Attachment 848380 Details for Bug 1051670 – CVE-2014-0006-grizzly.diff

[patch] CVE-2014-0006-grizzly.diff

CVE-2014-0006-grizzly.diff (text/plain), 1.64 KB, created by Kurt Seifried on 2014-01-10 20:46:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Kurt Seifried

Created: 2014-01-10 20:46:13 UTC

Size: 1.64 KB

patch

obsolete

>commit abe79e61601488b4cced6ac4a25e8076f105472f
>Author: Samuel Merritt <sam@swiftstack.com>
>Date:   Fri Jan 3 09:38:38 2014 -0800
>
>    backport of tempurl patch to 1.8.0
>    
>    Change-Id: Ib7bc7474b8d3b060323afd9d7e03fe34cd3c38f9
>
>diff --git a/swift/common/middleware/tempurl.py b/swift/common/middleware/tempurl.py
>index 5a05de7..8a2517e 100644
>--- a/swift/common/middleware/tempurl.py
>+++ b/swift/common/middleware/tempurl.py
>@@ -98,6 +98,7 @@ from urlparse import parse_qs
> 
> from swift.common.wsgi import make_pre_authed_env
> from swift.common.http import HTTP_UNAUTHORIZED
>+from swift.common.utils import streq_const_time
> 
> 
> #: Default headers to remove from incoming requests. Simply a whitespace
>@@ -248,14 +249,14 @@ class TempURL(object):
>         if env['REQUEST_METHOD'] == 'HEAD':
>             hmac_val = self._get_hmac(env, temp_url_expires, key,
>                                       request_method='GET')
>-            if temp_url_sig != hmac_val:
>+            if not streq_const_time(temp_url_sig, hmac_val):
>                 hmac_val = self._get_hmac(env, temp_url_expires, key,
>                                           request_method='PUT')
>-                if temp_url_sig != hmac_val:
>+                if not streq_const_time(temp_url_sig, hmac_val):
>                     return self._invalid(env, start_response)
>         else:
>             hmac_val = self._get_hmac(env, temp_url_expires, key)
>-            if temp_url_sig != hmac_val:
>+            if not streq_const_time(temp_url_sig, hmac_val):
>                 return self._invalid(env, start_response)
>         self._clean_incoming_headers(env)
>         env['swift.authorize'] = lambda req: None

Actions: View | Diff

Attachments on bug 1051670: 848380 | 848381 | 848382