[CVE-2015-5245] rgw: url encode exposed bucket

This commit contains changes from:
	* https://github.com/ceph/ceph/pull/5430
	  rgw: url encode exposed bucket
	  Don't send the bucket name back without url encoding it.
	* https://github.com/ceph/ceph/pull/4844
	  rgw: Do not enclose the Bucket header in quotes
	  HTTP headers don't have to be enclosed when it's a string.

The aforementioned commits help to prevent CVE-2015-5245

Closes-Bug: #1520185
Change-Id: I934309ecce99628b6d1309658ee3506cc4153d64

diff --git a/debian/changelog b/debian/changelog
index ce1c9df6020c33db403e0b4c42d225d2fd0809e7..292ff1437c82491cf483807a93a8431d771c8d10 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ceph (0.80.9-1~u14.04+mos1+mos6.1+1) mos6.1; urgency=hi
+
+  * Fix security vulnerability CVE-2015-5245
+    https://github.com/ceph/ceph/pull/5430
+
+ -- Denis Meltsaykin <dmeltsaykin@mirantis.com>  Mon, 07 Dec 2015 20:19:12 +0300
+
 ceph (0.80.9-1~u14.04+mos1) mos6.1; urgency=hi
 
   * Fixing performance regression 

diff --git a/debian/patches/series b/debian/patches/series
index 8e560e85dd9fd491ee3ff6d08e2e5daf9bd505ec..a334894f587aa1d2fe28e8cfefa3eb6dea2c5b6b 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,3 @@
 virtualenv-never-download
 modules.patch
+url_encode_exposed_bucket.patch

diff --git a/debian/patches/url_encode_exposed_bucket.patch b/debian/patches/url_encode_exposed_bucket.patch
new file mode 100644 (file)
index 0000000..6ba037e
--- /dev/null
+++ b/debian/patches/url_encode_exposed_bucket.patch
@@ -0,0 +1,17 @@
+diff -Nuar ceph-0.80.9/src/rgw/rgw_rest.cc ceph-0.80.9-WIP/src/rgw/rgw_rest.cc
+--- ceph-0.80.9/src/rgw/rgw_rest.cc    2015-04-09 00:30:46.000000000 +0300
++++ ceph-0.80.9-WIP/src/rgw/rgw_rest.cc        2015-12-07 22:16:13.100942762 +0300
+@@ -272,8 +272,11 @@
+ {
+   int expose_bucket = g_conf->rgw_expose_bucket;
+   if (expose_bucket) {
+-    if (!s->bucket_name_str.empty())
+-      s->cio->print("Bucket: \"%s\"\r\n", s->bucket_name_str.c_str());
++    if (!s->bucket_name_str.empty()){
++      string b;
++      url_encode(s->bucket_name_str, b);
++      s->cio->print("Bucket: %s\r\n", b.c_str());
++    }
+   }
+ }
+