summaryrefslogtreecommitdiff
path: root/meta-openembedded/meta-webserver
diff options
context:
space:
mode:
Diffstat (limited to 'meta-openembedded/meta-webserver')
-rw-r--r--meta-openembedded/meta-webserver/recipes-httpd/apache2/apache2_2.4.56.bb (renamed from meta-openembedded/meta-webserver/recipes-httpd/apache2/apache2_2.4.54.bb)2
-rw-r--r--meta-openembedded/meta-webserver/recipes-httpd/apache2/files/apache2-volatile.conf2
-rw-r--r--meta-openembedded/meta-webserver/recipes-httpd/monkey/files/0001-fastcgi-Use-value-instead-of-address-of-sin6_port.patch30
-rw-r--r--meta-openembedded/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb6
-rw-r--r--meta-openembedded/meta-webserver/recipes-httpd/nginx/files/CVE-2022-41741-CVE-2022-41742.patch319
-rw-r--r--meta-openembedded/meta-webserver/recipes-httpd/nginx/nginx_1.20.1.bb4
-rw-r--r--meta-openembedded/meta-webserver/recipes-php/phpmyadmin/phpmyadmin/CVE-2023-25727.patch37
-rw-r--r--meta-openembedded/meta-webserver/recipes-php/phpmyadmin/phpmyadmin_5.1.3.bb1
8 files changed, 396 insertions, 5 deletions
diff --git a/meta-openembedded/meta-webserver/recipes-httpd/apache2/apache2_2.4.54.bb b/meta-openembedded/meta-webserver/recipes-httpd/apache2/apache2_2.4.56.bb
index 37d498f52e..8b857d2f0c 100644
--- a/meta-openembedded/meta-webserver/recipes-httpd/apache2/apache2_2.4.54.bb
+++ b/meta-openembedded/meta-webserver/recipes-httpd/apache2/apache2_2.4.56.bb
@@ -27,7 +27,7 @@ SRC_URI:append:class-target = " \
"
LIC_FILES_CHKSUM = "file://LICENSE;md5=bddeddfac80b2c9a882241d008bb41c3"
-SRC_URI[sha256sum] = "eb397feeefccaf254f8d45de3768d9d68e8e73851c49afd5b7176d1ecf80c340"
+SRC_URI[sha256sum] = "d8d45f1398ba84edd05bb33ca7593ac2989b17cb9c7a0cafe5442d41afdb2d7c"
S = "${WORKDIR}/httpd-${PV}"
diff --git a/meta-openembedded/meta-webserver/recipes-httpd/apache2/files/apache2-volatile.conf b/meta-openembedded/meta-webserver/recipes-httpd/apache2/files/apache2-volatile.conf
index ff2c587046..0852a8859a 100644
--- a/meta-openembedded/meta-webserver/recipes-httpd/apache2/files/apache2-volatile.conf
+++ b/meta-openembedded/meta-webserver/recipes-httpd/apache2/files/apache2-volatile.conf
@@ -1,2 +1,2 @@
-d /var/run/apache2 0755 root root -
+d /run/apache2 0755 root root -
d /var/log/apache2 0755 root root -
diff --git a/meta-openembedded/meta-webserver/recipes-httpd/monkey/files/0001-fastcgi-Use-value-instead-of-address-of-sin6_port.patch b/meta-openembedded/meta-webserver/recipes-httpd/monkey/files/0001-fastcgi-Use-value-instead-of-address-of-sin6_port.patch
new file mode 100644
index 0000000000..f4bab49aa7
--- /dev/null
+++ b/meta-openembedded/meta-webserver/recipes-httpd/monkey/files/0001-fastcgi-Use-value-instead-of-address-of-sin6_port.patch
@@ -0,0 +1,30 @@
+From 7f724bbafbb1e170401dd5de201273ab8c8bc75f Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Sun, 28 Aug 2022 14:24:02 -0700
+Subject: [PATCH] fastcgi: Use value instead of address of sin6_port
+
+This seems to be wrongly assigned where ipv4 sin_port is
+equated to address of sin6_port and not value of sin6_port
+
+Upstream-Status: Submitted [https://github.com/monkey/monkey/pull/375]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ plugins/fastcgi/fcgi_handler.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/plugins/fastcgi/fcgi_handler.c b/plugins/fastcgi/fcgi_handler.c
+index 9e095e3c..e8e1eec1 100644
+--- a/plugins/fastcgi/fcgi_handler.c
++++ b/plugins/fastcgi/fcgi_handler.c
+@@ -245,7 +245,7 @@ static inline int fcgi_add_param_net(struct fcgi_handler *handler)
+ struct sockaddr_in *s4 = (struct sockaddr_in *)&addr4;
+ memset(&addr4, 0, sizeof(addr4));
+ addr4.sin_family = AF_INET;
+- addr4.sin_port = &s->sin6_port;
++ addr4.sin_port = s->sin6_port;
+ memcpy(&addr4.sin_addr.s_addr,
+ s->sin6_addr.s6_addr + 12,
+ sizeof(addr4.sin_addr.s_addr));
+--
+2.37.2
+
diff --git a/meta-openembedded/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb b/meta-openembedded/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb
index fff406a3f2..d3e22757c4 100644
--- a/meta-openembedded/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb
+++ b/meta-openembedded/meta-webserver/recipes-httpd/monkey/monkey_1.6.9.bb
