[rpms/libgsasl] epel8: Fix CVE-2026-48829

[rpms/libgsasl] epel8: Fix CVE-2026-48829

[Peter Lemenkov]

            A new commit has been pushed.

            Repo   : rpms/libgsasl
            Branch : epel8
            Commit : fda6a28949fac978c0a9ec064b1889c367462e61
            Author : Peter Lemenkov <lemenkov@gmail.com>
            Date   : 2026-08-07T13:30:25+02:00
            Stats  : +49/-28 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/libgsasl/c/fda6a28949fac978c0a9ec064b1889c367462e61?branch=epel8

            Log:
            Fix CVE-2026-48829

Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>

---
diff --git a/0001-GSSAPI-server-Boundary-check-gss_wrap-token-read-OOB.patch b/0001-GSSAPI-server-Boundary-check-gss_wrap-token-read-OOB.patch
new file mode 100644
index 0000000..69a14cb
--- /dev/null
+++ b/0001-GSSAPI-server-Boundary-check-gss_wrap-token-read-OOB.patch
@@ -0,0 +1,20 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Simon Josefsson <simon@josefsson.org>
+Date: Fri, 15 Jul 2022 16:23:58 +0200
+Subject: [PATCH] GSSAPI server: Boundary check gss_wrap token (read OOB).
+
+
+diff --git a/lib/gssapi/server.c b/lib/gssapi/server.c
+index 5dca5dc3..4d861c6e 100644
+--- a/lib/gssapi/server.c
++++ b/lib/gssapi/server.c
+@@ -232,6 +232,9 @@ _gsasl_gssapi_server_step (Gsasl_session * sctx,
+          FALSE, and responds with the generated output_message.  The
+          client can then consider the server authenticated. */
+ 
++      if (bufdesc2.length < 4)
++	return GSASL_AUTHENTICATION_ERROR;
++
+       if ((((char *) bufdesc2.value)[0] & GSASL_QOP_AUTH) == 0)
+ 	{
+ 	  /* Integrity or privacy unsupported */

diff --git a/0001-fix-gssapi-server-oob.patch b/0001-fix-gssapi-server-oob.patch
deleted file mode 100644
index 850f392..0000000
--- a/0001-fix-gssapi-server-oob.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Simon Josefsson <simon@josefsson.org>
-Date: Fri, 15 Jul 2022 16:23:58 +0200
-Subject: [PATCH] GSSAPI server: Boundary check gss_wrap token (read OOB).
-Origin: upstream, https://gitlab.com/gsasl/gsasl/-/commit/796e4197f696261c1f872d7576371232330bcc30
-
----
- lib/gssapi/server.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/lib/gssapi/server.c b/lib/gssapi/server.c
-index 5410360b..4ebfda47 100644
---- a/lib/gssapi/server.c
-+++ b/lib/gssapi/server.c
-@@ -218,6 +218,9 @@ _gsasl_gssapi_server_step (Gsasl_session * sctx,
-          FALSE, and responds with the generated output_message.  The
-          client can then consider the server authenticated. */
- 
-+      if (bufdesc2.length < 4)
-+	return GSASL_AUTHENTICATION_ERROR;
-+
-       if ((((char *) bufdesc2.value)[0] & GSASL_QOP_AUTH) == 0)
- 	{
- 	  /* Integrity or privacy unsupported */
--- 
-2.30.2
-

diff --git a/0002-Fix-NULL-pointer-dereference-in-DIGEST-MD5-parser.patch b/0002-Fix-NULL-pointer-dereference-in-DIGEST-MD5-parser.patch
new file mode 100644
index 0000000..069aeb9
--- /dev/null
+++ b/0002-Fix-NULL-pointer-dereference-in-DIGEST-MD5-parser.patch
@@ -0,0 +1,22 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: zhangph <zhangph12138@163.com>
+Date: Wed, 13 May 2026 09:20:31 +0200
+Subject: [PATCH] Fix NULL pointer dereference in DIGEST-MD5 parser
+
+https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00000.html
+
+Signed-off-by: Simon Josefsson <simon@josefsson.org>
+
+diff --git a/lib/digest-md5/getsubopt.c b/lib/digest-md5/getsubopt.c
+index c7210ca4..c8b2cc89 100644
+--- a/lib/digest-md5/getsubopt.c
++++ b/lib/digest-md5/getsubopt.c
+@@ -74,7 +74,7 @@ digest_md5_getsubopt (char **optionp,
+ 	&& tokens[cnt][vstart - *optionp] == '\0')
+       {
+ 	/* We found the current option in TOKENS.  */
+-	*valuep = vstart != endp ? vstart + 1 : NULL;
++	*valuep = vstart != endp ? vstart + 1 : (char *) "";
+ 
+ 	while (*valuep && (**valuep == ' ' ||
+ 			   **valuep == '\t' ||

diff --git a/libgsasl.spec b/libgsasl.spec
index 4a18054..58453d2 100644
--- a/libgsasl.spec
+++ b/libgsasl.spec
@@ -1,12 +1,13 @@
 Name:           libgsasl
 Version:        1.8.0 
-Release:        9%{?dist}
+Release:        10%{?dist}
 Summary:        GNU SASL library 
 Group:          System Environment/Libraries
 License:        LGPLv2+ 
 URL:            http://www.gnu.org/software/gsasl/
 Source0:        ftp://ftp.gnu.org/gnu/gsasl/%{name}-%{version}.tar.gz
-Patch1:         0001-fix-gssapi-server-oob.patch
+Patch1:         0001-GSSAPI-server-Boundary-check-gss_wrap-token-read-OOB.patch
+Patch2:         0002-Fix-NULL-pointer-dereference-in-DIGEST-MD5-parser.patch
 BuildRequires:  libidn-devel
 BuildRequires:  krb5-devel
 BuildRequires:  libntlm-devel
@@ -31,6 +32,7 @@ developing applications that use %{name}.
 %prep
 %setup -q
 %patch -P 1 -p 2
+%patch -P 2 -p 2
 
 %build
 %configure --disable-static --disable-rpath --with-gssapi-impl=mit
@@ -56,6 +58,9 @@ find %{buildroot} -name '*.la' -exec rm -f {} ';'
 %{_libdir}/pkgconfig/libgsasl.pc
 
 %changelog
+* Fri Aug  7 2026 Peter Lemenkov <lemenkov@gmail.com> - 1.8.0-10
+- Fix CVE-2026-48829
+
 * Thu Mar 26 2026 Peter Lemenkov <lemenkov@gmail.com> - 1.8.0-9
 - Fix CVE-2022-2469