From 508a2e6b942d4ff16ec23cc808464fcd9506ddc4 Mon Sep 17 00:00:00 2001 From: Peter Marko Date: Thu, 7 Nov 2024 22:58:49 +0100 Subject: squid: handle CVE-2024-45802 According to [1] the ESI implementation in squid feature is vulnerable without any fix available. NVD says it's fixed in 6.10, however the change in this release only disables ESI by default (which we always did via PACKAGECONFIG). This means CVE report would say Patched even if the vulnerability is still present if someone adapts squid PACKAGECONFIG. Commit in master branch related to this CVE is [2]. Title is "Remove Edge Side Include (ESI) protocol" and it's also what it does. So there will never be a fix for these ESI vulnerabilities. Based on this, remove vulnerable ESI PACKAGECONFIG already now. [1] https://github.com/squid-cache/squid/security/advisories/GHSA-f975-v7qw-q7hj [2] https://github.com/squid-cache/squid/commit/5eb89ef3d828caa5fc43cd8064f958010dbc8158 Signed-off-by: Peter Marko Signed-off-by: Khem Raj --- meta-networking/recipes-daemons/squid/squid_6.12.bb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'meta-networking') diff --git a/meta-networking/recipes-daemons/squid/squid_6.12.bb b/meta-networking/recipes-daemons/squid/squid_6.12.bb index cc3d2f25db..a697f21836 100644 --- a/meta-networking/recipes-daemons/squid/squid_6.12.bb +++ b/meta-networking/recipes-daemons/squid/squid_6.12.bb @@ -48,7 +48,6 @@ PACKAGECONFIG ??= "auth url-rewrite-helpers \ PACKAGECONFIG[libnetfilter-conntrack] = "--with-netfilter-conntrack=${includedir}, --without-netfilter-conntrack, libnetfilter-conntrack" PACKAGECONFIG[ipv6] = "--enable-ipv6,--disable-ipv6," PACKAGECONFIG[werror] = "--enable-strict-error-checking,--disable-strict-error-checking," -PACKAGECONFIG[esi] = "--enable-esi,--disable-esi,expat libxml2" PACKAGECONFIG[ssl] = "--with-openssl=yes,--with-openssl=no,openssl" PACKAGECONFIG[auth] = "--enable-auth-basic='${BASIC_AUTH}',--disable-auth --disable-auth-basic,krb5 openldap db cyrus-sasl" PACKAGECONFIG[url-rewrite-helpers] = "--enable-url-rewrite-helpers,--disable-url-rewrite-helpers," @@ -67,7 +66,9 @@ BASIC_AUTH += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'PAM', '', d)}" EXTRA_OECONF += "--with-default-user=squid \ --sysconfdir=${sysconfdir}/${BPN} \ --with-logdir=${localstatedir}/log/${BPN} \ - 'PERL=${USRBINPATH}/env perl'" + 'PERL=${USRBINPATH}/env perl' \ + --disable-esi \ +" # Workaround a build failure when using a native compiler that need -std=c++17 # with a cross-compiler that doesn't. -- cgit v1.2.3-54-g00ecf