@@ -7,11 +7,13 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=2ee41112a44fe7014dce33e26468ba93"
SECTION = "net"
-SRC_URI = "http://monkey-project.com/releases/1.6/monkey-${PV}.tar.gz \
+SRC_URI = "git://github.com/monkey/monkey;branch=1.6;protocol=https \
+ file://0001-fastcgi-Use-value-instead-of-address-of-sin6_port.patch \
file://monkey.service \
file://monkey.init"
-SRC_URI[sha256sum] = "f1122e89cda627123286542b0a18fcaa131cbe9d4f5dd897d9455157289148fb"
+SRCREV = "7999b487fded645381d387ec0e057e92407b0d2c"
+S = "${WORKDIR}/git"
UPSTREAM_CHECK_URI = "https://github.com/monkey/monkey/releases"
UPSTREAM_CHECK_REGEX = "v(?P<pver>\d+(\.\d+)+).tar.gz"
diff --git a/meta-openembedded/meta-webserver/recipes-httpd/nginx/files/CVE-2022-41741-CVE-2022-41742.patch b/meta-openembedded/meta-webserver/recipes-httpd/nginx/files/CVE-2022-41741-CVE-2022-41742.patch
new file mode 100644
index 0000000000..d151256b37
--- /dev/null
+++ b/meta-openembedded/meta-webserver/recipes-httpd/nginx/files/CVE-2022-41741-CVE-2022-41742.patch
@@ -0,0 +1,319 @@
+From 91a3b5302d6a2467df70d3b43450991a53f9946b Mon Sep 17 00:00:00 2001
+From: Hitendra Prajapati <hprajapati@mvista.com>
+Date: Wed, 16 Nov 2022 11:24:25 +0530
+Subject: [PATCH] CVE-2022-41741, CVE-2022-41742
+
+Upstream-Status: Backport [https://github.com/nginx/nginx/commit/6b022a5556af22b6e18532e547a6ae46b0d8c6ea]
+CVE: CVE-2022-41741, CVE-2022-41742
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+
+Mp4: disabled duplicate atoms.
+
+Most atoms should not appear more than once in a container. Previously,
+this was not enforced by the module, which could result in worker process
+crash, memory corruption and disclosure.
+---
+ src/http/modules/ngx_http_mp4_module.c | 147 +++++++++++++++++++++++++
+ 1 file changed, 147 insertions(+)
+
+diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
+index 0e93fbd..4f4d89d 100644
+--- a/src/http/modules/ngx_http_mp4_module.c
++++ b/src/http/modules/ngx_http_mp4_module.c
+@@ -1070,6 +1070,12 @@ ngx_http_mp4_read_ftyp_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ return NGX_ERROR;
+ }
+
++ if (mp4->ftyp_atom.buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 ftyp atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size;
+
+ ftyp_atom = ngx_palloc(mp4->request->pool, atom_size);
+@@ -1128,6 +1134,12 @@ ngx_http_mp4_read_moov_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ return NGX_DECLINED;
+ }
+
++ if (mp4->moov_atom.buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 moov atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ conf = ngx_http_get_module_loc_conf(mp4->request, ngx_http_mp4_module);
+
+ if (atom_data_size > mp4->buffer_size) {
+@@ -1195,6 +1207,12 @@ ngx_http_mp4_read_mdat_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 mdat atom");
+
++ if (mp4->mdat_atom.buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 mdat atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ data = &mp4->mdat_data_buf;
+ data->file = &mp4->file;
+ data->in_file = 1;
+@@ -1321,6 +1339,12 @@ ngx_http_mp4_read_mvhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ ngx_log_debug0(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "mp4 mvhd atom");
+
++ if (mp4->mvhd_atom.buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 mvhd atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom_header = ngx_mp4_atom_header(mp4);
+ mvhd_atom = (ngx_mp4_mvhd_atom_t *) atom_header;
+ mvhd64_atom = (ngx_mp4_mvhd64_atom_t *) atom_header;
+@@ -1586,6 +1610,13 @@ ngx_http_mp4_read_tkhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size;
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_TKHD_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 tkhd atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->tkhd_size = atom_size;
+
+ ngx_mp4_set_32value(tkhd_atom->size, atom_size);
+@@ -1624,6 +1655,12 @@ ngx_http_mp4_read_mdia_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_MDIA_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 mdia atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->mdia_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1747,6 +1784,13 @@ ngx_http_mp4_read_mdhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_size = sizeof(ngx_mp4_atom_header_t) + (size_t) atom_data_size;
