--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: buster
User: release.debian.org@packages.debian.org
Usertags: pu
X-Debbugs-CC: tmancill@debian.org
Hi,
This is an update for CVE-2019-12402. The change is same as done for
libcommons-compress-java_1.18-3 at:
https://salsa.debian.org/java-team/libcommons-compress-java/-/commit/b0f86e2643f1edde31f42a8245224b618030c6aa
Its a no-dsa so needs to be fixed via stable update.
--
Regards
Sudip
diff -Nru libcommons-compress-java-1.18/debian/changelog libcommons-compress-java-1.18/debian/changelog
--- libcommons-compress-java-1.18/debian/changelog 2019-03-01 22:27:13.000000000 +0000
+++ libcommons-compress-java-1.18/debian/changelog 2020-09-18 12:47:06.000000000 +0100
@@ -1,3 +1,10 @@
+libcommons-compress-java (1.18-2+deb10u1) buster; urgency=medium
+
+ * Team upload.
+ * Add patch for CVE-2019-12402 (Closes: #939610)
+
+ -- Sudip Mukherjee <sudipm.mukherjee@gmail.com> Fri, 18 Sep 2020 12:47:06 +0100
+
libcommons-compress-java (1.18-2) unstable; urgency=medium
* Team upload.
diff -Nru libcommons-compress-java-1.18/debian/patches/CVE-2019-12402-939610.patch libcommons-compress-java-1.18/debian/patches/CVE-2019-12402-939610.patch
--- libcommons-compress-java-1.18/debian/patches/CVE-2019-12402-939610.patch 1970-01-01 01:00:00.000000000 +0100
+++ libcommons-compress-java-1.18/debian/patches/CVE-2019-12402-939610.patch 2020-09-14 16:52:45.000000000 +0100
@@ -0,0 +1,127 @@
+Description: addresses CVE-2019-12402 (Debian: #939610)
+From: Stefan Bodewig <bodewig@apache.org>
+Date: Fri, 23 Aug 2019 14:12:05 +0000 (+0200)
+Subject: unit tests for encoding logic
+X-Git-Tag: 1.19-RC1~6
+X-Git-Url: https://gitbox.apache.org/repos/asf?p=commons-compress.git;a=commitdiff_plain;h=4ad5d80a6272e007f64a6ac66829ca189a8093b9;hp=16a0c84e84b93cc8c107b7ff3080bd11317ab581
+
+unit tests for encoding logic
+---
+
+diff --git a/src/main/java/org/apache/commons/compress/archivers/zip/NioZipEncoding.java b/src/main/java/org/apache/commons/compress/archivers/zip/NioZipEncoding.java
+index 0a7581a..4ce9c20 100644
+--- a/src/main/java/org/apache/commons/compress/archivers/zip/NioZipEncoding.java
++++ b/src/main/java/org/apache/commons/compress/archivers/zip/NioZipEncoding.java
+@@ -112,6 +112,9 @@ class NioZipEncoding implements ZipEncoding, CharsetAccessor {
+ } else if (res.isOverflow()) {
+ int increment = estimateIncrementalEncodingSize(enc, cb.remaining());
+ out = ZipEncodingHelper.growBufferBy(out, increment);
++
++ } else if (res.isUnderflow() || res.isError()) {
++ break;
+ }
+ }
+ // tell the encoder we are done
+diff --git a/src/test/java/org/apache/commons/compress/archivers/zip/NioZipEncodingTest.java b/src/test/java/org/apache/commons/compress/archivers/zip/NioZipEncodingTest.java
+new file mode 100644
+index 0000000..a04730c
+--- /dev/null
++++ b/src/test/java/org/apache/commons/compress/archivers/zip/NioZipEncodingTest.java
+@@ -0,0 +1,97 @@
++/*
++ * Licensed to the Apache Software Foundation (ASF) under one
++ * or more contributor license agreements. See the NOTICE file
++ * distributed with this work for additional information
++ * regarding copyright ownership. The ASF licenses this file
++ * to you under the Apache License, Version 2.0 (the
++ * "License"); you may not use this file except in compliance
++ * with the License. You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing,
++ * software distributed under the License is distributed on an
++ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
++ * KIND, either express or implied. See the License for the
++ * specific language governing permissions and limitations
++ * under the License.
