Star0
4
代码
代码
Issues2
Pull Requests4
项目讨论
Wiki
分析
Star0
4
已开启
Fix CVE-2026-70367 in stunnel #23
G7egHN创建于 8月18日
Fix CVE-2026-70367 in stunnel #23
已开启
G7egHN创建于 8月18日
从G7egHN/stunnelfix-cve-2026-70367-2403sp4合入到src-openeuler/stunnelopenEuler-24.03-LTS-SP4
共 2 个文件变更+117-1
ACVE-2026-70367.patch+112-0
@@ -0,0 +1,112 @@
1+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2+From: G7egHN <3120705253@qq.com>
3+Date: Tue, 18 Aug 2026 21:15:00 +0800
4+Subject: [PATCH] Fix CVE-2026-70367
5+ 
6+Backport the stunnel 5.80 SOCKS destination filter hardening. SOCKS
7+server mode must reject alternate local-address representations such as
8+0.0.0.0, ::, IPv4-compatible loopback, and IPv4-mapped IPv6 loopback.
9+ 
10+Reference: https://www.stunnel.org/CVE-2026-70367.html
11+Upstream: stunnel-5.80 src/protocol.c SOCKS address validation changes
12+---
13+ src/protocol.c | 61 ++++++++++++++++++++++++++++++++++++++++++++------
14+ 1 file changed, 46 insertions(+), 15 deletions(-)
15+ 
16+diff --git a/src/protocol.c b/src/protocol.c
17+index 91a61d6..a9c36f0 100644
18+--- a/src/protocol.c
19++++ b/src/protocol.c
20+@@ -47,6 +47,10 @@ NOEXPORT void socks_server_late(CLI *);
21+ NOEXPORT void socks4_server(CLI *);
22+ NOEXPORT void socks5_server_method(CLI *);
23+ NOEXPORT void socks5_server(CLI *);
24++NOEXPORT int socks_ipv4_addr_prohibited(const unsigned char *);
25++#ifdef USE_IPv6
26++NOEXPORT int socks_ipv6_addr_prohibited(const unsigned char *);
27++#endif
28+ NOEXPORT int validate(CLI *);
29+ NOEXPORT char *proxy_server(CLI *, SERVICE_OPTIONS *, const PHASE);
30+ NOEXPORT char *cifs_client(CLI *, SERVICE_OPTIONS *, const PHASE);
31+@@ -534,37 +538,64 @@ NOEXPORT void socks5_server(CLI *c) {
32+ throw_exception(c, 2); /* don't reset */
33+ }
34+
35++NOEXPORT int socks_ipv4_addr_prohibited(const unsigned char *addr) {
36++ return (!addr[0] && !addr[1] && !addr[2] && !addr[3]) ||
37++ addr[0]==0x7f;
38++}
39++
40++#ifdef USE_IPv6
41++NOEXPORT int socks_ipv6_addr_prohibited(const unsigned char *addr) {
42++ const unsigned char ipv6_unspecified[16]={0};
43++ const unsigned char ipv6_loopback[16]={0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1};
44++ const unsigned char ipv4_mapped_prefix[12]={
45++ 0,0,0,0,0,0,0,0,0,0,0xff,0xff};
46++
47++ if(!memcmp(addr, ipv6_unspecified, 16) ||
48++ !memcmp(addr, ipv6_loopback, 16))
49++ return 1;
50++ if(!memcmp(addr, ipv6_unspecified, 12) &&
51++ socks_ipv4_addr_prohibited(addr+12))
52++ return 1;
53++ if(!memcmp(addr, ipv4_mapped_prefix, 12) &&
54++ socks_ipv4_addr_prohibited(addr+12))
55++ return 1;
56++ return 0;
57++}
58++#endif
59++
60+ /* validate the allocated address */
61+ NOEXPORT int validate(CLI *c) {
62+-#ifdef USE_IPv6
63+- const unsigned char ipv6_loopback[16]={0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1};
64+-#endif
65+ unsigned i;
66+
67+ for(i=0; i<c->connect_addr.num; ++i) {
68+ SOCKADDR_UNION *addr=&c->connect_addr.addr[i];
