summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndreas Sturmlechner <asturm@gentoo.org>2020-08-30 09:54:06 +0200
committerAndreas Sturmlechner <asturm@gentoo.org>2020-08-30 09:58:22 +0200
commitbcbbc28935e68cd159ba8c04fac867cc8f284ce5 (patch)
tree541956f951c8a77524269eb9e50488751ed6b563 /kde-apps/kleopatra
parentkde-apps/cantor: Add missing DEPEND (diff)
downloadgentoo-bcbbc28935e68cd159ba8c04fac867cc8f284ce5.tar.gz
gentoo-bcbbc28935e68cd159ba8c04fac867cc8f284ce5.tar.bz2
gentoo-bcbbc28935e68cd159ba8c04fac867cc8f284ce5.zip
kde-apps/kleopatra: Fix CVE-2020-24972
Bug: https://bugs.gentoo.org/739556 Package-Manager: Portage-3.0.4, Repoman-3.0.1 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>
Diffstat (limited to 'kde-apps/kleopatra')
-rw-r--r--kde-apps/kleopatra/files/kleopatra-20.04.3-CVE-2020-24972.patch110
-rw-r--r--kde-apps/kleopatra/kleopatra-20.04.3-r1.ebuild57
2 files changed, 167 insertions, 0 deletions
diff --git a/kde-apps/kleopatra/files/kleopatra-20.04.3-CVE-2020-24972.patch b/kde-apps/kleopatra/files/kleopatra-20.04.3-CVE-2020-24972.patch
new file mode 100644
index 00000000000..ebcbb232e08
--- /dev/null
+++ b/kde-apps/kleopatra/files/kleopatra-20.04.3-CVE-2020-24972.patch
@@ -0,0 +1,110 @@
+From b4bd63c1739900d94c04da03045e9445a5a5f54b Mon Sep 17 00:00:00 2001
+From: Andre Heinecke <aheinecke@gnupg.org>
+Date: Tue, 7 Jul 2020 14:39:29 +0200
+Subject: [PATCH] Allow safe usage of query
+
+To allow secure usage of query and search the parameters are
+no longer parsed as value but instead of positional arguments.
+
+This allows us to register "kleoptra --query -- $1" as an
+URL handler for openpgp4fpr: without the risk of command
+line injection through an unsescaped query string.
+
+Similarly the double dash should be used for file handling
+to avoid command line injection through filenames.
+---
+ src/kleopatra_options.h | 19 ++++++++++++++-----
+ src/kleopatraapplication.cpp | 25 ++++++++++++++-----------
+ 2 files changed, 28 insertions(+), 16 deletions(-)
+
+diff --git a/src/kleopatra_options.h b/src/kleopatra_options.h
+index 661c44d7..8ce7fccf 100644
+--- a/src/kleopatra_options.h
++++ b/src/kleopatra_options.h
+@@ -79,8 +79,7 @@ static void kleopatra_options(QCommandLineParser *parser)
+ << QStringLiteral("D"),
+ i18n("Decrypt and/or verify file(s)"))
+ << QCommandLineOption(QStringList() << QStringLiteral("search"),
+- i18n("Search for a certificate on a keyserver"),
+- QStringLiteral("search string"))
++ i18n("Search for a certificate on a keyserver"))
+ << QCommandLineOption(QStringList() << QStringLiteral("checksum"),
+ i18n("Create or check a checksum file"))
+ << QCommandLineOption(QStringList() << QStringLiteral("query")
+@@ -88,8 +87,7 @@ static void kleopatra_options(QCommandLineParser *parser)
+ i18nc("If a certificate is already known it shows the certificate details dialog."
+ "Otherwise it brings up the certificate search dialog.",
+ "Show details of a local certificate or search for it on a keyserver"
+- " by fingerprint"),
+- QStringLiteral("fingerprint"))
++ " by fingerprint"))
+ << QCommandLineOption(QStringList() << QStringLiteral("gen-key"),
+ i18n("Create a new key pair or certificate signing request"))
+ << QCommandLineOption(QStringLiteral("parent-windowid"),
+@@ -100,8 +98,19 @@ static void kleopatra_options(QCommandLineParser *parser)
+
+ parser->addOptions(options);
+
++ /* Security note: To avoid code execution by shared library injection
++ * through e.g. -platformpluginpath any external input should be seperated
++ * by a double dash -- this is why query / search uses positional arguments.
++ *
++ * For example on Windows there is an URLhandler for openpgp4fpr:
++ * be opened with Kleopatra's query function. And while a browser should
++ * urlescape such a query there might be tricks to inject a quote character
++ * and as such inject command line options for Kleopatra in an URL. */
+ parser->addPositionalArgument(QStringLiteral("files"),
+ i18n("File(s) to process"),
+- QStringLiteral("[files..]"));
++ QStringLiteral("-- [files..]"));
++ parser->addPositionalArgument(QStringLiteral("query"),
++ i18n("String or Fingerprint for query and search"),
++ QStringLiteral("-- [query..]"));
+ }
+ #endif
+diff --git a/src/kleopatraapplication.cpp b/src/kleopatraapplication.cpp
+index 989f14b4..a8c5dd08 100644
+--- a/src/kleopatraapplication.cpp
++++ b/src/kleopatraapplication.cpp
+@@ -273,13 +273,18 @@ QString KleopatraApplication::newInstance(const QCommandLineParser &parser,
+
+ QStringList files;
+ const QDir cwd = QDir(workingDirectory);
+- Q_FOREACH (const QString &file, parser.positionalArguments()) {
+- // We do not check that file exists here. Better handle
+- // these errors in the UI.
+- if (QFileInfo(file).isAbsolute()) {
+- files << file;
+- } else {
+- files << cwd.absoluteFilePath(file);
++ bool queryMode = parser.isSet(QStringLiteral("query")) || parser.isSet(QStringLiteral("search"));
++
++ // Query and Search treat positional arguments differently, see below.
++ if (!queryMode) {
++ Q_FOREACH (const QString &file, parser.positionalArguments()) {
++ // We do not check that file exists here. Better handle
++ // these errors in the UI.
++ if (QFileInfo(file).isAbsolute()) {
++ files << file;
++ } else {
++ files << cwd.absoluteFilePath(file);
++ }
+ }
+ }
+
+@@ -313,10 +318,8 @@ QString KleopatraApplication::newInstance(const QCommandLineParser &parser,
+
+ // Handle openpgp4fpr URI scheme
+ QString needle;
+- if (parser.isSet(QStringLiteral("search"))) {
+- needle = parser.value(QStringLiteral("search"));
+- } else if (parser.isSet(QStringLiteral("query"))) {
+- needle = parser.value(QStringLiteral("query"));
++ if (queryMode) {
++ needle = parser.positionalArguments().join(QLatin1Char(' '));
+ }
+ if (needle.startsWith(QLatin1String("openpgp4fpr:"))) {
+ needle.remove(0, 12);
+--
+GitLab
+
diff --git a/kde-apps/kleopatra/kleopatra-20.04.3-r1.ebuild b/kde-apps/kleopatra/kleopatra-20.04.3-r1.ebuild
new file mode 100644
index 00000000000..3953432cb0f
--- /dev/null
+++ b/kde-apps/kleopatra/kleopatra-20.04.3-r1.ebuild
@@ -0,0 +1,57 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+ECM_HANDBOOK="optional"
+ECM_TEST="forceoptional"
+PVCUT=$(ver_cut 1-3)
+KFMIN=5.70.0
+QTMIN=5.14.2
+VIRTUALX_REQUIRED="test"
+inherit ecm kde.org
+
+DESCRIPTION="Certificate manager and GUI for OpenPGP and CMS cryptography"
+HOMEPAGE="https://kde.org/applications/utilities/org.kde.kleopatra"
+
+LICENSE="GPL-2+ handbook? ( FDL-1.2+ )"
+SLOT="5"
+KEYWORDS="~amd64 ~arm64 ~x86"
+IUSE=""
+
+DEPEND="
+ >=app-crypt/gpgme-1.11.1[cxx,qt5]
+ dev-libs/boost:=
+ dev-libs/libassuan
+ dev-libs/libgpg-error
+ >=dev-qt/qtdbus-${QTMIN}:5
+ >=dev-qt/qtgui-${QTMIN}:5
+ >=dev-qt/qtnetwork-${QTMIN}:5
+ >=dev-qt/qtprintsupport-${QTMIN}:5
+ >=dev-qt/qtwidgets-${QTMIN}:5
+ >=kde-apps/kmime-${PVCUT}:5
+ >=kde-apps/libkleo-${PVCUT}:5
+ >=kde-frameworks/kcmutils-${KFMIN}:5
+ >=kde-frameworks/kcodecs-${KFMIN}:5
+ >=kde-frameworks/kconfig-${KFMIN}:5
+ >=kde-frameworks/kconfigwidgets-${KFMIN}:5
+ >=kde-frameworks/kcoreaddons-${KFMIN}:5
+ >=kde-frameworks/kdbusaddons-${KFMIN}:5
+ >=kde-frameworks/ki18n-${KFMIN}:5
+ >=kde-frameworks/kiconthemes-${KFMIN}:5
+ >=kde-frameworks/kitemmodels-${KFMIN}:5
+ >=kde-frameworks/knotifications-${KFMIN}:5
+ >=kde-frameworks/ktextwidgets-${KFMIN}:5
+ >=kde-frameworks/kwidgetsaddons-${KFMIN}:5
+ >=kde-frameworks/kwindowsystem-${KFMIN}:5
+ >=kde-frameworks/kxmlgui-${KFMIN}:5
+"
+RDEPEND="${DEPEND}
+ >=app-crypt/gnupg-2.1
+ app-crypt/paperkey
+"
+
+# tests completely broken, bug #641720
+RESTRICT+=" test"
+
+PATCHES=( "${FILESDIR}/${P}-CVE-2020-24972.patch" )