++ */
++
++package org.apache.commons.compress.archivers.zip;
++
++import java.nio.ByteBuffer;
++import java.nio.charset.StandardCharsets;
++import java.util.Arrays;
++
++import org.junit.Assert;
++import org.junit.Test;
++
++public class NioZipEncodingTest {
++
++ private static final String UMLAUTS = "\u00e4\u00f6\u00fc";
++
++ @Test
++ public void umlautToUTF16BE() {
++ NioZipEncoding e = new NioZipEncoding(StandardCharsets.UTF_16BE, false);
++ ByteBuffer bb = e.encode(UMLAUTS);
++ final int off = bb.arrayOffset();
++ byte[] result = Arrays.copyOfRange(bb.array(), off, off + bb.limit() - bb.position());
++ Assert.assertArrayEquals(UMLAUTS.getBytes(StandardCharsets.UTF_16BE), result);
++ }
++
++ @Test
++ public void umlautToUTF8() {
++ NioZipEncoding e = new NioZipEncoding(StandardCharsets.UTF_8, true);
++ ByteBuffer bb = e.encode("\u00e4\u00f6\u00fc");
++ final int off = bb.arrayOffset();
++ byte[] result = Arrays.copyOfRange(bb.array(), off, off + bb.limit() - bb.position());
++ Assert.assertArrayEquals(UMLAUTS.getBytes(StandardCharsets.UTF_8), result);
++ }
++
++ @Test
++ public void umlautToISO88591() {
++ NioZipEncoding e = new NioZipEncoding(StandardCharsets.ISO_8859_1, true);
++ ByteBuffer bb = e.encode("\u00e4\u00f6\u00fc");
++ final int off = bb.arrayOffset();
++ byte[] result = Arrays.copyOfRange(bb.array(), off, off + bb.limit() - bb.position());
++ Assert.assertArrayEquals(UMLAUTS.getBytes(StandardCharsets.ISO_8859_1), result);
++ }
++
++ @Test
++ public void unmappableUmlauts() {
++ NioZipEncoding e = new NioZipEncoding(StandardCharsets.US_ASCII, false);
++ ByteBuffer bb = e.encode("\u00e4\u00f6\u00fc");
++ final int off = bb.arrayOffset();
++ byte[] result = Arrays.copyOfRange(bb.array(), off, off + bb.limit() - bb.position());
++ Assert.assertEquals("%U00E4%U00F6%U00FC", new String(result, StandardCharsets.US_ASCII));
++ }
++
++ private static final String RAINBOW_EMOJI = "\ud83c\udf08";
++
++ @Test
++ public void unmappableRainbowEmoji() {
++ NioZipEncoding e = new NioZipEncoding(StandardCharsets.US_ASCII, false);
++ ByteBuffer bb = e.encode(RAINBOW_EMOJI);
++ final int off = bb.arrayOffset();
++ byte[] result = Arrays.copyOfRange(bb.array(), off, off + bb.limit() - bb.position());
++ Assert.assertEquals("%UD83C%UDF08", new String(result, StandardCharsets.US_ASCII));
++ }
++
++ @Test
++ public void rainbowEmojiToSurrogatePairUTF16() {
++ NioZipEncoding e = new NioZipEncoding(StandardCharsets.UTF_16BE, false);
++ ByteBuffer bb = e.encode(RAINBOW_EMOJI);
++ final int off = bb.arrayOffset();
++ byte[] result = Arrays.copyOfRange(bb.array(), off, off + bb.limit() - bb.position());
++ Assert.assertArrayEquals(RAINBOW_EMOJI.getBytes(StandardCharsets.UTF_16BE), result);
++ }
++
++ @Test
++ public void partialSurrogatePair() {
++ NioZipEncoding e = new NioZipEncoding(StandardCharsets.US_ASCII, false);
++ ByteBuffer bb = e.encode("\ud83c");
++ final int off = bb.arrayOffset();
++ byte[] result = Arrays.copyOfRange(bb.array(), off, off + bb.limit() - bb.position());
++ Assert.assertEquals(0, result.length);
++ }
++}
diff -Nru libcommons-compress-java-1.18/debian/patches/series libcommons-compress-java-1.18/debian/patches/series
--- libcommons-compress-java-1.18/debian/patches/series 2019-03-01 22:27:13.000000000 +0000
+++ libcommons-compress-java-1.18/debian/patches/series 2020-09-14 16:52:45.000000000 +0100
@@ -1,3 +1,4 @@
disable-brotli.patch
disable-zstd.patch
disable-osgi-tests.patch
+CVE-2019-12402-939610.patch
--- End Message ---