public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/gpsd-epel] epel10.2: fix command injection in gpsprof (CVE-2026-58459)
@ 2026-09-21 14:38 Troy Dawson
0 siblings, 0 replies; 2+ messages in thread
From: Troy Dawson @ 2026-09-21 14:38 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/gpsd-epel
Branch : epel10.2
Commit : 8ce5c24c282f9bfea90a33258e097a14b2db8336
Author : Troy Dawson <tdawson@redhat.com>
Date : 2026-09-21T07:37:51-07:00
Stats : +177/-1 in 3 file(s)
URL : https://src.fedoraproject.org/rpms/gpsd-epel/c/8ce5c24c282f9bfea90a33258e097a14b2db8336?branch=epel10.2
Log:
fix command injection in gpsprof (CVE-2026-58459)
fix another command injection in gpsprof (CVE-2026-60122)
---
diff --git a/gpsd-cve-2026-58459.patch b/gpsd-cve-2026-58459.patch
new file mode 100644
index 0000000..8e10713
--- /dev/null
+++ b/gpsd-cve-2026-58459.patch
@@ -0,0 +1,130 @@
+commit 5581ba196d826a984fbfaf792b7d58535f9911ce
+Author: Gary E. Miller <gem@rellim.com>
+Date: Wed Jul 1 17:55:57 2026 -0700
+
+ clients/gpsprof.py.in: Quote double quotes in title.
+
+ Someone could use the double quote to break out of the
+ string and add gnuplot commnds.
+
+ For issue 404.
+ Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
+
+diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
+index 5c18f50ff..261e72665 100644
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -198,6 +198,10 @@ class plotter(object):
+ if 'subtype' in self.device:
+ desc += "\\n%s" % self.device['subtype']
+
++ # escape ", and \n, for gnuplot, to not break strings
++ desc = desc.replace('"', '\\042')
++ desc = desc.replace('\n', '')
++
+ return desc
+
+ def collect(self, verb, log_fp=None):
+@@ -1262,10 +1266,10 @@ if __name__ == '__main__':
+ # Ship the plot to standard output
+ if not options.title:
+ options.title = plot.whatami()
+- # escape " for gnuplot
+- options.title = options.title.replace('"', '\\"')
+ if options.subtitle:
+ options.title += '\\n' + options.subtitle
++ # escape " for gnuplot, to not break strings
++ options.title = options.title.replace('"', '\\042')
+ term_opts = ""
+ truecolor_terms = ['png', 'sixelgd', 'wxt']
+ if options.terminal in truecolor_terms:
+
+commit 1a6bb7bcbdf58aa940132e630870af061dc88537
+Author: Gary E. Miller <gem@rellim.com>
+Date: Tue Jul 7 13:41:54 2026 -0700
+
+ clients/gpsprof.py.in: Quote back ticks in title.
+
+ Someone could use the back tick to break out of the string and add
+ gnuplot commnds.
+
+ For issue 404.
+ Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
+
+diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
+index 261e72665..202214769 100644
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -198,8 +198,9 @@ class plotter(object):
+ if 'subtype' in self.device:
+ desc += "\\n%s" % self.device['subtype']
+
+- # escape ", and \n, for gnuplot, to not break strings
++ # escape ", `, and \n, for gnuplot, to not break strings
+ desc = desc.replace('"', '\\042')
++ desc = desc.replace('`', '\\140')
+ desc = desc.replace('\n', '')
+
+ return desc
+@@ -1268,8 +1269,9 @@ if __name__ == '__main__':
+ options.title = plot.whatami()
+ if options.subtitle:
+ options.title += '\\n' + options.subtitle
+- # escape " for gnuplot, to not break strings
++ # escape ", and`, for gnuplot, to not break strings
+ options.title = options.title.replace('"', '\\042')
++ options.title = options.title.replace('"', '\\140')
+ term_opts = ""
+ truecolor_terms = ['png', 'sixelgd', 'wxt']
+ if options.terminal in truecolor_terms:
+
+commit 4c06658e988f4ced1a7a574ce082a22ef625df56
+Author: Gary E. Miller <gem@rellim.com>
+Date: Tue Jul 7 14:23:56 2026 -0700
+
+ clients/gpsprof.py.in: Quote back ticks in title.
+
+ Second try. Also quote "terminal".
+
+ Someone could use the back tick to break out of the string and add
+ gnuplot commnds.
+
+ For issue 404.
+ Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
+
+diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
+index 202214769..e91367ee3 100644
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -200,7 +200,7 @@ class plotter(object):
+
+ # escape ", `, and \n, for gnuplot, to not break strings
+ desc = desc.replace('"', '\\042')
+- desc = desc.replace('`', '\\140')
++ desc = desc.replace("\x60", '\\140')
+ desc = desc.replace('\n', '')
+
+ return desc
+@@ -1271,13 +1271,19 @@ if __name__ == '__main__':
+ options.title += '\\n' + options.subtitle
+ # escape ", and`, for gnuplot, to not break strings
+ options.title = options.title.replace('"', '\\042')
+- options.title = options.title.replace('"', '\\140')
++ options.title = options.title.replace("\x60", '\\140')
+ term_opts = ""
+ truecolor_terms = ['png', 'sixelgd', 'wxt']
+ if options.terminal in truecolor_terms:
+ term_opts = 'truecolor'
+- sys.stdout.write("set terminal %s size 800,950 %s\n"
+- "set termoption enhanced\n"
++
++ # escape ", `, and \n, for gnuplot, to not break strings
++ options.terminal = options.terminal.replace('"', '\\042')
++ options.terminal = options.terminal.replace("\x60", '\\140')
++ options.terminal = options.terminal.replace('\n', '')
++
++ sys.stdout.write('set terminal "%s" size 800,950 %s\n'
++ 'set termoption enhanced\n'
+ % (options.terminal, term_opts))
+ # double quotes on title so \n is parsed by gnuplot
+ sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title)
diff --git a/gpsd-cve-2026-60122.patch b/gpsd-cve-2026-60122.patch
new file mode 100644
index 0000000..0974247
--- /dev/null
+++ b/gpsd-cve-2026-60122.patch
@@ -0,0 +1,36 @@
+commit 5a9c44a42136b9bb98d460a8a716e9fd344a8d93
+Author: Gary E. Miller <gem@rellim.com>
+Date: Mon Jul 20 20:12:16 2026 -0700
+
+ clients/gpsprof.py.in: ensure sats.used is boolean. Issue 406
+
+ Prevfent command injection by sates.used. Force to boolean.
