From cd077513f267e43ce4b659eb18a1734d8a369992 Mon Sep 17 00:00:00 2001 From: Patrick Griffis Date: Wed, 5 Feb 2025 14:03:05 -0600 Subject: [PATCH 1/2] auth-digest: Handle missing nonce Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/cd077513f267e43ce4b659eb18a1734d8a369992] CVE: CVE-2025-32912 Signed-off-by: Vijay Anusuri The test codes is based on CVE-2025-32910, test code in CVE-2025-32910 is removed for fixing do_compile failure. So also remove this test code Signed-off-by: Changqing Li --- libsoup/soup-auth-digest.c | 2 +- 1 files changed, 1 insertions(+), 1 deletion(-) diff --git a/libsoup/soup-auth-digest.c b/libsoup/soup-auth-digest.c index a1db188..f0edb81 100644 --- a/libsoup/soup-auth-digest.c +++ b/libsoup/soup-auth-digest.c @@ -156,7 +156,7 @@ soup_auth_digest_update (SoupAuth *auth, SoupMessage *msg, guint qop_options; gboolean ok = TRUE; - if (!soup_auth_get_realm (auth)) + if (!soup_auth_get_realm (auth) || !g_hash_table_contains (auth_params, "nonce")) return FALSE; g_free (priv->domain); -- 2.25.1