[cpp-sp] 01/03: Add upstream security fix for cert subjects containing nuls

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to annotated tag debian/2.0.dfsg1-4+lenny1
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=0946ae4e77da819e93f43775dd85a97bf8a62469

commit 0946ae4e77da819e93f43775dd85a97bf8a62469
Author: Russ Allbery <rra at debian.org>
AuthorDate: Thu Sep 17 18:36:51 2009 -0700

    Add upstream security fix for cert subjects containing nuls
    
    * SECURITY: Shibboleth incorrectly matched certificate subject names
      against trusted "key names" when they contained nul characters.  This
      affects only deployments relying on the "PKIX" style of trust
      validation, used in the absence of explicit certificate information in
      the SAML metadata provided to the SP and reliance on certificate
      authorities found in the <KeyAuthority> metadata extension element.
      See <http://shibboleth.internet2.edu/secadv/secadv_20090817.txt>.
---
 apache/mod_apache.cpp |  5 +++--
 debian/changelog      | 12 ++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/apache/mod_apache.cpp b/apache/mod_apache.cpp
index c5106dd..c5fabab 100644
--- a/apache/mod_apache.cpp
+++ b/apache/mod_apache.cpp
@@ -1114,8 +1114,9 @@ AccessControl::aclresult_t htAccessControl::authorized(const SPRequest& request,
                         re=temp;
                     }
                     
-                    for (; !status && attrs.first!=attrs.second; ++attrs.first) {
-                        if (checkAttribute(request, attrs.first->second, w, regexp ? re.get() : NULL)) {
+                    pair<multimap<string,const Attribute*>::const_iterator,multimap<string,const Attribute*>::const_iterator> attrs2(attrs);
+                    for (; !status && attrs2.first!=attrs2.second; ++attrs2.first) {
+                        if (checkAttribute(request, attrs2.first->second, w, regexp ? re.get() : NULL)) {
                             status = true;
                         }
                     }
diff --git a/debian/changelog b/debian/changelog
index a54b567..4c64ae1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+shibboleth-sp2 (2.0.dfsg1-4+lenny1) UNRELEASED; urgency=low
+
+  * SECURITY: Shibboleth incorrectly matched certificate subject names
+    against trusted "key names" when they contained nul characters.  This
+    affects only deployments relying on the "PKIX" style of trust
+    validation, used in the absence of explicit certificate information in
+    the SAML metadata provided to the SP and reliance on certificate
+    authorities found in the <KeyAuthority> metadata extension element.
+    See <http://shibboleth.internet2.edu/secadv/secadv_20090817.txt>.
+
+ -- Russ Allbery <rra at debian.org>  Thu, 17 Sep 2009 18:36:03 -0700
+
 shibboleth-sp2 (2.0.dfsg1-4) unstable; urgency=low
 
   [ Ferenc Wagner ]

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.