diff --git a/SPECS/memcached/CVE-2026-47783.patch b/SPECS/memcached/CVE-2026-47783.patch deleted file mode 100644 index c072e00e0ef..00000000000 --- a/SPECS/memcached/CVE-2026-47783.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 311ced2c38590bb4e576e0d743914382f7237365 Mon Sep 17 00:00:00 2001 -From: Sarthak Munshi -Date: Sat, 21 Mar 2026 15:20:25 -0700 -Subject: [PATCH] Fix timing side-channel in SASL password database - authentication - -sasl_server_userdb_checkpass() broke out of the password file loop -early when a valid username was found, creating a measurable timing -difference between valid and invalid usernames. Additionally, the -password comparison used memcmp() which returns early on the first -differing byte, potentially leaking password bytes via timing analysis. - -Fix both issues with minimal changes per reviewer feedback: -- Clear buffer to zero before each fgets so comparisons past the - stored password hit known zero bytes -- Use safe_memcmp() for both username and password comparisons - (constant-time, volatile-qualified) -- Remove the early break so the entire file is always scanned - -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed.patch ---- - sasl_defs.c | 21 ++++++++++----------- - 1 file changed, 10 insertions(+), 11 deletions(-) - -diff --git a/sasl_defs.c b/sasl_defs.c -index e73a570..98a1f75 100644 ---- a/sasl_defs.c -+++ b/sasl_defs.c -@@ -71,19 +71,18 @@ static int sasl_server_userdb_checkpass(sasl_conn_t *conn, - char buffer[MAX_ENTRY_LEN]; - bool ok = false; - -- while ((fgets(buffer, sizeof(buffer), pwfile)) != NULL) { -- if (memcmp(user, buffer, unmlen) == 0 && buffer[unmlen] == ':') { -- /* This is the correct user */ -- ++unmlen; -- if (memcmp(pass, buffer + unmlen, passlen) == 0 && -- (buffer[unmlen + passlen] == ':' || /* Additional tokens */ -- buffer[unmlen + passlen] == '\n' || /* end of line */ -- buffer[unmlen + passlen] == '\r'|| /* dos format? */ -- buffer[unmlen + passlen] == '\0')) { /* line truncated */ -+ while (1) { -+ memset(buffer, 0, sizeof(buffer)); -+ if (fgets(buffer, sizeof(buffer), pwfile) == NULL) -+ break; -+ if (safe_memcmp(user, buffer, unmlen) && buffer[unmlen] == ':') { -+ if (safe_memcmp(pass, buffer + unmlen + 1, passlen) && -+ (buffer[unmlen + 1 + passlen] == ':' || -+ buffer[unmlen + 1 + passlen] == '\n' || -+ buffer[unmlen + 1 + passlen] == '\r' || -+ buffer[unmlen + 1 + passlen] == '\0')) { - ok = true; - } -- -- break; - } - } - (void)fclose(pwfile); --- -2.45.4 - diff --git a/SPECS/memcached/memcached.signatures.json b/SPECS/memcached/memcached.signatures.json index b856e4013c3..96085bbdd68 100644 --- a/SPECS/memcached/memcached.signatures.json +++ b/SPECS/memcached/memcached.signatures.json @@ -1,6 +1,6 @@ { "Signatures": { "memcached.sysconfig": "31f7d20fad86bdd2bc5692619928af8785dc0e9f858863aeece67cff0e4edfd2", - "memcached-1.6.27.tar.gz": "74fe1447c8668adf910fa7a929fb6358aaf4a66ef734e751c5b8128071b0f7b5" + "memcached-1.6.45.tar.gz": "d362c64e6d8d5287153501eabf7c85b4a761432fbf53f5d7b085d0bb1653c1dd" } } diff --git a/SPECS/memcached/memcached.spec b/SPECS/memcached/memcached.spec index abbbaa0dad4..7aaef81c680 100644 --- a/SPECS/memcached/memcached.spec +++ b/SPECS/memcached/memcached.spec @@ -6,8 +6,8 @@ %bcond_with seccomp Summary: High Performance, Distributed Memory Object Cache Name: memcached -Version: 1.6.27 -Release: 5%{?dist} +Version: 1.6.45 +Release: 1%{?dist} License: BSD Vendor: Microsoft Corporation Distribution: Azure Linux @@ -18,7 +18,6 @@ Patch0: memcached-unit.patch Patch1: CVE-2021-43519.patch Patch2: CVE-2021-44647.patch Patch3: CVE-2026-24809.patch -Patch4: CVE-2026-47783.patch BuildRequires: gcc BuildRequires: libevent-devel BuildRequires: systemd-devel @@ -27,6 +26,7 @@ BuildRequires: perl-generators BuildRequires: perl(IO::Socket::SSL) BuildRequires: perl(Test::Harness) BuildRequires: perl(Test::More) +BuildRequires: perl(File::Copy) BuildRequires: perl(FindBin) BuildRequires: perl(lib) BuildRequires: perl(fields) @@ -38,7 +38,7 @@ BuildRequires: cyrus-sasl-devel BuildRequires: libseccomp-devel %endif %if %{with tls} -BuildRequires: openssl-devel +BuildRequires: openssl-devel >= 1.1.1 %endif Requires: openssl-libs @@ -133,6 +133,10 @@ exit 0 %{_unitdir}/memcached.service %changelog +* Tue Aug 18 2026 Pawel Winogrodzki - 1.6.45-1 +- Upgrade to 1.6.45 +- Remove CVE-2026-47783.patch, fixed upstream + * Thu May 21 2026 Azure Linux Security Servicing Account - 1.6.27-5 - Patch for CVE-2026-47783 diff --git a/cgmanifest.json b/cgmanifest.json index 5944da47c55..b027d27ab84 100644 --- a/cgmanifest.json +++ b/cgmanifest.json @@ -13371,8 +13371,8 @@ "type": "other", "other": { "name": "memcached", - "version": "1.6.27", - "downloadUrl": "https://www.memcached.org/files/memcached-1.6.27.tar.gz" + "version": "1.6.45", + "downloadUrl": "https://www.memcached.org/files/memcached-1.6.45.tar.gz" } } },