Version in base suite: 3.2.11-3+deb11u7 Base version: spip_3.2.11-3+deb11u7 Target version: spip_3.2.11-3+deb11u8 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/spip/spip_3.2.11-3+deb11u7.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/spip/spip_3.2.11-3+deb11u8.dsc changelog | 10 + patches/0052-security-limiter-la-profondeur-de-recursion-de-prote.patch | 37 +++++ patches/0053-security-Ameliorer-c76770a-en-vitant-un-unserialize-.patch | 64 ++++++++++ patches/0054-security-Effectivement-bloquer-les-fichiers-cach-s-d.patch | 59 +++++++++ patches/0055-build-Up-cran-de-s-cu-en-1.5.3.patch | 51 +++++++ patches/series | 4 6 files changed, 225 insertions(+) diff -Nru spip-3.2.11/debian/changelog spip-3.2.11/debian/changelog --- spip-3.2.11/debian/changelog 2023-02-28 21:51:50.000000000 +0000 +++ spip-3.2.11/debian/changelog 2023-06-11 13:47:39.000000000 +0000 @@ -1,3 +1,13 @@ +spip (3.2.11-3+deb11u8) bullseye; urgency=medium + + * Backport security fixes from 4.1.10 + - Limit recursion depth in protege_champ() function + - Avoid unserialize use in security screen + - Properly block hidden files in provided htaccess + - Update security screen to 1.5.3 + + -- David Prévot Sun, 11 Jun 2023 15:47:39 +0200 + spip (3.2.11-3+deb11u7) bullseye-security; urgency=medium * Backport security fixes from v3.2.18 diff -Nru spip-3.2.11/debian/patches/0052-security-limiter-la-profondeur-de-recursion-de-prote.patch spip-3.2.11/debian/patches/0052-security-limiter-la-profondeur-de-recursion-de-prote.patch --- spip-3.2.11/debian/patches/0052-security-limiter-la-profondeur-de-recursion-de-prote.patch 1970-01-01 00:00:00.000000000 +0000 +++ spip-3.2.11/debian/patches/0052-security-limiter-la-profondeur-de-recursion-de-prote.patch 2023-06-11 13:47:34.000000000 +0000 @@ -0,0 +1,37 @@ +From: Cerdic +Date: Tue, 7 Mar 2023 14:56:30 +0100 +Subject: security: limiter la profondeur de recursion de `protege_champ` + +(cherry picked from commit b362e987b41fac344150f97cc563bf4d8c8181fa) + +Origin: backport, https://git.spip.net/spip/spip/commit/9b73dbd66e50baf312ba1c7df21efebba4ae08f1 +--- + ecrire/balise/formulaire_.php | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/ecrire/balise/formulaire_.php b/ecrire/balise/formulaire_.php +index 34926cf..2b3639b 100644 +--- a/ecrire/balise/formulaire_.php ++++ b/ecrire/balise/formulaire_.php +@@ -33,9 +33,19 @@ include_spip('inc/texte'); + * @return string|array + * Saisie protégée + **/ +-function protege_champ($texte) { ++function protege_champ($texte, $max_prof = 128) { + if (is_array($texte)) { +- $texte = array_map('protege_champ', $texte); ++ // si on dépasse la prof max on tronque ++ if ($max_prof > 0) { ++ return array_map( ++ function($v) use ($max_prof) { ++ return protege_champ($v, $max_prof-1); ++ }, ++ $texte ++ ); ++ } ++ // si on dépasse la prof max on tronque ++ return []; + } else { + if (is_null($texte)) { + return $texte; diff -Nru spip-3.2.11/debian/patches/0053-security-Ameliorer-c76770a-en-vitant-un-unserialize-.patch spip-3.2.11/debian/patches/0053-security-Ameliorer-c76770a-en-vitant-un-unserialize-.patch --- spip-3.2.11/debian/patches/0053-security-Ameliorer-c76770a-en-vitant-un-unserialize-.patch 1970-01-01 00:00:00.000000000 +0000 +++ spip-3.2.11/debian/patches/0053-security-Ameliorer-c76770a-en-vitant-un-unserialize-.patch 2023-06-11 13:47:34.000000000 +0000 @@ -0,0 +1,64 @@ +From: Cerdic +Date: Tue, 7 Mar 2023 15:03:08 +0100 +Subject: =?utf-8?q?security=3A_Ameliorer_c76770a_en_=C3=A9vitant_un_=60unse?= + =?utf-8?q?rialize=60_dans_l=27=C3=A9cran_de_s=C3=A9curit=C3=A9?= + +(cherry picked from commit 9b1c3cf455b624163546f1521148897a5c96d5d6) + +Origin: upstream, https://git.spip.net/spip/spip/commit/9f55790164f7869d2e315a49b3fdc4af0c5b8fdd +--- + config/ecran_securite.php | 36 ++++++++++++++++++++++++++++++------ + 1 file changed, 30 insertions(+), 6 deletions(-) + +diff --git a/config/ecran_securite.php b/config/ecran_securite.php +index 57fc42f..4112e2e 100644 +--- a/config/ecran_securite.php ++++ b/config/ecran_securite.php +@@ -557,17 +557,41 @@ if ( + ) { + foreach ($_REQUEST as $k => $v) { + if (is_string($v) +- and strpos($v, ':') !== false +- and strpos($v, '"') !==false +- and preg_match(',[bidsaO]:,', $v) +- and @unserialize($v)) { +- $_REQUEST[$k] = htmlentities($v); ++ and strpbrk($v, "&\"'<>") !== false ++ and preg_match(',^[abis]:\d+[:;],', $v) ++ and __ecran_test_if_serialized($v) ++ ) { ++ $_REQUEST[$k] = htmlspecialchars($v, ENT_QUOTES); + if (isset($_POST[$k])) $_POST[$k] = $_REQUEST[$k]; + if (isset($_GET[$k])) $_GET[$k] = $_REQUEST[$k]; + } + } + } +- ++/** ++ * Version simplifiée de https://developer.wordpress.org/reference/functions/is_serialized/ ++ */ ++function __ecran_test_if_serialized($data) { ++ $data = trim($data); ++ if ('N;' === $data) {return true;} ++ if (strlen($data) < 4) {return false;} ++ if (':' !== $data[1]) {return false;} ++ $semicolon = strpos($data, ';'); ++ $brace = strpos($data, '}'); ++ // Either ; or } must exist. ++ if (false === $semicolon && false === $brace) {return false;} ++ // But neither must be in the first X characters. ++ if (false !== $semicolon && $semicolon < 3) {return false;} ++ if (false !== $brace && $brace < 4) {return false;} ++ $token = $data[0]; ++ if (in_array($token, array('s', 'S'))) { ++ if (false === strpos($data, '"')) {return false;} ++ } elseif (in_array($token, array('a', 'O', 'C', 'o', 'E'))) { ++ return (bool)preg_match("/^{$token}:[0-9]+:/s", $data); ++ } elseif (in_array($token, array('b', 'i', 'd'))) { ++ return (bool)preg_match("/^{$token}:[0-9.E+-]+;/", $data); ++ } ++ return false; ++} + + /* + * S'il y a une raison de mourir, mourons diff -Nru spip-3.2.11/debian/patches/0054-security-Effectivement-bloquer-les-fichiers-cach-s-d.patch spip-3.2.11/debian/patches/0054-security-Effectivement-bloquer-les-fichiers-cach-s-d.patch --- spip-3.2.11/debian/patches/0054-security-Effectivement-bloquer-les-fichiers-cach-s-d.patch 1970-01-01 00:00:00.000000000 +0000 +++ spip-3.2.11/debian/patches/0054-security-Effectivement-bloquer-les-fichiers-cach-s-d.patch 2023-06-11 13:47:34.000000000 +0000 @@ -0,0 +1,59 @@ +From: Matthieu Marcillaud +Date: Wed, 7 Jun 2023 09:40:00 +0200 +Subject: =?utf-8?q?security=3A_Effectivement_bloquer_les_fichiers_cach?= + =?utf-8?q?=C3=A9s_dans_le_htaccess?= +MIME-Version: 1.0 +Content-Type: text/plain; charset="utf-8" +Content-Transfer-Encoding: 8bit + +L’histoire est quelque peu ubuesque, et remonte à il y a 16 ans via 26a1f4906d23 +qui a déplacé des règles trop bas. Ça ne bloquait plus les .svn depuis, +à cause du fait que plus haut, si c’est un fichier, on exécute la règle +`[S=100]` qui saute les prochaines `RewriteRule`. + +- #5109 a semblé corriger en utilisant `RedirectMatch`, qui n’est pas affecté + par le Skip (sans se rendre compte du problème initial) +- #5432 a remis une `RewriteRule`, et du coup, de nouveau paf. + +Ce n’est pas toujours très visible car les serveurs eux-mêmes bloquent +déjà souvent ces répertoires cachés. + +Donc, on remonte bien plus haut les règles de blocage des fichiers cachés +et on leur fait un titre dédié. + +Refs: #5109 #5432 spip-team/securite#4844 +(cherry picked from commit d50cb7bbc7a71ff23a77dfe02215c16991437336) + +Origin: backport, https://git.spip.net/spip/spip/commit/36ec7947e96e44af095c3cf87f25cf27a963fe40 +--- + htaccess.txt | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/htaccess.txt b/htaccess.txt +index ec4e51d..e7a699c 100644 +--- a/htaccess.txt ++++ b/htaccess.txt +@@ -58,6 +58,13 @@ RewriteCond %{QUERY_STRING} action=ical + RewriteRule spip.php spip.php?page=ical_prive [QSA,L] + + ### ++ ++# bloquer les acces aux fichiers caches (.svn, .git, etc) ++RewriteCond %{REQUEST_URI} !^/.well-known/ ++RewriteRule "(^|/)\." - [R=404,NC,L] ++# bloquer les informations Composer ++RedirectMatch 404 ^/composer\.(json|lock|phar)$ ++ + # Si le fichier ou repertoire demande existe + # ignorer toutes les regles qui suivent + +@@ -123,9 +130,6 @@ RewriteRule ^[^\.]+(\.html)?$ spip.php [QSA,E=url_propre:$0,L] + ### + # Divers + +-# bloquer les acces aux fichiers caches (.svn, .git, etc) +-RewriteRule /\\..*(/.*|$) - [F] +- + ### + # Fichiers "standards" (si absents de la racine) + # diff -Nru spip-3.2.11/debian/patches/0055-build-Up-cran-de-s-cu-en-1.5.3.patch spip-3.2.11/debian/patches/0055-build-Up-cran-de-s-cu-en-1.5.3.patch --- spip-3.2.11/debian/patches/0055-build-Up-cran-de-s-cu-en-1.5.3.patch 1970-01-01 00:00:00.000000000 +0000 +++ spip-3.2.11/debian/patches/0055-build-Up-cran-de-s-cu-en-1.5.3.patch 2023-06-11 13:47:34.000000000 +0000 @@ -0,0 +1,51 @@ +From: Matthieu Marcillaud +Date: Wed, 7 Jun 2023 12:12:57 +0200 +Subject: =?utf-8?q?build=3A_Up_=C3=A9cran_de_s=C3=A9cu_en_1=2E5=2E3?= + +Origin: upstream, https://git.spip.net/spip/spip/commit/536192d895c051b0859374710fbdd5bf15205e3f +--- + config/ecran_securite.php | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/config/ecran_securite.php b/config/ecran_securite.php +index 4112e2e..5118d55 100644 +--- a/config/ecran_securite.php ++++ b/config/ecran_securite.php +@@ -5,7 +5,7 @@ + * ------------------ + */ + +-define('_ECRAN_SECURITE', '1.5.0'); // 2023-02-27 ++define('_ECRAN_SECURITE', '1.5.3'); // 2023-05-31 + + /* + * Documentation : http://www.spip.net/fr_article4200.html +@@ -553,7 +553,7 @@ if ( + } + + if ( +- isset($_REQUEST['formulaire_action_args']) ++ isset($_REQUEST['formulaire_action_args']) || isset($_REQUEST['var_login']) + ) { + foreach ($_REQUEST as $k => $v) { + if (is_string($v) +@@ -583,9 +583,8 @@ function __ecran_test_if_serialized($data) { + if (false !== $semicolon && $semicolon < 3) {return false;} + if (false !== $brace && $brace < 4) {return false;} + $token = $data[0]; +- if (in_array($token, array('s', 'S'))) { +- if (false === strpos($data, '"')) {return false;} +- } elseif (in_array($token, array('a', 'O', 'C', 'o', 'E'))) { ++ if (in_array($token, array('s', 'S', 'a', 'O', 'C', 'o', 'E'))) { ++ if (in_array($token, array('s', 'S')) and false === strpos($data, '"')) {return false;} + return (bool)preg_match("/^{$token}:[0-9]+:/s", $data); + } elseif (in_array($token, array('b', 'i', 'd'))) { + return (bool)preg_match("/^{$token}:[0-9.E+-]+;/", $data); +@@ -593,6 +592,7 @@ function __ecran_test_if_serialized($data) { + return false; + } + ++ + /* + * S'il y a une raison de mourir, mourons + */ diff -Nru spip-3.2.11/debian/patches/series spip-3.2.11/debian/patches/series --- spip-3.2.11/debian/patches/series 2023-02-28 21:51:50.000000000 +0000 +++ spip-3.2.11/debian/patches/series 2023-06-11 13:47:34.000000000 +0000 @@ -49,3 +49,7 @@ 0049-Fix-Sanitizer-toutes-les-valeurs-pass-es-aux-formula.patch 0050-fix-Sanitizer-toutes-les-valeurs-pass-es-aux-formula.patch 0051-fix-Correction-des-ordres-_todo-adress-es-SVP.patch +0052-security-limiter-la-profondeur-de-recursion-de-prote.patch +0053-security-Ameliorer-c76770a-en-vitant-un-unserialize-.patch +0054-security-Effectivement-bloquer-les-fichiers-cach-s-d.patch +0055-build-Up-cran-de-s-cu-en-1.5.3.patch