engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

undf: assign UNDF-2026-000001193..1197 to suricata-0002, squid-0004, clamav-0001, pgbouncer-0002, sendmail-0001; stamp patches

Browse source
This commit is contained in:
russell@unturf.com 2026-04-03 13:31:17 -04:00
parent 01f059fa4b
commit 1fda7b64d3
20 changed files with 812 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

13
defects/wine-0002/patch/wine-0002-basic-auth-credential-trace-leak.patch Normal file
View file

@ -0,0 +1,13 @@
# UNDF: UNDF-2026-000001193
--- a/dlls/wininet/http.c
+++ b/dlls/wininet/http.c
@@ -787,7 +787,10 @@ static void cache_basic_authorization(LPWSTR host, LPWSTR realm, LPSTR auth_data
TRACE("caching authorization for %s:%s = %s\n",debugstr_w(host),debugstr_w(realm),debugstr_an(auth_data,auth_data_len));
+ /* DEFECT (CWE-312): auth_data is "username:password" in plain UTF-8.
+ * Logging it verbatim via TRACE exposes credentials to any process
+ * or log collector that captures Wine debug output (WINEDEBUG=+wininet).
+ * Replace with a redacted marker so host+realm are still traceable. */
- TRACE("caching authorization for %s:%s = %s\n",debugstr_w(host),debugstr_w(realm),debugstr_an(auth_data,auth_data_len));
+ TRACE("caching authorization for %s:%s = <redacted, len=%u>\n",debugstr_w(host),debugstr_w(realm),auth_data_len);
EnterCriticalSection(&authcache_cs);