVE-2026-63381.patch +Patch2: CVE-2026-63382.patch +Patch3: CVE-2026-63383.patch +Patch4: CVE-2026-63384.patch +Patch5: CVE-2026-63385.patch +Patch6: CVE-2026-63387.patch +Patch7: CVE-2026-63388.patch BuildRequires: gcc >= 11.2.0 BuildRequires: glibc >= 2.34 @@ -62,6 +70,14 @@ state of the NTP daemon running on the local machine. %prep %setup -q -a 1 +%patch 0 -p1 +%patch 1 -p1 +%patch 2 -p1 +%patch 3 -p1 +%patch 4 -p1 +%patch 5 -p1 +%patch 6 -p1 +%patch 7 -p1 %build @@ -197,6 +213,9 @@ fi %{_mandir}/man8/ntpstat.8* %changelog +* Tue Aug 25 2026 Azure Linux Security Servicing Account - 4.2.8p17-3 +- Patch for CVE-2026-63388, CVE-2026-63387, CVE-2026-63385, CVE-2026-63384, CVE-2026-63383, CVE-2026-63382, CVE-2026-63381, CVE-2026-63379 + * Tue Mar 17 2026 Sudipta Pandit - 4.2.8p17-2 - Fix ntpdate-wrapper to use /usr/bin/ntpdate From 1bb4bcf4a073127fb4d4bf1a4897c779e548c423 Mon Sep 17 00:00:00 2001 From: BinduSri-6522866 Date: Wed, 26 Aug 2026 08:13:26 +0000 Subject: [PATCH 2/3] manually applied patches --- SPECS/ntp/CVE-2026-63379.patch | 32 +++----- SPECS/ntp/CVE-2026-63381.patch | 65 ++++++++++++++-- SPECS/ntp/CVE-2026-63382.patch | 133 ++++++++++++++++++++------------- SPECS/ntp/CVE-2026-63385.patch | 30 ++++++-- SPECS/ntp/ntp.spec | 10 +-- 5 files changed, 177 insertions(+), 93 deletions(-) diff --git a/SPECS/ntp/CVE-2026-63379.patch b/SPECS/ntp/CVE-2026-63379.patch index fa9db79beae..11b25d48ab7 100644 --- a/SPECS/ntp/CVE-2026-63379.patch +++ b/SPECS/ntp/CVE-2026-63379.patch @@ -1,4 +1,4 @@ -From ccda1bf8a67beef6fe22fc7bb64a8bab334b5034 Mon Sep 17 00:00:00 2001 +From 87e8e44fa774e9677b089b1a5114ee68aefa1636 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Fri, 26 Jun 2026 11:04:48 -0400 Subject: [PATCH] http: Discard trailers. @@ -14,17 +14,16 @@ Fixes GHSA-2gmv-p5m7-98p6. Reported by @sebastianosrt. Tracking: X13. -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636.patch +Upstream Patch reference: https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636.patch --- - sntp/libevent/http.c | 26 +++++++++++++++++++++----- - 1 file changed, 21 insertions(+), 5 deletions(-) + sntp/libevent/http.c | 26 ++++++++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c -index 8428656..a146b39 100644 +index 04f089b..e96ce0b 100644 --- a/sntp/libevent/http.c +++ b/sntp/libevent/http.c -@@ -182,6 +182,10 @@ static evutil_socket_t create_bind_socket_nonblock(struct evutil_addrinfo *, int +@@ -181,6 +181,10 @@ static evutil_socket_t create_bind_socket_nonblock(struct evutil_addrinfo *, int static evutil_socket_t bind_socket(const char *, ev_uint16_t, int reuse); static void name_from_addr(struct sockaddr *, ev_socklen_t, char **, char **); static struct evhttp_uri *evhttp_uri_parse_authority(char *source_uri); @@ -35,7 +34,7 @@ index 8428656..a146b39 100644 static int evhttp_associate_new_request_with_connection( struct evhttp_connection *evcon); static void evhttp_connection_start_detectclose( -@@ -998,8 +1002,10 @@ static void +@@ -997,8 +1001,10 @@ static void evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) { struct evbuffer *buf = bufferevent_get_input(evcon->bufev); @@ -47,7 +46,7 @@ index 8428656..a146b39 100644 case DATA_CORRUPTED: case DATA_TOO_LONG: evhttp_connection_fail_(evcon, EVREQ_HTTP_DATA_TOO_LONG); -@@ -1013,6 +1019,8 @@ evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) +@@ -1012,6 +1018,8 @@ evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) default: break; } @@ -56,7 +55,7 @@ index 8428656..a146b39 100644 } static void -@@ -2117,14 +2125,17 @@ evhttp_append_to_last_header(struct evkeyvalq *headers, char *line) +@@ -2092,14 +2100,17 @@ evhttp_append_to_last_header(struct evkeyvalq *headers, char *line) return (0); } @@ -77,18 +76,11 @@ index 8428656..a146b39 100644 size_t len; while ((line = evbuffer_readln(buffer, &len, EVBUFFER_EOL_CRLF)) != NULL) { -@@ -2180,7 +2191,6 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) +@@ -2155,6 +2166,13 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) return (errcode); } -- - /* Return true if 'ch' is a single linear WS character (per the HTTP spec). - * We reject CR and LF elsewhere. */ - #define IS_LWS(ch) \ -@@ -2301,6 +2311,12 @@ evhttp_validate_len_and_encoding_(struct evhttp_request *req) - } - - ++ +enum message_read_status +evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer *buffer) +{ @@ -99,5 +91,5 @@ index 8428656..a146b39 100644 evhttp_get_body_length(struct evhttp_request *req) { -- -2.45.4 +2.43.0 diff --git a/SPECS/ntp/CVE-2026-63381.patch b/SPECS/ntp/CVE-2026-63381.patch index 38a71854dc5..ee82ad10d74 100644 --- a/SPECS/ntp/CVE-2026-63381.patch +++ b/SPECS/ntp/CVE-2026-63381.patch @@ -1,4 +1,4 @@ -From fb1f037d829a7dd74f6a535c622ae17fca8ffc86 Mon Sep 17 00:00:00 2001 +From 5cb95ba2f804f8aff46f88d58391c71e1251cd1c Mon Sep 17 00:00:00 2001 From: Alexis Date: Tue, 9 Jun 2026 15:09:05 +0200 Subject: [PATCH] Fix a dangling pointer in evbuffer_add_buffer_reference. @@ -10,11 +10,11 @@ that could later lead to a use-after-free. Fixes GHSA-c2pj-cg4r-88c8. Tracking: X8. -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c.patch +Upstream Patch reference: https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c.patch --- - sntp/libevent/buffer.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) + sntp/libevent/buffer.c | 7 +++++- + sntp/libevent/test/regress_buffer.c | 35 +++++++++++++++++++++++++++++ + 2 files changed, 41 insertions(+), 1 deletion(-) diff --git a/sntp/libevent/buffer.c b/sntp/libevent/buffer.c index 3524b35..f68f31c 100644 @@ -35,6 +35,59 @@ index 3524b35..f68f31c 100644 } APPEND_CHAIN_MULTICAST(outbuf, inbuf); +diff --git a/sntp/libevent/test/regress_buffer.c b/sntp/libevent/test/regress_buffer.c +index f259b92..e1dc9bd 100644 +--- a/sntp/libevent/test/regress_buffer.c ++++ b/sntp/libevent/test/regress_buffer.c +@@ -2227,6 +2227,40 @@ end: + evbuffer_free(buf2); + } + ++static void ++test_evbuffer_multicast_empty_chain(void *ptr) ++{ ++ const char chunk[] = "If you have found the answer to such a problem"; ++ size_t len = strlen(chunk); ++ ++ struct evbuffer *buf1 = NULL, *buf2 = NULL; ++ ++ buf1 = evbuffer_new(); ++ tt_assert(buf1); ++ buf2 = evbuffer_new(); ++ tt_assert(buf2); ++ ++ evbuffer_add_reference(buf2, "", 0, NULL, NULL); ++ evbuffer_validate(buf2); ++ tt_int_op(evbuffer_get_length(buf2), ==, 0); ++ ++ evbuffer_add(buf1, chunk, len); ++ evbuffer_validate(buf1); ++ ++ tt_int_op(evbuffer_add_buffer_reference(buf2, buf1), ==, 0); ++ evbuffer_validate(buf2); ++ tt_int_op(evbuffer_get_length(buf2), ==, len); ++ ++ tt_assert(!strncmp((char *)evbuffer_pullup(buf2, -1), chunk, len)); ++ evbuffer_validate(buf2); ++ ++end: ++ if (buf1) ++ evbuffer_free(buf1); ++ if (buf2) ++ evbuffer_free(buf2); ++} ++ + static void + check_prepend(struct evbuffer *buffer, + const struct evbuffer_cb_info *cbinfo, +@@ -2830,6 +2864,7 @@ struct testcase_t evbuffer_testcases[] = { + { "add_reference", test_evbuffer_add_reference, 0, NULL, NULL }, + { "multicast", test_evbuffer_multicast, 0, NULL, NULL }, + { "multicast_drain", test_evbuffer_multicast_drain, 0, NULL, NULL }, ++ { "multicast_empty_chain", test_evbuffer_multicast_empty_chain, TT_FORK, NULL, NULL }, + { "prepend", test_evbuffer_prepend, TT_FORK, NULL, NULL }, + { "empty_reference_prepend", test_evbuffer_empty_reference_prepend, TT_FORK, NULL, NULL }, + { "empty_reference_prepend_buffer", test_evbuffer_empty_reference_prepend_buffer, TT_FORK, NULL, NULL }, -- -2.45.4 +2.43.0 diff --git a/SPECS/ntp/CVE-2026-63382.patch b/SPECS/ntp/CVE-2026-63382.patch index 3ab95aaf7f1..67171b8a1f9 100644 --- a/SPECS/ntp/CVE-2026-63382.patch +++ b/SPECS/ntp/CVE-2026-63382.patch @@ -1,41 +1,7 @@ -From 5fcbb539abe9715994bfb76b4d57f46341bb310d Mon Sep 17 00:00:00 2001 -From: Nick Mathewson -Date: Fri, 26 Jun 2026 08:32:25 -0400 -Subject: [PATCH 1/2] http: Treat CRLF strictly in HTTP chunks. - -According to RFC 9112, we can't treat LF alone as a terminator in -the chunked encoding. - -Reported by @xclow3n - -Part of GHSA-q39v-w2g7-gr8j - -Tracking: X11 ---- - sntp/libevent/http.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c -index 4400abb..474d8c2 100644 ---- a/sntp/libevent/http.c -+++ b/sntp/libevent/http.c -@@ -925,7 +925,7 @@ evhttp_handle_chunked_read(struct evhttp_request *req, struct evbuffer *buf) - if (req->ntoread < 0) { - /* Read chunk size */ - ev_int64_t ntoread; -- char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF); -+ char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF_STRICT); - char *endp; - int error; - if (p == NULL) --- -2.45.4 - - -From 2b8fd75033a99f90ba5e6ee0cb7b92dd22d0d01c Mon Sep 17 00:00:00 2001 +From ac38703b2d312200c4f967f02936af0118d384a0 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Fri, 26 Jun 2026 10:37:46 -0400 -Subject: [PATCH 2/2] http: Tighten acceptable headers to prevent request +Subject: [PATCH] http: Tighten acceptable headers to prevent request smuggling. Previously, we accepted a wider variety of combinations of @@ -56,12 +22,14 @@ Originally reported by @xclow3n; and then by @kodareef5, CR and LF in header lines.) Tracking: X12. -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6.patch https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0.patch +Upstream Patch reference: +https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0.patch +& https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6.patch --- - sntp/libevent/http-internal.h | 14 +++ - sntp/libevent/http.c | 164 ++++++++++++++++++++++++++++++++-- - 2 files changed, 172 insertions(+), 6 deletions(-) + sntp/libevent/http-internal.h | 14 +++ + sntp/libevent/http.c | 165 ++++++++++++++++++++++++++++-- + sntp/libevent/test/regress_http.c | 39 +++++++ + 3 files changed, 211 insertions(+), 7 deletions(-) diff --git a/sntp/libevent/http-internal.h b/sntp/libevent/http-internal.h index feaf436..4d52504 100644 @@ -89,7 +57,7 @@ index feaf436..4d52504 100644 EVENT2_EXPORT_SYMBOL diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c -index 474d8c2..8428656 100644 +index e96ce0b..e6fd70e 100644 --- a/sntp/libevent/http.c +++ b/sntp/libevent/http.c @@ -123,7 +123,6 @@ @@ -109,7 +77,16 @@ index 474d8c2..8428656 100644 #define REQ_VERSION_BEFORE(req, major_v, minor_v) \ ((req)->major < (major_v) || \ ((req)->major == (major_v) && (req)->minor < (minor_v))) -@@ -1908,6 +1909,32 @@ evhttp_find_header(const struct evkeyvalq *headers, const char *key) +@@ -929,7 +930,7 @@ evhttp_handle_chunked_read(struct evhttp_request *req, struct evbuffer *buf) + if (req->ntoread < 0) { + /* Read chunk size */ + ev_int64_t ntoread; +- char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF); ++ char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF_STRICT); + char *endp; + int error; + if (p == NULL) +@@ -1916,6 +1917,32 @@ evhttp_find_header(const struct evkeyvalq *headers, const char *key) return (NULL); } @@ -142,11 +119,10 @@ index 474d8c2..8428656 100644 void evhttp_clear_headers(struct evkeyvalq *headers) { -@@ -2153,6 +2180,127 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) - return (errcode); +@@ -2173,6 +2200,126 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer *buffer) + return evhttp_parse_headers_impl_(req, buffer, req->input_headers); } -+ +/* Return true if 'ch' is a single linear WS character (per the HTTP spec). + * We reject CR and LF elsewhere. */ +#define IS_LWS(ch) \ @@ -270,7 +246,7 @@ index 474d8c2..8428656 100644 static int evhttp_get_body_length(struct evhttp_request *req) { -@@ -2212,8 +2360,6 @@ evhttp_method_may_have_body(enum evhttp_cmd_type type) +@@ -2232,8 +2379,6 @@ evhttp_method_may_have_body(enum evhttp_cmd_type type) static void evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) { @@ -279,7 +255,7 @@ index 474d8c2..8428656 100644 /* If this is a request without a body, then we are done */ if (req->kind == EVHTTP_REQUEST && !evhttp_method_may_have_body(req->type)) { -@@ -2221,9 +2367,8 @@ evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) +@@ -2241,9 +2386,8 @@ evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) return; } evcon->state = EVCON_READING_BODY; @@ -291,7 +267,7 @@ index 474d8c2..8428656 100644 req->ntoread = -1; } else { if (evhttp_get_body_length(req) == -1) { -@@ -2309,6 +2454,13 @@ evhttp_read_header(struct evhttp_connection *evcon, +@@ -2329,6 +2473,13 @@ evhttp_read_header(struct evhttp_connection *evcon, return; } @@ -305,6 +281,63 @@ index 474d8c2..8428656 100644 /* Callback can shut down connection with negative return