Bug#1144493: trixie-pu: package xapian-core/1.4.29-3+deb13u1
Olly Betts <[email protected]>
| Newsgroups | gmane.linux.debian.devel.release |
|---|---|
| Message-ID | <aoD2tzRYtSly13tQ__8590.75681525923$1786836811$gmane$org@survex.com> |
Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:xapian-core User: [email protected] Usertags: pu This fixes #1144490 which is a previously missed corner case of CVE-2018-0499. It's a missing HTML escaping bug. It affects upstream releases 1.4.x for x <= 31 and 2.0.0. Upstream releases 1.4.32 and 2.1.0 include a fix, and I've already uploaded 1.4.32-1 to unstable and 2.1.0-1 to experimental. I've already contacted the security team who decided it was more appropriate to handle via a stable update. [ Impact ] There's potential for unescaped data appearing in HTML search result pages. It is only exploitable with a particular combination of parameters which don't seem to be commonly used in practice (I search codesearch.d.n and didn't locate any examples, though `snippet` is a fairly common function name, and it may be used in code people run on Debian which isn't packaged for Debian). Exploitation would generally also require the attacker can supply documents to the search system, or find suitable document content already in the system. [ Tests ] The patch include regression tests which are automatically run during the package build. [ Risks ] This is a low risk change - the patch is small and not complex, and just changes this code path to use existing escaping functionality already used on other code paths. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] In the affected case, the return value is escaped rather than returned as-is. [ Other info ] I wonder if this should be considered for the stable-updates suite so users get the fix sooner? While it seems an unusual use of the API, for users affected the lack of company won't be much comfort, and it's a low risk patch. Cheers, Olly
xapian-core_1.4.29-3+deb13u1.debdiff
(text/plain, 3.4 KB)
diff -Nru xapian-core-1.4.29/debian/changelog xapian-core-1.4.29/debian/changelog --- xapian-core-1.4.29/debian/changelog 2025-05-02 11:29:34.000000000 +1200 +++ xapian-core-1.4.29/debian/changelog 2026-08-16 09:59:21.000000000 +1200 @@ -1,3 +1,11 @@ +xapian-core (1.4.29-3+deb13u1) trixie; urgency=medium + + * Cherry-pick fix for missed corner case of CVE-2018-0499. New patch: + cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch + (Closes: #1144490) + + -- Olly Betts <[email protected]> Sun, 16 Aug 2026 09:59:21 +1200 + xapian-core (1.4.29-3) unstable; urgency=medium * debian/rules: Drop dependency on debian/control from diff -Nru xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch --- xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch 1970-01-01 12:00:00.000000000 +1200 +++ xapian-core-1.4.29/debian/patches/cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch 2026-08-15 11:41:17.000000000 +1200 @@ -0,0 +1,54 @@ +Description: Fix missing escaping in MSet::snippet() + Fix missing escaping when hi_start and hi_end are empty and the + input string is already within the requested length. +Origin: upstream, commit:b39620db6fa87c7aea83abef1a94dff96444ba29 +Last-Update: 2026-08-14 +Applied-Upstream: 1.4.32 + +--- a/queryparser/termgenerator_internal.cc ++++ b/queryparser/termgenerator_internal.cc +@@ -760,8 +760,11 @@ + const string & omit) const + { + if (hi_start.empty() && hi_end.empty() && text.size() <= length) { +- // Too easy! +- return text; ++ // The text is already short enough so we just need to perform ++ // escaping. ++ string output; ++ append_escaping_xml(text.data(), text.data() + text.size(), output); ++ return output; + } + + bool try_word_break = (flags & MSet::SNIPPET_CJK_NGRAM); +--- a/tests/api_snippets.cc ++++ b/tests/api_snippets.cc +@@ -350,6 +350,13 @@ + TEST_STRINGS_EQUAL(mset.snippet(input, 12, stem), + "...<<b>foo</b>.h> to..."); + ++ // Check escaping still happens without highlighting when the text is ++ // already short enough. Regression test for bug fixed in 1.4.32 and ++ // 2.0.1. ++ input = "<foo> &"; ++ TEST_STRINGS_EQUAL(mset.snippet(input, 12, stem, 0, "", ""), ++ "<foo> &amp;"); ++ + input = "¡foo!"; + TEST_STRINGS_EQUAL(mset.snippet(input, strlen(input), stem), + "¡<b>foo</b>!"); +@@ -456,6 +463,14 @@ + input = "foo for 10¢"; + TEST_STRINGS_EQUAL(mset.snippet(input, strlen(input), stem), + "<b>foo</b> for <b>10</b>¢"); ++ ++ // Check escaping still happens without highlighting when the text is ++ // already short enough. Regression test for bug fixed in 1.4.32 and ++ // 2.0.1. ++ input = "&foo takes the address of foo"; ++ TEST_STRINGS_EQUAL(mset.snippet(input, strlen(input), stem, 0, "", ""), ++ "&foo takes the address of foo"); ++ + } + + /// Test snippets with small and zero length. diff -Nru xapian-core-1.4.29/debian/patches/series xapian-core-1.4.29/debian/patches/series --- xapian-core-1.4.29/debian/patches/series 1970-01-01 12:00:00.000000000 +1200 +++ xapian-core-1.4.29/debian/patches/series 2026-08-15 11:26:55.000000000 +1200 @@ -0,0 +1 @@ +cve-2018-0499-mset-snippet-escaping-no-highlighting-1.4.x.patch