public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/erlang] f43: Backport fix for CVE-2026-55953
@ 2026-09-07 13:29 Peter Lemenkov
0 siblings, 0 replies; only message in thread
From: Peter Lemenkov @ 2026-09-07 13:29 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/erlang
Branch : f43
Commit : 6e80bd0d6e5d95f3cf91eb11fb742487fcf0b066
Author : Peter Lemenkov <lemenkov@gmail.com>
Date : 2026-09-07T15:27:13+02:00
Stats : +147/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/erlang/c/6e80bd0d6e5d95f3cf91eb11fb742487fcf0b066?branch=f43
Log:
Backport fix for CVE-2026-55953
Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
---
diff --git a/erlang.spec b/erlang.spec
index 34b5120..c94ed0e 100644
--- a/erlang.spec
+++ b/erlang.spec
@@ -70,7 +70,7 @@
Name: erlang
Version: 26.2.5.21
-Release: 5%{?dist}
+Release: 6%{?dist}
Summary: General-purpose programming language and runtime environment
License: Apache-2.0
@@ -116,6 +116,7 @@ Patch14: otp-0014-Fix-extended-data-infinite-loop-in-sftpd.patch
Patch15: otp-0015-ssl-TLS-Client-hardening.patch
Patch16: otp-0016-ssl-Add-PSK-parameter-check.patch
Patch17: otp-0017-ssl-Add-pre-TLS-1.3-client-cipher-suite-check.patch
+Patch18: otp-0018-inets-Fix-rejection-of-invalid-chunk-sizes.patch
# end of autogenerated patch tag list
BuildRequires: gcc
@@ -1964,6 +1965,9 @@ ERL_TOP=${ERL_TOP} make TARGET=${TARGET} release_tests
%changelog
+* Mon Sep 7 2026 Peter Lemenkov <lemenkov@gmail.com> - 26.2.5.21-6
+- Backport fix for CVE-2026-55953
+
* Thu Jul 30 2026 Peter Lemenkov <lemenkov@gmail.com> - 26.2.5.21-5
- Backport fix for CVE-2026-55953
diff --git a/otp-0018-inets-Fix-rejection-of-invalid-chunk-sizes.patch b/otp-0018-inets-Fix-rejection-of-invalid-chunk-sizes.patch
new file mode 100644
index 0000000..caa9c6d
--- /dev/null
+++ b/otp-0018-inets-Fix-rejection-of-invalid-chunk-sizes.patch
@@ -0,0 +1,142 @@
+From: =?UTF-8?q?Lukas=20Backstr=C3=B6m?= <lukas@erlang.org>
+Date: Mon, 1 Jun 2026 10:26:29 +0200
+Subject: [PATCH] inets: Fix rejection of invalid chunk sizes
+
+Before this fix the server would hang indefinitely without the need
+to send any bytes to keep it running. This causes it to leak a process
+which could be used to DOS the server.
+
+diff --git a/lib/inets/src/http_server/httpd_request_handler.erl b/lib/inets/src/http_server/httpd_request_handler.erl
+index 4f71c115ca..9d28714f17 100644
+--- a/lib/inets/src/http_server/httpd_request_handler.erl
++++ b/lib/inets/src/http_server/httpd_request_handler.erl
+@@ -226,7 +226,6 @@ handle_info({Proto, Socket, Data},
+ (Proto =:= ssl) orelse
+ (Proto =:= dummy)) andalso is_binary(Data)) ->
+
+- PROCESSED = (catch Module:Function([Data | Args])),
+ NewDataSize = case State#state.byte_limit of
+ undefined ->
+ undefined;
+@@ -234,7 +233,7 @@ handle_info({Proto, Socket, Data},
+ State#state.data + byte_size(Data)
+ end,
+
+- case PROCESSED of
++ try Module:Function([Data | Args]) of
+ {ok, Result} ->
+ NewState = case NewDataSize of
+ undefined ->
+@@ -243,13 +242,15 @@ handle_info({Proto, Socket, Data},
+ set_new_data_size(cancel_request_timeout(State), NewDataSize)
+ end,
+ handle_msg(Result, NewState);
++
+ {error, {size_error, MaxSize, ErrCode, ErrStr}, Version} ->
+ NewModData = ModData#mod{http_version = Version},
+ httpd_response:send_status(NewModData, ErrCode, ErrStr, {max_size, MaxSize}),
+ {stop, normal, State#state{response_sent = true,
+ mod = NewModData}};
++
+ {error, {version_error, ErrCode, ErrStr}, Version} ->
+- NewModData = ModData#mod{http_version = Version},
++ NewModData = ModData#mod{http_version = Version},
+ httpd_response:send_status(NewModData, ErrCode, ErrStr),