value */ if (req->header_cb != NULL) { if ((*req->header_cb)(req, req->cb_arg) < 0) { +diff --git a/sntp/libevent/test/regress_http.c b/sntp/libevent/test/regress_http.c +index 4493907..8447444 100644 +--- a/sntp/libevent/test/regress_http.c ++++ b/sntp/libevent/test/regress_http.c +@@ -3959,6 +3959,43 @@ http_multi_line_header_test(void *arg) + evhttp_free(http); + } + ++static void ++http_is_chunked_test(void *arg) ++{ ++ (void) arg; ++ tt_assert(evhttp_str_is_chunked_("chunked", NULL)); ++ tt_assert(evhttp_str_is_chunked_("chUNKED", NULL)); ++ tt_assert(evhttp_str_is_chunked_(" CHUNKED ", NULL)); ++ tt_assert(evhttp_str_is_chunked_(" chUNKED ; foo=bar", NULL)); ++ tt_assert(evhttp_str_is_chunked_("chUNKED ; foo=bar", NULL)); ++ ++ tt_assert(! evhttp_str_is_chunked_("wombat", NULL)); ++ tt_assert(! evhttp_str_is_chunked_("chunked+", NULL)); ++ tt_assert(! evhttp_str_is_chunked_("wombchunkedat", NULL)); ++ tt_assert(! evhttp_str_is_chunked_("wombat chunked", NULL)); ++ tt_assert(! evhttp_str_is_chunked_("wombat; chunked=foo", NULL)); ++end: ++ ; ++} ++ ++static void ++http_check_transfer_encoding_test(void *arg) ++{ ++#define CH evhttp_check_transfer_encoding_ ++ tt_int_op(CH("hello"), ==, TE_NO_CHUNKED); ++ tt_int_op(CH("hello, world"), ==, TE_NO_CHUNKED); ++ tt_int_op(CH("hello, world, chunked"), ==, TE_ENDS_IN_CHUNKED); ++ tt_int_op(CH("chunked "), ==, TE_ENDS_IN_CHUNKED); ++ tt_int_op(CH(" , chunked "), ==, TE_ENDS_IN_CHUNKED); ++ tt_int_op(CH("chunked , gzip"), ==, TE_INVALID); ++ tt_int_op(CH("foo, chunked , gzip"), ==, TE_INVALID); ++ tt_int_op(CH(" , chunked, "), ==, TE_INVALID); ++end: ++ ; ++#undef CH ++} ++ ++ + static void + http_request_bad(struct evhttp_request *req, void *arg) + { +@@ -4747,6 +4784,8 @@ struct testcase_t http_testcases[] = { + HTTP(highport), + HTTP(dispatcher), + HTTP(multi_line_header), ++ HTTP(is_chunked), ++ HTTP(check_transfer_encoding), + HTTP(negative_content_length), + HTTP(chunk_out), + HTTP(stream_out), -- -2.45.4 +2.43.0 diff --git a/SPECS/ntp/CVE-2026-63385.patch b/SPECS/ntp/CVE-2026-63385.patch index 3e7dc4a84aa..f8fa48ac853 100644 --- a/SPECS/ntp/CVE-2026-63385.patch +++ b/SPECS/ntp/CVE-2026-63385.patch @@ -1,4 +1,4 @@ -From 1655dd6b0a7b72d1e0a16399a95c418526338e00 Mon Sep 17 00:00:00 2001 +From 9170dd35e64714613e8d13b290587cfc28e258e2 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Fri, 26 Jun 2026 09:08:47 -0400 Subject: [PATCH] http: Reject headers containing CRLF. @@ -13,17 +13,17 @@ Reported by @AsafMeizner Part of GHSA-jcwh-pvf2-73p2 Tracking: X10. -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2.patch +Upstream Patch reference: https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2.patch --- - sntp/libevent/http.c | 10 ++++------ - 1 file changed, 4 insertions(+), 6 deletions(-) + sntp/libevent/http.c | 10 ++++------ + sntp/libevent/test/regress_http.c | 3 ++- + 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/sntp/libevent/http.c b/sntp/libevent/http.c -index 516f6f9..4400abb 100644 +index e6fd70e..19ab491 100644 --- a/sntp/libevent/http.c +++ b/sntp/libevent/http.c -@@ -1955,13 +1955,11 @@ evhttp_header_is_valid_value(const char *value) +@@ -1990,13 +1990,11 @@ evhttp_header_is_valid_value(const char *value) { const char *p = value; @@ -41,6 +41,20 @@ index 516f6f9..4400abb 100644 return (1); } +diff --git a/sntp/libevent/test/regress_http.c b/sntp/libevent/test/regress_http.c +index 8447444..5404ae0 100644 +--- a/sntp/libevent/test/regress_http.c ++++ b/sntp/libevent/test/regress_http.c +@@ -2406,7 +2406,8 @@ http_bad_header_test(void *ptr) + TAILQ_INIT(&headers); + + tt_want(evhttp_add_header(&headers, "One", "Two") == 0); +- tt_want(evhttp_add_header(&headers, "One", "Two\r\n Three") == 0); ++ tt_want(evhttp_add_header(&headers, "One", "Two Three") == 0); ++ tt_want(evhttp_add_header(&headers, "One", "Two\r\n Three") == -1); + tt_want(evhttp_add_header(&headers, "One\r", "Two") == -1); + tt_want(evhttp_add_header(&headers, "One\n", "Two") == -1); + tt_want(evhttp_add_header(&headers, "One", "Two\r") == -1); -- -2.45.4 +2.43.0 diff --git a/SPECS/ntp/ntp.spec b/SPECS/ntp/ntp.spec index d71641cbebf..d3dd1ec5b32 100644 --- a/SPECS/ntp/ntp.spec +++ b/SPECS/ntp/ntp.spec @@ -69,15 +69,7 @@ ntpstat is a utility which reports the synchronisation state of the NTP daemon running on the local machine. %prep -%setup -q -a 1 -%patch 0 -p1 -%patch 1 -p1 -%patch 2 -p1 -%patch 3 -p1 -%patch 4 -p1 -%patch 5 -p1 -%patch 6 -p1 -%patch 7 -p1 +%autosetup -a 1 -p1 %build From 9969f84b2961ab0bf89b3f738bc3a6f608f05b6c Mon Sep 17 00:00:00 2001 From: BinduSri-6522866 Date: Thu, 27 Aug 2026 09:38:37 +0000 Subject: [PATCH 3/3] fix License Check error --- SPECS/ntp/ntp.spec | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/SPECS/ntp/ntp.spec b/SPECS/ntp/ntp.spec index d3dd1ec5b32..19b2ba00cf7 100644 --- a/SPECS/ntp/ntp.spec +++ b/SPECS/ntp/ntp.spec @@ -92,8 +92,10 @@ make -C ntpstat-master CFLAGS="$CFLAGS" cp %{SOURCE8} . make DESTDIR=%{buildroot} install -install -v -m755 -d %{buildroot}%{_docdir}/%{name}-%{version} -cp -v -R html/* %{buildroot}%{_docdir}/%{name}-%{version}/ +rm -f \ + %{buildroot}%{_docdir}/%{name}/html/copyright.html \ + %{buildroot}%{_docdir}/%{name}/html/hints/bsdi \ + %{buildroot}%{_docdir}/%{name}/html/hints/freebsd install -vdm 755 %{buildroot}%{_sysconfdir} mkdir -p %{buildroot}%{_sharedstatedir}/ntp/drift @@ -113,7 +115,6 @@ restrict -6 ::1 driftfile %{_sharedstatedir}/ntp/drift/ntp.drift EOF -install -D -m644 COPYRIGHT %{buildroot}%{_datadir}/licenses/%{name}/LICENSE rm -rf %{buildroot}%{_sysconfdir}/rc.d/* %{_fixperms} %{buildroot}/* @@ -158,7 +159,7 @@ fi %files %defattr(-,root,root) -%license COPYRIGHT LICENSE.PTR +%license COPYRIGHT LICENSE.PTR html/copyright.html html/hints/bsdi html/hints/freebsd %dir %{_sharedstatedir}/ntp/drift %attr(0755, ntp, ntp) %{_sharedstatedir}/ntp/drift %attr(0750, root, root) %config(noreplace) %{_sysconfdir}/ntp.conf @@ -177,10 +178,8 @@ fi %{_bindir}/ntptime %{_bindir}/sntp %{_bindir}/tickadj -%{_docdir}/%{name}-%{version}/* -%{_docdir}/ntp/* -%{_docdir}/sntp/* -%{_datadir}/licenses/ntp/LICENSE +%doc %{_docdir}/ntp/* +%doc %{_docdir}/sntp/* %{_mandir}/man1/ntpd.1.gz %{_mandir}/man1/ntpdc.1.gz %{_mandir}/man1/ntp-keygen.1.gz