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_MDHD_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 mdhd atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->mdhd_size = atom_size;
+ trak->timescale = timescale;
+
+@@ -1789,6 +1833,12 @@ ngx_http_mp4_read_hdlr_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_HDLR_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 hdlr atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->hdlr_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1817,6 +1867,12 @@ ngx_http_mp4_read_minf_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_MINF_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 minf atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->minf_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1860,6 +1916,15 @@ ngx_http_mp4_read_vmhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_VMHD_ATOM].buf
++ || trak->out[NGX_HTTP_MP4_SMHD_ATOM].buf)
++ {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 vmhd/smhd atom in \"%s\"",
++ mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->vmhd_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1891,6 +1956,15 @@ ngx_http_mp4_read_smhd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_VMHD_ATOM].buf
++ || trak->out[NGX_HTTP_MP4_SMHD_ATOM].buf)
++ {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 vmhd/smhd atom in \"%s\"",
++ mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->smhd_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1922,6 +1996,12 @@ ngx_http_mp4_read_dinf_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_DINF_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 dinf atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->dinf_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -1950,6 +2030,12 @@ ngx_http_mp4_read_stbl_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_STBL_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stbl atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->stbl_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -2018,6 +2104,12 @@ ngx_http_mp4_read_stsd_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+
+ trak = ngx_mp4_last_trak(mp4);
+
++ if (trak->out[NGX_HTTP_MP4_STSD_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stsd atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ atom = &trak->stsd_atom_buf;
+ atom->temporary = 1;
+ atom->pos = atom_header;
+@@ -2086,6 +2178,13 @@ ngx_http_mp4_read_stts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_end = atom_table + entries * sizeof(ngx_mp4_stts_entry_t);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STTS_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stts atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->time_to_sample_entries = entries;
+
+ atom = &trak->stts_atom_buf;
+@@ -2291,6 +2390,13 @@ ngx_http_mp4_read_stss_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ "sync sample entries:%uD", entries);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STSS_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stss atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->sync_samples_entries = entries;
+
+ atom_table = atom_header + sizeof(ngx_http_mp4_stss_atom_t);
+@@ -2489,6 +2595,13 @@ ngx_http_mp4_read_ctts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ "composition offset entries:%uD", entries);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_CTTS_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 ctts atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->composition_offset_entries = entries;
+
+ atom_table = atom_header + sizeof(ngx_mp4_ctts_atom_t);
+@@ -2692,6 +2805,13 @@ ngx_http_mp4_read_stsc_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_end = atom_table + entries * sizeof(ngx_mp4_stsc_entry_t);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STSC_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stsc atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->sample_to_chunk_entries = entries;
+
+ atom = &trak->stsc_atom_buf;