69++ int prohibited;
70+ #ifdef USE_IPv6
71+ if(addr->sa.sa_family==AF_INET6) {
72+- if(!memcmp(&addr->in6.sin6_addr, ipv6_loopback, 16)) {
73+- s_log(LOG_ERR,
74+- "SOCKS connection to the IPv6 loopback rejected");
75+- return 0;
76+- }
77+- /* TODO: implement more checks */
78++ const unsigned char *bytes=
79++ (const unsigned char *)&addr->in6.sin6_addr;
80++ /* A link-local address scoped to a loopback interface reaches
81++ * the local host on some systems. Conservatively reject all
82++ * interface-scoped destinations. */
83++ prohibited=addr->in6.sin6_scope_id ||
84++ socks_ipv6_addr_prohibited(bytes);
85+ } else
86+ #endif
87+ if(addr->sa.sa_family==AF_INET) {
88+- if((ntohl(addr->in.sin_addr.s_addr)&0xff000000)==0x7f000000) {
89+- s_log(LOG_ERR,
90+- "SOCKS connection to the IPv4 loopback rejected");
91+- return 0;
92+- }
93+- /* TODO: implement more checks */
94++ const unsigned char *bytes=
95++ (const unsigned char *)&addr->in.sin_addr;
96++ prohibited=socks_ipv4_addr_prohibited(bytes);
97+ } else {
98+ s_log(LOG_ERR, "Unsupported address type 0x%02x",
99+ addr->sa.sa_family);
100+ return 0;
101+ }
102++ if(prohibited) {
103++ char *addr_txt=s_ntop(addr, addr_len(addr));
104++ s_log(LOG_ERR, "SOCKS connection to %s rejected", addr_txt);
105++ str_free(addr_txt);
106++ return 0;
107++ }
108+ }
109+ return 1;
110+ }
111+--
112+2.45.0
Mstunnel.spec+5-1
@@ -1,12 +1,13 @@
1Name: stunnel1Name: stunnel
2Version: 5.692Version: 5.69
3-Release: 13+Release: 2
4Summary: Secure traffic running between a TCP client and server4Summary: Secure traffic running between a TCP client and server
5License: GPLv25License: GPLv2
6URL: http://www.stunnel.org/6URL: http://www.stunnel.org/
7Source0: https://www.usenix.org.uk/mirrors/stunnel/archive/5.x/%{name}-%{version}.tar.gz7Source0: https://www.usenix.org.uk/mirrors/stunnel/archive/5.x/%{name}-%{version}.tar.gz
8Source1: https://www.usenix.org.uk/mirrors/stunnel/archive/5.x/%{name}-%{version}.tar.gz.asc8Source1: https://www.usenix.org.uk/mirrors/stunnel/archive/5.x/%{name}-%{version}.tar.gz.asc
9Source2: stunnel@.service9Source2: stunnel@.service
10+Patch0: CVE-2026-70367.patch
10 11 
11BuildRequires: pkgconfig util-linux autoconf automake libtool compat-openssl11-devel12BuildRequires: pkgconfig util-linux autoconf automake libtool compat-openssl11-devel
12BuildRequires: perl-podlators perl nmap-ncat lsof procps-ng systemd13BuildRequires: perl-podlators perl nmap-ncat lsof procps-ng systemd
@@ -88,6 +89,9 @@ install -D %{SOURCE2} %{buildroot}%{_unitdir}/%{name}@.service
88%exclude %{_datadir}/doc/stunnel89%exclude %{_datadir}/doc/stunnel
89 90 
90%changelog91%changelog
92+* Tue Aug 18 2026 G7egHN <3120705253@qq.com> - 5.69-2
93+- Fix CVE-2026-70367
94+ 
91* Wed Apr 19 2023 yaoxin <yao_xin001@hoperun.com> - 5.69-195* Wed Apr 19 2023 yaoxin <yao_xin001@hoperun.com> - 5.69-1
92- Update to 5.6996- Update to 5.69
93 97