From bebdffb4de586fb43fd07ac549121f4b22f6812d Mon Sep 17 00:00:00 2001
From: "Douglas R. Reno" <renodr@linuxfromscratch.org>
Date: Mon, 18 Oct 2021 13:18:01 -0500
Subject: [PATCH] Fix CVE-2021-39359 by forcing TLS certificate validation

This was done by adding "ssl-use-system-ca-file", TRUE to the options
for each soup_session_new_with_options() call that was made.

Tested on Linux From Scratch 11.0 and Debian 11.

Fixes #249
---
 providers/web/gda-web-provider.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/providers/web/gda-web-provider.c b/providers/web/gda-web-provider.c
index cf8d14dc3..cc818895f 100644
--- a/providers/web/gda-web-provider.c
+++ b/providers/web/gda-web-provider.c
@@ -355,8 +355,8 @@ gda_web_provider_open_connection (GdaServerProvider *provider, GdaConnection *cn
 	g_rec_mutex_init (& (cdata->mutex));
 	cdata->server_id = NULL;
 	cdata->forced_closing = FALSE;
-	cdata->worker_session = soup_session_new ();
-	cdata->front_session = soup_session_new_with_options ("max-conns-per-host", 1, NULL);
+	cdata->worker_session = soup_session_new_with_options ("ssl-use-system-ca-file", TRUE, NULL);
+	cdata->front_session = soup_session_new_with_options ("max-conns-per-host", 1, "ssl-use-system-ca-file", TRUE, NULL);
 	if (use_ssl) {
 		server_url = g_string_new ("https://");
 		g_print ("USING SSL\n");
-- 
GitLab

le-wm.scm?id=ae416e852ad6b305ffaf67343d7192bd7c4c89aa'>commit</a><a href='/guix/diff/gnu/packages/guile-wm.scm?id=ae416e852ad6b305ffaf67343d7192bd7c4c89aa'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/packages/guile-wm.scm'>
<input type='hidden' name='id' value='ae416e852ad6b305ffaf67343d7192bd7c4c89aa'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=ae416e852ad6b305ffaf67343d7192bd7c4c89aa'>root</a>/<a href='/guix/log/gnu?id=ae416e852ad6b305ffaf67343d7192bd7c4c89aa'>gnu</a>/<a href='/guix/log/gnu/packages?id=ae416e852ad6b305ffaf67343d7192bd7c4c89aa'>packages</a>/<a href='/guix/log/gnu/packages/guile-wm.scm?id=ae416e852ad6b305ffaf67343d7192bd7c4c89aa'>guile-wm.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/guile-wm.scm?id=ae416e852ad6b305ffaf67343d7192bd7c4c89aa&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-05-13 09:30:26 +0300'>2020-05-13</span></td><td><a href='/guix/commit/gnu/packages/guile-wm.scm?id=3c986a7dc268756c097212de958f046b29b76c1b'>mailmap: Update entries for Nikita.</a><span class='msg-avail'>...<span class='msg-tooltip'>* .mailmap: change email and name for Nikita.
* Makefile.am, doc/guix.texi, etc/completion/fish/guix.fish,
gnu/packages/accessibility.scm, gnu/packages/admin.scm,
gnu/packages/audio.scm, gnu/packages/autotools.scm, gnu/packages/cdrom.scm,
gnu/packages/check.scm, gnu/packages/cinnamon.scm,
gnu/packages/compression.scm, gnu/packages/crypto.scm,
gnu/packages/databases.scm, gnu/packages/django.scm, gnu/packages/dns.scm,
gnu/packages/elixir.scm, gnu/packages/emacs-xyz.scm, gnu/packages/emacs.scm,
gnu/packages/enlightenment.scm, gnu/packages/erlang.scm,
gnu/packages/fonts.scm, gnu/packages/fontutils.scm, gnu/packages/forth.scm,
gnu/packages/fvwm.scm, gnu/packages/games.scm, gnu/packages/gl.scm,
gnu/packages/gnome.scm, gnu/packages/gnunet.scm, gnu/packages/gnupg.scm,
gnu/packages/gtk.scm, gnu/packages/guile-wm.scm, gnu/packages/guile-xyz.scm,
gnu/packages/haskell-apps.scm, gnu/packages/haskell-check.scm,
gnu/packages/haskell-crypto.scm, gnu/packages/haskell-xyz.scm,
gnu/packages/haskell.scm, gnu/packages/image-viewers.scm,
gnu/packages/image.scm, gnu/packages/irc.scm, gnu/packages/language.scm,
gnu/packages/libcanberra.scm, gnu/packages/linux.scm,
gnu/packages/lisp-xyz.scm, gnu/packages/lisp.scm, gnu/packages/lolcode.scm,
gnu/packages/lxde.scm, gnu/packages/lxqt.scm, gnu/packages/mail.scm,
gnu/packages/markup.scm, gnu/packages/mate.scm, gnu/packages/maths.scm,
gnu/packages/mc.scm, gnu/packages/messaging.scm, gnu/packages/music.scm,
gnu/packages/ncurses.scm, gnu/packages/networking.scm,
gnu/packages/nickle.scm, gnu/packages/openbox.scm, gnu/packages/pdf.scm,
gnu/packages/perl-check.scm, gnu/packages/perl.scm,
gnu/packages/python-compression.scm, gnu/packages/python-crypto.scm,
gnu/packages/python-web.scm, gnu/packages/python-xyz.scm,
gnu/packages/python.scm, gnu/packages/qt.scm, gnu/packages/ruby.scm,
gnu/packages/rust.scm, gnu/packages/scheme.scm,
gnu/packages/serialization.scm, gnu/packages/shells.scm,
gnu/packages/ssh.scm, gnu/packages/suckless.scm, gnu/packages/tbb.scm,
gnu/packages/telephony.scm, gnu/packages/text-editors.scm,
gnu/packages/textutils.scm, gnu/packages/time.scm, gnu/packages/tls.scm,
gnu/packages/tor.scm, gnu/packages/version-control.scm,
gnu/packages/video.scm, gnu/packages/vim.scm, gnu/packages/web.scm,
gnu/packages/wm.scm, gnu/packages/xdisorg.scm, gnu/packages/xfce.scm,
gnu/packages/xml.scm, gnu/packages/xorg.scm, gnu/services/certbot.scm,
gnu/services/desktop.scm, gnu/services/version-control.scm,
gnu/services/web.scm, guix/import/hackage.scm, guix/licenses.scm: Likewise.

Signed-off-by: Efraim Flashner &lt;efraim@flashner.co.il&gt;
</span></span></td><td>nikita</td></tr>
<tr><td><span title='2019-09-24 08:13:40 +0200'>2019-09-24</span></td><td><a href='/guix/commit/gnu/packages/guile-wm.scm?id=c3d523b04812c49080fbb5f95db5a03b73e36429'>gnu: guile-xcb: Fix cross-compilation.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/guile-wm.scm (guile-xcb)[native-inputs]: Add guile.
</span></span></td><td>Pierre-Moana Levesque</td></tr>
<tr><td><span title='2019-09-04 18:01:49 +0200'>2019-09-04</span></td><td><a href='/guix/commit/gnu/packages/guile-wm.scm?id=e94b95473ea5dadea76be9763b7f8b34d400e863'>gnu: guile-wm: Fix cross-compilation.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/guile-wm.scm (guile-wm): Add guile and guile-xcb to native-inputs.
</span></span></td><td>Pierre-Moana Levesque</td></tr>