+@@ -3024,6 +3144,13 @@ ngx_http_mp4_read_stsz_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ "sample uniform size:%uD, entries:%uD", size, entries);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STSZ_ATOM].buf) {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stsz atom in \"%s\"", mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->sample_sizes_entries = entries;
+
+ atom_table = atom_header + sizeof(ngx_mp4_stsz_atom_t);
+@@ -3207,6 +3334,16 @@ ngx_http_mp4_read_stco_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_end = atom_table + entries * sizeof(uint32_t);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STCO_ATOM].buf
++ || trak->out[NGX_HTTP_MP4_CO64_ATOM].buf)
++ {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stco/co64 atom in \"%s\"",
++ mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->chunks = entries;
+
+ atom = &trak->stco_atom_buf;
+@@ -3413,6 +3550,16 @@ ngx_http_mp4_read_co64_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
+ atom_end = atom_table + entries * sizeof(uint64_t);
+
+ trak = ngx_mp4_last_trak(mp4);
++
++ if (trak->out[NGX_HTTP_MP4_STCO_ATOM].buf
++ || trak->out[NGX_HTTP_MP4_CO64_ATOM].buf)
++ {
++ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
++ "duplicate mp4 stco/co64 atom in \"%s\"",
++ mp4->file.name.data);
++ return NGX_ERROR;
++ }
++
+ trak->chunks = entries;
+
+ atom = &trak->co64_atom_buf;
+--
+2.25.1
+
diff --git a/meta-openembedded/meta-webserver/recipes-httpd/nginx/nginx_1.20.1.bb b/meta-openembedded/meta-webserver/recipes-httpd/nginx/nginx_1.20.1.bb
index d686c627f2..09a1b45591 100644
--- a/meta-openembedded/meta-webserver/recipes-httpd/nginx/nginx_1.20.1.bb
+++ b/meta-openembedded/meta-webserver/recipes-httpd/nginx/nginx_1.20.1.bb
@@ -1,6 +1,8 @@
require nginx.inc
-SRC_URI += "file://CVE-2021-3618.patch"
+SRC_URI += "file://CVE-2021-3618.patch \
+ file://CVE-2022-41741-CVE-2022-41742.patch \
+ "
LIC_FILES_CHKSUM = "file://LICENSE;md5=206629dc7c7b3e87acb31162363ae505"
diff --git a/meta-openembedded/meta-webserver/recipes-php/phpmyadmin/phpmyadmin/CVE-2023-25727.patch b/meta-openembedded/meta-webserver/recipes-php/phpmyadmin/phpmyadmin/CVE-2023-25727.patch
new file mode 100644
index 0000000000..707334a517
--- /dev/null
+++ b/meta-openembedded/meta-webserver/recipes-php/phpmyadmin/phpmyadmin/CVE-2023-25727.patch
@@ -0,0 +1,37 @@
+From 0842f11158699a979437125756b26eeabedab9ab Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Maur=C3=ADcio=20Meneghini=20Fauth?= <mauricio@fauth.dev>
+Date: Fri, 5 Aug 2022 20:18:16 -0300
+Subject: [PATCH] Fix not escaped title when using drag and drop upload
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
+
+Upstream-Status: Backport
+CVE: CVE-2023-25727
+
+Reference to upstream patch:
+https://github.com/phpmyadmin/phpmyadmin/commit/efa2406695551667f726497750d3db91fb6f662e
+
+Signed-off-by: Dragos-Marian Panait <dragos.panait@windriver.com>
+---
+ js/src/drag_drop_import.js | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/js/src/drag_drop_import.js b/js/src/drag_drop_import.js
+index 55250c2..9b8710e 100644
+--- a/js/src/drag_drop_import.js
++++ b/js/src/drag_drop_import.js
+@@ -130,7 +130,7 @@ var DragDropImport = {
+ var filename = $this.parent('span').attr('data-filename');
+ $('body').append('<div class="pma_drop_result"><h2>' +
+ Messages.dropImportImportResultHeader + ' - ' +
+- filename + '<span class="close">x</span></h2>' + value.message + '</div>');
++ Functions.escapeHtml(filename) + '<span class="close">x</span></h2>' + value.message + '</div>');
+ $('.pma_drop_result').draggable(); // to make this dialog draggable
+ }
+ });
+--
+2.39.1
+
diff --git a/meta-openembedded/meta-webserver/recipes-php/phpmyadmin/phpmyadmin_5.1.3.bb b/meta-openembedded/meta-webserver/recipes-php/phpmyadmin/phpmyadmin_5.1.3.bb
index 7ccc05ec3e..3f19194391 100644
--- a/meta-openembedded/meta-webserver/recipes-php/phpmyadmin/phpmyadmin_5.1.3.bb
+++ b/meta-openembedded/meta-webserver/recipes-php/phpmyadmin/phpmyadmin_5.1.3.bb
@@ -9,6 +9,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
SRC_URI = "https://files.phpmyadmin.net/phpMyAdmin/${PV}/phpMyAdmin-${PV}-all-languages.tar.xz \
file://apache.conf \
+ file://CVE-2023-25727.patch \
"
SRC_URI[sha256sum] = "c562feddc0f8ff5e69629113f273a0d024a65fb928c48e89ce614744d478296f"
generated by cgit v1.2.3 (git 2.39.0) at 2024-10-21 08:44:08 +0300