[pkg-java] r4307 - in trunk/jetty/debian: . patches
mkoch at alioth.debian.org
mkoch at alioth.debian.org
Fri Oct 5 05:40:44 UTC 2007
Author: mkoch
Date: 2007-10-05 05:40:44 +0000 (Fri, 05 Oct 2007)
New Revision: 4307
Added:
trunk/jetty/debian/patches/cve-2007-6969.patch
Modified:
trunk/jetty/debian/changelog
trunk/jetty/debian/patches/jdk-1.2-src-encoding.patch
Log:
jetty (5.1.10-4) unstable; urgency=low
* Added patch to fix CVE-2006-6969. Thanks to Greg Wilkins for the patch.
Closes: #445283.
* Updated debian/patches/jdk-1.2-src-encoding.patch to make it work with
current ecj.
-- Michael Koch <konqueror at gmx.de> Fri, 05 Oct 2007 07:34:55 +0200
Modified: trunk/jetty/debian/changelog
===================================================================
--- trunk/jetty/debian/changelog 2007-10-04 20:09:00 UTC (rev 4306)
+++ trunk/jetty/debian/changelog 2007-10-05 05:40:44 UTC (rev 4307)
@@ -1,3 +1,12 @@
+jetty (5.1.10-4) unstable; urgency=low
+
+ * Added patch to fix CVE-2006-6969. Thanks to Greg Wilkins for the patch.
+ Closes: #445283.
+ * Updated debian/patches/jdk-1.2-src-encoding.patch to make it work with
+ current ecj.
+
+ -- Michael Koch <konqueror at gmx.de> Fri, 05 Oct 2007 07:34:55 +0200
+
jetty (5.1.10-3) unstable; urgency=low
* Fix debian/jetty.init to permit removal without purge and offer a new
Added: trunk/jetty/debian/patches/cve-2007-6969.patch
===================================================================
--- trunk/jetty/debian/patches/cve-2007-6969.patch (rev 0)
+++ trunk/jetty/debian/patches/cve-2007-6969.patch 2007-10-05 05:40:44 UTC (rev 4307)
@@ -0,0 +1,117 @@
+--- src/org/mortbay/jetty/servlet/AbstractSessionManager.java 2006/06/21 09:35:28 1.52
++++ src/org/mortbay/jetty/servlet/AbstractSessionManager.java 2006/11/22 20:01:10 1.53
+@@ -15,6 +15,8 @@
+
+ package org.mortbay.jetty.servlet;
+
++import java.security.NoSuchAlgorithmException;
++import java.security.SecureRandom;
+ import java.util.ArrayList;
+ import java.util.Collections;
+ import java.util.Enumeration;
+@@ -82,6 +84,7 @@
+ protected transient ArrayList _sessionAttributeListeners=new ArrayList();
+ protected transient Map _sessions;
+ protected transient Random _random;
++ protected transient boolean _weakRandom;
+ protected transient ServletHandler _handler;
+ protected int _minSessions = 0;
+ protected int _maxSessions = 0;
+@@ -102,6 +105,7 @@
+ public AbstractSessionManager(Random random)
+ {
+ _random=random;
++ _weakRandom=false;
+ }
+
+
+@@ -192,8 +196,7 @@
+ /* ------------------------------------------------------------ */
+ /* new Session ID.
+ * If the request has a requestedSessionID which is unique, that is used.
+- * The session ID is created as a unique random long, represented as in a
+- * base between 30 and 36, selected by timestamp.
++ * The session ID is created as a unique random long base 36.
+ * If the request has a jvmRoute attribute, that is appended as a
+ * worker tag, else any worker tag set on the manager is appended.
+ * @param request
+@@ -221,9 +224,16 @@
+ String id=null;
+ while (id==null || id.length()==0 || __allSessions.containsKey(id))
+ {
+- long r = _random.nextLong();
+- if (r<0)r=-r;
+- id=Long.toString(r,30+(int)(created%7));
++ long r=_weakRandom
++ ?(hashCode()^Runtime.getRuntime().freeMemory()^_random.nextInt()^(((long)request.hashCode())<<32))
++ :_random.nextLong();
++ r^=created;
++ if (request!=null && request.getRemoteAddr()!=null)
++ r^=request.getRemoteAddr().hashCode();
++ if (r<0)
++ r=-r;
++ id=Long.toString(r,36);
++
+ String worker = (String)request.getAttribute("org.mortbay.http.ajp.JVMRoute");
+ if (worker!=null)
+ id+="."+worker;
+@@ -469,11 +479,18 @@
+ if (_random==null)
+ {
+ log.debug("New random session seed");
+- _random=new Random();
++ try
++ {
++ _random=SecureRandom.getInstance("SHA1PRNG");
++ }
++ catch (NoSuchAlgorithmException e)
++ {
++ log.warn("Could not generate SecureRandom for session-id randomness",e);
++ _random=new Random();
++ _weakRandom=true;
++ }
++ _random.setSeed(_random.nextLong()^System.currentTimeMillis()^hashCode()^Runtime.getRuntime().freeMemory());
+ }
+- else
+- if(log.isDebugEnabled())log.debug("Initializing random session key: "+_random);
+- _random.nextLong();
+
+ if (_sessions==null)
+ _sessions=new HashMap();
+@@ -564,7 +581,20 @@
+ thread.setContextClassLoader(old_loader);
+ }
+ }
+-
++
++
++ /* ------------------------------------------------------------ */
++ public Random getRandom()
++ {
++ return _random;
++ }
++
++ /* ------------------------------------------------------------ */
++ public void setRandom(Random random)
++ {
++ _random=random;
++ }
++
+
+ /* ------------------------------------------------------------ */
+ /* ------------------------------------------------------------ */
+@@ -607,7 +637,7 @@
+
+ } // SessionScavenger
+
+-
++
+
+ /* ------------------------------------------------------------ */
+ /* ------------------------------------------------------------ */
+@@ -926,4 +956,5 @@
+ }
+
+
++
+ }
Modified: trunk/jetty/debian/patches/jdk-1.2-src-encoding.patch
===================================================================
--- trunk/jetty/debian/patches/jdk-1.2-src-encoding.patch 2007-10-04 20:09:00 UTC (rev 4306)
+++ trunk/jetty/debian/patches/jdk-1.2-src-encoding.patch 2007-10-05 05:40:44 UTC (rev 4307)
@@ -1,10 +1,12 @@
---- ../jetty-5.1.4.orig/extra/jdk1.2/build.xml 2004-11-16 01:15:38.000000000 +0100
-+++ ./extra/jdk1.2/build.xml 2005-06-30 14:40:31.841519056 +0200
-@@ -127,6 +127,7 @@
+--- extra/jdk1.2/build.xml.orig 2007-10-05 07:31:53.000000000 +0200
++++ extra/jdk1.2/build.xml 2007-10-05 07:32:17.000000000 +0200
+@@ -127,7 +127,8 @@
debug="${javac.debug}"
optimize="${javac.optimize}"
deprecation="${javac.deprecation}"
-+ source="1.2"
- target="1.2"
+- target="1.2"
++ source="1.3"
++ target="1.3"
>
<classpath>
+ <path refid="extpath"/>
More information about the pkg-java-commits
mailing list