+ {stop, normal, State#state{response_sent = true,
+ mod = NewModData}};
+@@ -259,17 +260,22 @@ handle_info({Proto, Socket, Data},
+ {stop, normal, State#state{response_sent = true,
+ mod = NewModData}};
+
+- {http_chunk = Module, Function, Args} when ChunkState =/= undefined ->
+- NewState = handle_chunk(Module, Function, Args, State),
+- {noreply, NewState};
+- NewMFA ->
+- setopts(Socket, SockType, [{active, once}]),
++ {http_chunk = Module, Function, Args} when ChunkState =/= undefined ->
++ NewState = handle_chunk(Module, Function, Args, State),
++ {noreply, NewState};
++
++ {_M, _F, _A} = NewMFA ->
++ setopts(Socket, SockType, [{active, once}]),
+ case NewDataSize of
+ undefined ->
+ {noreply, State#state{mfa = NewMFA}};
+ _ ->
+ {noreply, State#state{mfa = NewMFA, data = NewDataSize}}
+ end
++ catch throw:{error, Error} when Module =:= http_chunk ->
++ httpd_response:send_status(ModData, 400,
++ "Bad input", {chunk_decoding, bad_input, Error}),
++ {stop, normal, State#state{response_sent = true}}
+ end;
+
+ %% Error cases
+diff --git a/lib/inets/test/httpd_SUITE.erl b/lib/inets/test/httpd_SUITE.erl
+index 056e7fc664..78620822f6 100644
+--- a/lib/inets/test/httpd_SUITE.erl
++++ b/lib/inets/test/httpd_SUITE.erl
+@@ -127,7 +127,11 @@ groups() ->
+ reload_config_file,
+ reload_invalid_config_survives
+ ]},
+- {post, [], [chunked_post, chunked_chunked_encoded_post, post_204, multiple_content_length_header]},
++ {post, [], [chunked_post,
++ chunked_chunked_encoded_post,
++ post_204,
++ chunked_invalid_chunk_size,
++ multiple_content_length_header]},
+ {basic_auth, [], [basic_auth_1_1, basic_auth_1_0, verify_href_1_1]},
+ {auth_api, [], [auth_api_1_1, auth_api_1_0]},
+ {auth_api_dets, [], [auth_api_1_1, auth_api_1_0]},
+@@ -894,6 +898,50 @@ post_204(Config) ->
+ {args, [SockType, Host, Port, TranspOpts]}]})
+ end.
+
++%% This test used to make httpd hang
++chunked_invalid_chunk_size(Config) ->
++ Host = proplists:get_value(host, Config),
++ Port = proplists:get_value(port, Config),
++ SockType = proplists:get_value(type, Config),
++ TranspOpts = transport_opts(SockType, Config),
++ try inets_test_lib:connect_bin(SockType, Host, Port, TranspOpts) of
++ {ok, Socket} ->
++ RequestStr = "POST /cgi-bin/erl/httpd_example:post_chunked HTTP/1.1\r\n" ++
++ "Host: " ++ Host ++ "\r\n" ++
++ "Transfer-Encoding: chunked\r\n" ++
++ "\r\n",
++ io:format("Sending request with invalid chunked encoding: '~p'~n", [RequestStr]),
++ ok = inets_test_lib:send(SockType, Socket, RequestStr),
++ receive
++ {tcp, Socket, Data} ->
++ io:format("Received response: '~p'~n", [Data]),
++ ct:fail("Expected server to not send a response yet.")
++ after 1000 ->
++ ok
++ end,
++ io:format("Sending request with too large header: '~p'~n", ["zz\r\n"]),
++ ok = inets_test_lib:send(SockType, Socket, "zz\r\n"),
++ receive
++ {tcp, Socket, Data2} ->
++ io:format("Received response: '~p'~n", [Data2]),
++ case binary:match(Data2, <<"400">>,[]) of
++ nomatch ->
++ ct:fail("Expected 400 Bad Request response.");
++ {_, _} ->
++ ok
++ end
++ after 2000 ->
++ ct:fail(connection_timed_out)
++ end
++ catch
++ T:E:Stk ->
++ ct:fail({connect_failure,
++ [{type, T},
++ {error, E},
++ {stacktrace, Stk},
++ {args, [SockType, Host, Port, TranspOpts]}]})
++ end.
++
+ %%-------------------------------------------------------------------------
+ host() ->
+ [{doc, "Test host header"}].
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-07 13:29 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-07 13:29 [rpms/erlang] f43: Backport fix for CVE-2026-55953 Peter Lemenkov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox