From bebdffb4de586fb43fd07ac549121f4b22f6812d Mon Sep 17 00:00:00 2001
From: "Douglas R. Reno" <renodr@linuxfromscratch.org>
Date: Mon, 18 Oct 2021 13:18:01 -0500
Subject: [PATCH] Fix CVE-2021-39359 by forcing TLS certificate validation

This was done by adding "ssl-use-system-ca-file", TRUE to the options
for each soup_session_new_with_options() call that was made.

Tested on Linux From Scratch 11.0 and Debian 11.

Fixes #249
---
 providers/web/gda-web-provider.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/providers/web/gda-web-provider.c b/providers/web/gda-web-provider.c
index cf8d14dc3..cc818895f 100644
--- a/providers/web/gda-web-provider.c
+++ b/providers/web/gda-web-provider.c
@@ -355,8 +355,8 @@ gda_web_provider_open_connection (GdaServerProvider *provider, GdaConnection *cn
 	g_rec_mutex_init (& (cdata->mutex));
 	cdata->server_id = NULL;
 	cdata->forced_closing = FALSE;
-	cdata->worker_session = soup_session_new ();
-	cdata->front_session = soup_session_new_with_options ("max-conns-per-host", 1, NULL);
+	cdata->worker_session = soup_session_new_with_options ("ssl-use-system-ca-file", TRUE, NULL);
+	cdata->front_session = soup_session_new_with_options ("max-conns-per-host", 1, "ssl-use-system-ca-file", TRUE, NULL);
 	if (use_ssl) {
 		server_url = g_string_new ("https://");
 		g_print ("USING SSL\n");
-- 
GitLab

onment.sh?id=297e8f0319a2fc3c872fb79633ed21b04424a2ca'>commit</a><a href='/guix/diff/tests/guix-environment.sh?id=297e8f0319a2fc3c872fb79633ed21b04424a2ca'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/tests/guix-environment.sh'>
<input type='hidden' name='id' value='297e8f0319a2fc3c872fb79633ed21b04424a2ca'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=297e8f0319a2fc3c872fb79633ed21b04424a2ca'>root</a>/<a href='/guix/log/tests?id=297e8f0319a2fc3c872fb79633ed21b04424a2ca'>tests</a>/<a href='/guix/log/tests/guix-environment.sh?id=297e8f0319a2fc3c872fb79633ed21b04424a2ca'>guix-environment.sh</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/tests/guix-environment.sh?id=297e8f0319a2fc3c872fb79633ed21b04424a2ca&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2023-04-21 16:16:38 +0200'>2023-04-21</span></td><td><a href='/guix/commit/tests/guix-environment.sh?id=37dd69b44511dc73eb04bdebe8d82c9a0386338e'>tests: Fix checks for expected failures.</a><span class='msg-avail'>...<span class='msg-tooltip'>Addresses &lt;https://issues.guix.gnu.org/62406&gt;.

With 'set -e', a return status inverted with '!' does not cause the shell to
exit immediately.  Instead use '&amp;&amp; false' to indicate an expected failure.

* tests/guix-archive.sh, tests/guix-build-branch.sh, tests/guix-build.sh,
tests/guix-daemon.sh, tests/guix-download.sh,
tests/guix-environment-container.sh, tests/guix-environment.sh,
tests/guix-gc.sh, tests/guix-git-authenticate.sh, tests/guix-graph.sh,
tests/guix-hash.sh, tests/guix-home.sh, tests/guix-pack-relocatable.sh,
tests/guix-pack.sh, tests/guix-package-aliases.sh, tests/guix-package-net.sh,
tests/guix-package.sh, tests/guix-refresh.sh, tests/guix-shell.sh,
tests/guix-style.sh, tests/guix-system.sh: Replace uses of '! ...' with
'... &amp;&amp; false' or `test ! ...` as appropriate.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Eric Bavier</td></tr>
<tr><td><span title='2021-10-31 14:49:47 +0200'>2021-10-31</span></td><td><a href='/guix/commit/tests/guix-environment.sh?id=bc5155b952ae8bdbc56aded4d8d39768b4e2a7d4'>Merge remote-tracking branch 'origin/master' into core-updates-frozen</a></td><td>Efraim Flashner</td></tr>
<tr><td><span title='2021-10-25 19:02:32 +0200'>2021-10-25</span></td><td><a href='/guix/commit/tests/guix-environment.sh?id=10208952eaf0834b9cdf341bc75463ed033af315'>environment: Add tests for '--profile'.</a><span class='msg-avail'>...<span class='msg-tooltip'>This is a followup to a643deac2de81755a1843a3b41dd53857678bebc.

* tests/guix-environment-container.sh, tests/guix-environment.sh: Add
tests for '--profile'.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2021-07-11 00:46:54 +0200'>2021-07-11</span></td><td><a href='/guix/commit/tests/guix-environment.sh?id=2a3cd4ee3557fbbdca42b5ec2f3ec4546c270203'>environment: Adjust to earlier 'gcc-bootstrap' search paths changes.</a><span class='msg-avail'>...<span class='msg-tooltip'>This is a followup to fe6775f52b7f28a5bf74633ea4737c32a64b7e05.

* tests/guix-environment.sh: Expect C_INCLUDE_PATH rather than CPATH in
environment containing 'gcc-bootstrap'.
</span></span></td><td>Ludovic Courtès</td></tr>