+
+diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
+index e91367ee3..07123d417 100644
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -334,8 +334,11 @@ class spaceplot(plotter):
+ # get sat used count
+ sats_used = 0
+ for sat in self.session.satellites:
+- if sat.used:
++ if sat.used is True:
+ sats_used += 1
++ else:
++ # ensure it is boolean.
++ sat.used = False
+
+ if 'altHAE' not in self.session.data:
+ self.session.data['altHAE'] = gps.NaN
+@@ -783,6 +786,10 @@ class polarplot(plotter):
+ used += 1
+ if 'polarunused' == self.name:
+ continue
++ else:
++ # ensure it is boolean.
++ sat['used'] = False;
++
+ if (('polarused' == self.name and
+ sat['used'] is False)):
+ continue
diff --git a/gpsd-epel.spec b/gpsd-epel.spec
index 40178a0..6986008 100644
--- a/gpsd-epel.spec
+++ b/gpsd-epel.spec
@@ -12,7 +12,7 @@
Name: gpsd-epel
Version: 3.26.1
-Release: 3%{?dist}.1
+Release: 3%{?dist}.2
Epoch: 1
Summary: Service daemon for mediating access to a GPS
@@ -27,6 +27,10 @@ Source11: gpsd.sysconfig
Patch1: gpsd-cve-2025-67268.patch
# fix integer underflow in handling of Navcom packets
Patch2: gpsd-cve-2025-67269.patch
+# fix command injection in gpsprof
+Patch3: gpsd-cve-2026-58459.patch
+# fix another command injection in gpsprof
+Patch4: gpsd-cve-2026-60122.patch
BuildRequires: gcc
BuildRequires: dbus-devel
@@ -256,6 +260,12 @@ rm -rf %{buildroot}%{python3_sitearch}/gps*
%changelog
+* Wed Aug 26 2026 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-3.el10_2.2
+- fix another command injection in gpsprof (CVE-2026-60122)
+
+* Mon Jul 13 2026 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-3.el10_2.1
+- fix command injection in gpsprof (CVE-2026-58459)
+
* Mon Aug 10 2026 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-3.1
- fix command injection in gpsprof (CVE-2026-58459)
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [rpms/gpsd-epel] epel10.2: fix command injection in gpsprof (CVE-2026-58459)
@ 2026-08-17 19:57 Troy Dawson
0 siblings, 0 replies; 2+ messages in thread
From: Troy Dawson @ 2026-08-17 19:57 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/gpsd-epel
Branch : epel10.2
Commit : e65ef732611f9339d9239afdda5f0291af6b7093
Author : Troy Dawson <tdawson@redhat.com>
Date : 2026-08-17T12:57:21-07:00
Stats : +6/-3 in 1 file(s)
URL : https://src.fedoraproject.org/rpms/gpsd-epel/c/e65ef732611f9339d9239afdda5f0291af6b7093?branch=epel10.2
Log:
fix command injection in gpsprof (CVE-2026-58459)
---
diff --git a/gpsd-epel.spec b/gpsd-epel.spec
index 86e76b5..40178a0 100644
--- a/gpsd-epel.spec
+++ b/gpsd-epel.spec
@@ -1,5 +1,5 @@
-# This spec file is derived from the EPEL9 gpsd spec file.
-# Updates come from the CentOS Stream 10 gpsd sgit repo
+# This spec file is derived from the EPEL10 gpsd spec file.
+# Updates come from the Alma Linux 10 and CentOS Stream 10 gpsd git repo
%global rhel_name gpsd
%global with_libs 1
@@ -12,7 +12,7 @@
Name: gpsd-epel
Version: 3.26.1
-Release: 3%{?dist}
+Release: 3%{?dist}.1
Epoch: 1
Summary: Service daemon for mediating access to a GPS
@@ -256,6 +256,9 @@ rm -rf %{buildroot}%{python3_sitearch}/gps*
%changelog
+* Mon Aug 10 2026 Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-3.1
+- fix command injection in gpsprof (CVE-2026-58459)
+
* Mon Jan 26 2026 Troy Dawson <tdawson@redhat.com> - 1:3.26.1-3
- Match RHEL 10 version-release
- fix buffer overflow in NMEA2000 driver (CVE-2025-67268)
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-21 14:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-21 14:38 [rpms/gpsd-epel] epel10.2: fix command injection in gpsprof (CVE-2026-58459) Troy Dawson
-- strict thread matches above, loose matches on Subject: below --
2026-08-17 19:57 Troy Dawson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox