mirror of
git://git.openembedded.org/meta-openembedded
synced 2026-09-16 14:05:06 +00:00
07d6722816
Fix CVE-2026-1539,CVE-2026-1761,CVE-2026-1801,CVE-2026-2443, CVE-2026-2369,CVE-2026-1760,CVE-2025-14523,CVE-2025-32049,CVE-2026-1467 Refer: CVE-2026-1801 https://gitlab.gnome.org/GNOME/libsoup/-/issues/481 CVE-2026-1761 https://gitlab.gnome.org/GNOME/libsoup/-/issues/493 CVE-2026-2443 https://gitlab.gnome.org/GNOME/libsoup/-/issues/487 CVE-2026-1539 https://gitlab.gnome.org/GNOME/libsoup/-/issues/489 CVE-2026-2369 https://gitlab.gnome.org/GNOME/libsoup/-/issues/498 CVE-2026-1760 https://gitlab.gnome.org/GNOME/libsoup/-/issues/475 CVE-2025-14523 https://gitlab.gnome.org/GNOME/libsoup/-/issues/472 CVE-2025-32049 https://gitlab.gnome.org/GNOME/libsoup/-/issues/390 CVE-2026-1467 https://gitlab.gnome.org/GNOME/libsoup/-/issues/488 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
32 lines
1.1 KiB
Diff
32 lines
1.1 KiB
Diff
From 285faea567e1e2a95226201175dbf745a64a2439 Mon Sep 17 00:00:00 2001
|
|
From: Changqing Li <changqing.li@windriver.com>
|
|
Date: Fri, 20 Mar 2026 15:04:22 +0800
|
|
Subject: [PATCH 4/4] Also remove Proxy-Authorization header on cross origin
|
|
redirect
|
|
|
|
Closes #489
|
|
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/98c1285d9d78662c38bf14b4a128af01ccfdb446]
|
|
CVE: CVE-2026-1539
|
|
|
|
Signed-off-by: Changqing Li <changqing.li@windriver.com>
|
|
---
|
|
libsoup/soup-session.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/libsoup/soup-session.c b/libsoup/soup-session.c
|
|
index cc0d04c..0361856 100644
|
|
--- a/libsoup/soup-session.c
|
|
+++ b/libsoup/soup-session.c
|
|
@@ -1190,6 +1190,7 @@ soup_session_redirect_message (SoupSession *session, SoupMessage *msg)
|
|
/* Strip all credentials on cross-origin redirect. */
|
|
if (!soup_uri_host_equal (soup_message_get_uri (msg), new_uri)) {
|
|
soup_message_headers_remove (msg->request_headers, "Authorization");
|
|
+ soup_message_headers_remove (msg->request_headers, "Proxy-Authorization");
|
|
soup_message_set_auth (msg, NULL);
|
|
}
|
|
|
|
--
|
|
2.34.1
|
|
|