[pkg-uWSGI-devel] Fwd: Possible uWSGI security vulnerability

[Carlos Pastor]

Sorry, forgot to reply to all.

On Mon, Sep 7, 2026 at 9:46 AM Carlos Pastor
<carlos.pastor at outboxcoaching.com> wrote:
>
> Hello Alexandre,
>
> No ASCII character fulfills the condition of being less than '0' and
> at the same time greater than '9', for example. Therefore the check is
> always false.
>
> The corrected version is right: it is not an hex character if it is
> not between 0 and 9 AND not between a and f AND not between A and F.
>
> Best regards,
> Carlos
>
> On Mon, Sep 7, 2026 at 9:38 AM Alexandre Rossi <niol at zincube.net> wrote:
> >
> > Hi,
> >
> > > core/utils.c function check_hex is clearly wrong, and allows non-hex
> > > characters through.
> >
> > Please provide an example, I fail to see something wrong in check_hex().
> >
> > > I don't have enough knowledge to research the security implications,
> > > but it doesn't look good. It is also kind of public, as at least one
> > > unrelated PR fixes it #2766 (might have been autofixed by some coding
> > > tool?).
> >
> > Again, I fail to see something fixed in the following patch, it only negates
> > the AND'ed conditions.
> >
> > --- a/core/utils.c
> > +++ b/core/utils.c
> > @@ -31,7 +31,7 @@ uint64_t uwsgi_swap64(uint64_t x) {
> >  int check_hex(char *str, int len) {
> >         int i;
> >         for (i = 0; i < len; i++) {
> > -               if ((str[i] < '0' && str[i] > '9') && (str[i] < 'a' && str[i] > 'f') && (str[i] < 'A' && str[i] > 'F')
> > +               if (!(str[i] >= '0' && str[i] <= '9') && !(str[i] >= 'a' && str[i] <= 'f') && !(str[i] >= 'A' && str[i] <= 'F')
> >                         ) {
> >                         return 0;
> >                 }
> >
> > Thanks,
> >
> > Alex