已开启
[openEuler-24.03-LTS-SP2] Sync CVE-2026-2332 and CVE-2026-5795 fixes from master #101
byj0创建于 6月5日
[openEuler-24.03-LTS-SP2] Sync CVE-2026-2332 and CVE-2026-5795 fixes from master #101
已开启
共 2 个文件变更+69-1
| @@ -0,0 +1,64 @@ | |||
| 1 | +--- a/jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/JaspiAuthenticator.java 2019-04-11 23:01:26.000000000 +0800 | ||
| 2 | ++++ b/jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/JaspiAuthenticator.java 2026-06-09 09:57:23.539763256 +0800 | ||
| 3 | + | ||
| 4 | + ServerAuthContext authContext = _authConfig.getAuthContext(authContextId, _serviceSubject, _authProperties); | ||
| 5 | + Subject clientSubject = new Subject(); | ||
| 6 | + | ||
| 7 | +- AuthStatus authStatus = authContext.validateRequest(messageInfo, clientSubject, _serviceSubject); | ||
| 8 | ++ AuthStatus authStatus; | ||
| 9 | ++ CallerPrincipalCallback principalCallback; | ||
| 10 | ++ GroupPrincipalCallback groupPrincipalCallback; | ||
| 11 | ++ | ||
| 12 | ++ try | ||
| 13 | ++ { | ||
| 14 | ++ _callbackHandler.clear(); | ||
| 15 | ++ authStatus = authContext.validateRequest(messageInfo, clientSubject, _serviceSubject); | ||
| 16 | ++ principalCallback = _callbackHandler.getThreadCallerPrincipalCallback(); | ||
| 17 | ++ groupPrincipalCallback = _callbackHandler.getThreadGroupPrincipalCallback(); | ||
| 18 | ++ } | ||
| 19 | ++ finally | ||
| 20 | ++ { | ||
| 21 | ++ _callbackHandler.clear(); | ||
| 22 | ++ } | ||
| 23 | + | ||
| 24 | + if (authStatus == AuthStatus.SEND_CONTINUE) return Authentication.SEND_CONTINUE; | ||
| 25 | + if (authStatus == AuthStatus.SEND_FAILURE) return Authentication.SEND_FAILURE; | ||
| 26 | + | ||
| 27 | + { | ||
| 28 | + Set<UserIdentity> ids = clientSubject.getPrivateCredentials(UserIdentity.class); | ||
| 29 | + UserIdentity userIdentity; | ||
| 30 | +- if (ids.size() > 0) | ||
| 31 | ++ if (!ids.isEmpty()) | ||
| 32 | + { | ||
| 33 | + userIdentity = ids.iterator().next(); | ||
| 34 | + } | ||
| 35 | + else | ||
| 36 | + { | ||
| 37 | +- CallerPrincipalCallback principalCallback = _callbackHandler.getThreadCallerPrincipalCallback(); | ||
| 38 | + if (principalCallback == null) { return Authentication.UNAUTHENTICATED; } | ||
| 39 | + Principal principal = principalCallback.getPrincipal(); | ||
| 40 | + if (principal == null) | ||
| 41 | + | ||
| 42 | + } | ||
| 43 | + if (principal == null) { return Authentication.UNAUTHENTICATED; } | ||
| 44 | + } | ||
| 45 | +- GroupPrincipalCallback groupPrincipalCallback = _callbackHandler.getThreadGroupPrincipalCallback(); | ||
| 46 | ++ | ||
| 47 | + String[] groups = groupPrincipalCallback == null ? null : groupPrincipalCallback.getGroups(); | ||
| 48 | + userIdentity = _identityService.newUserIdentity(clientSubject, principal, groups); | ||
| 49 | + } | ||
| 50 | + | ||
| 51 | +--- a/jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/ServletCallbackHandler.java | ||
| 52 | ++++ b/jetty-jaspi/src/main/java/org/eclipse/jetty/security/jaspi/ServletCallbackHandler.java | ||
| 53 | + | ||
| 54 | + _groupPrincipals.set(null); | ||
| 55 | + return groupPrincipalCallback; | ||
| 56 | + } | ||
| 57 | ++ | ||
| 58 | ++ public void clear() | ||
| 59 | ++ { | ||
| 60 | ++ _callerPrincipals.remove(); | ||
| 61 | ++ _groupPrincipals.remove(); | ||
| 62 | ++ } | ||
| 63 | + } | ||
| 64 | + | ||
| @@ -12,7 +12,7 @@ | |||
| 12 | %bcond_with jp_minimal | 12 | %bcond_with jp_minimal |
| 13 | Name: jetty | 13 | Name: jetty |
| 14 | Version: 9.4.16 | 14 | Version: 9.4.16 |
| 15 | -Release: 8 | 15 | +Release: 9 |
| 16 | Summary: Java Webserver and Servlet Container | 16 | Summary: Java Webserver and Servlet Container |
| 17 | License: Apache-2.0 OR EPL-1.0 | 17 | License: Apache-2.0 OR EPL-1.0 |
| 18 | URL: http://www.eclipse.org/jetty/ | 18 | URL: http://www.eclipse.org/jetty/ |
| @@ -33,6 +33,7 @@ Patch8: CVE-2023-26049.patch | |||
| 33 | Patch9: CVE-2023-36479.patch | 33 | Patch9: CVE-2023-36479.patch |
| 34 | Patch10: CVE-2023-40167.patch | 34 | Patch10: CVE-2023-40167.patch |
| 35 | Patch11: CVE-2024-6762.patch | 35 | Patch11: CVE-2024-6762.patch |
| 36 | +Patch12: CVE-2026-5795.patch | ||
| 36 | 37 | ||
| 37 | BuildRequires: maven-local mvn(javax.servlet:javax.servlet-api) < 4.0.0 | 38 | BuildRequires: maven-local mvn(javax.servlet:javax.servlet-api) < 4.0.0 |
| 38 | BuildRequires: mvn(org.apache.felix:maven-bundle-plugin) | 39 | BuildRequires: mvn(org.apache.felix:maven-bundle-plugin) |
| @@ -801,6 +802,9 @@ exit 0 | |||
| 801 | %license LICENSE NOTICE.txt LICENSE-MIT | 802 | %license LICENSE NOTICE.txt LICENSE-MIT |
| 802 | 803 | ||
| 803 | %changelog | 804 | %changelog |
| 805 | +* Fri Jun 05 2026 baiyanjie <baiyanjie@kylinsec.com.cn> - 9.4.16-9 | ||
| 806 | +- Sync from master: Fix CVE-2026-2332 and CVE-2026-5795 | ||
| 807 | + | ||
| 804 | * Tue Nov 05 2024 yaoxin <yao_xin001@hoperun.com> - 9.4.16-8 | 808 | * Tue Nov 05 2024 yaoxin <yao_xin001@hoperun.com> - 9.4.16-8 |
| 805 | - Fix CVE-2024-6762 | 809 | - Fix CVE-2024-6762 |
| 806 | 810 | ||