Version in base suite: 1.8.0.3-1 Base version: socat_1.8.0.3-1 Target version: socat_1.8.0.3-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/socat/socat_1.8.0.3-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/socat/socat_1.8.0.3-1+deb13u1.dsc changelog | 6 ++ patches/CVE-2026-56123.patch | 122 +++++++++++++++++++++++++++++++++++++++++++ patches/series | 1 3 files changed, 129 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmprgxj6kee/socat_1.8.0.3-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmprgxj6kee/socat_1.8.0.3-1+deb13u1.dsc: no acceptable signature found diff -Nru socat-1.8.0.3/debian/changelog socat-1.8.0.3/debian/changelog --- socat-1.8.0.3/debian/changelog 2025-03-31 20:50:04.000000000 +0000 +++ socat-1.8.0.3/debian/changelog 2026-09-03 20:58:48.000000000 +0000 @@ -1,3 +1,9 @@ +socat (1.8.0.3-1+deb13u1) trixie; urgency=medium + + * CVE-2026-56123 + + -- Moritz Mühlenhoff Thu, 03 Sep 2026 22:58:48 +0200 + socat (1.8.0.3-1) unstable; urgency=medium [ Bastian Germann ] diff -Nru socat-1.8.0.3/debian/patches/CVE-2026-56123.patch socat-1.8.0.3/debian/patches/CVE-2026-56123.patch --- socat-1.8.0.3/debian/patches/CVE-2026-56123.patch 1970-01-01 00:00:00.000000000 +0000 +++ socat-1.8.0.3/debian/patches/CVE-2026-56123.patch 2026-09-03 20:57:59.000000000 +0000 @@ -0,0 +1,122 @@ +From d44cd1cc4fbb70a9ae9e71890024ae8367fcb912 Mon Sep 17 00:00:00 2001 +From: Gerhard Rieger +Date: Thu, 25 Jun 2026 14:55:59 +0200 +Subject: [PATCH] Version 1.8.1.2 - fixed SOCKS5 client buffer overflow + (CVE-2026-56123) + +From af5388c898c7bb60997935aee93c223deba60c4a Mon Sep 17 00:00:00 2001 +From: Gerhard Rieger +Date: Fri, 26 Jun 2026 07:53:54 +0200 +Subject: [PATCH] Version 1.8.1.3 - corrected test for non-bash + + +--- socat-1.8.0.3.orig/test.sh ++++ socat-1.8.0.3/test.sh +@@ -615,6 +615,9 @@ rm -rf "$TD" || (echo "cannot rm $TD" >& + mkdir -p "$TD" + #trap "rm -r $TD" 0 3 + ++BINDIR=$td/bin ++mkdir -p $BINDIR ++ + echo "Using temp directory $TD" + + RESULTS="$TD/results.txt" # file for list of results +@@ -20412,6 +20415,77 @@ PROXY tcp CONNECT 127.0.0.1:80 proxyp + # test combined 4_6/6_4 with retry and fork + + ++# Above tests introduced with 1.8.1.0 (none with 1.8.1.1) ++#============================================================================== ++# Below tests introduced with 1.8.1.2 ++ ++ ++# Test socks5 client buffer overflow (CVE-2026-56123) ++NAME=SOCKS5_OVERFL ++case "$TESTS" in ++*%$N%*|*%functions%*|*%bugs%*|*%security%*|*%socks5%*|*%socks%*|*%%*|*%%*|*%socket%*|*%$NAME%*) ++#*%internet%*|*%root%*|*%listen%*|*%fork%*|*%ip4%*|*%tcp4%*|*%bug%*|... ++TEST="$NAME: socks5 client buffer overflow" ++# Start a listener that emulates a malicious socks5 server, using a temporary ++# shell script; ++# connect using Socat with socks5 client; ++# when is terminates with rc=0 the test succeeded (not vulnerable) ++if ! eval $NUMCOND; then : ++# Check if this test can be performed meaningfully ++elif ! cond=$(checkconds \ ++ "" \ ++ "" \ ++ "" \ ++ "IP4 TCP LISTEN SHELL GOPEN SOCKS5" \ ++ "TCP4-LISTEN SHELL GOPEN SOCKS5" \ ++ "socksport" \ ++ "tcp4" ); then ++ $PRINTF "test $F_n $TEST... ${YELLOW}$cond${NORMAL}\n" $N ++ cant ++else ++ mkdir -p "$BINDIR" ++ tf="$td/test$N.stdout" ++ te="$td/test$N.stderr" ++ tdiff="$td/test$N.diff" ++ tsh="$BINDIR/test$N.sh" ++ cat >"$tsh" <<__EOF__ ++#! /usr/bin/env bash ++$ECHO -n "\\x05\\x00" ++relsleep 1 ++$ECHO -n "\\x05\\x00\\x00\\x03\\xfdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ++__EOF__ ++ chmod a+x "$tsh" ++ newport tcp4 # -> PORT ++ CMD0="$TRACE $SOCAT $opts TCP4-LISTEN:$PORT SHELL:$tsh" ++ CMD1="$TRACE $SOCAT $opts /dev/null SOCKS5:$LOCALHOST4:17.34.51.68:85,socksport=$PORT" ++ printf "test $F_n $TEST... " $N ++ $CMD0 >/dev/null 2>"${te}0" & ++ pid0=$! ++ waittcp4port $PORT 1 ++ $CMD1 >"${tf}1" 2>"${te}1" ++ rc1=$? ++ kill $pid0 2>/dev/null; wait ++ if [ "$rc1" -ne 0 ]; then ++ $PRINTF "$FAILED (rc1=$rc1)\n" ++ echo "$CMD0 &" ++ cat "${te}0" >&2 ++ echo "$CMD1" ++ cat "${te}1" >&2 ++ failed ++ else ++ $PRINTF "$OK\n" ++ if [ "$VERBOSE" ]; then echo "$CMD0 &"; fi ++ if [ "$DEBUG" ]; then cat "${te}0" >&2; fi ++ if [ "$VERBOSE" ]; then echo "$CMD1"; fi ++ if [ "$DEBUG" ]; then cat "${te}1" >&2; fi ++ ok ++ fi ++fi # NUMCOND ++ ;; ++esac ++N=$((N+1)) ++ ++ + # end of common tests + + ################################################################################## +--- socat-1.8.0.3.orig/xio-socks5.h ++++ socat-1.8.0.3/xio-socks5.h +@@ -23,7 +23,7 @@ struct socks5_request { + uint8_t command; + uint8_t reserved; + uint8_t address_type; +- char dstdata[]; ++ unsigned char dstdata[]; + }; + + struct socks5_reply { +@@ -31,7 +31,7 @@ struct socks5_reply { + uint8_t reply; + uint8_t reserved; + uint8_t address_type; +- char dstdata[]; ++ unsigned char dstdata[]; + }; + + extern const struct addrdesc xioaddr_socks5_connect; diff -Nru socat-1.8.0.3/debian/patches/series socat-1.8.0.3/debian/patches/series --- socat-1.8.0.3/debian/patches/series 2025-03-31 20:50:04.000000000 +0000 +++ socat-1.8.0.3/debian/patches/series 2026-09-03 20:57:15.000000000 +0000 @@ -5,3 +5,4 @@ 07-compat-define-PATH_MAX.patch 08-test.sh-fixes.patch 09-xioinitialize.c.patch +CVE-2026-56123.patch