Adding debian version 2.4.38-3+deb10u9.debian/2.4.38-3+deb10u9

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

2 files changed, 107 insertions, 0 deletions

diff --git a/debian/perl-framework/t/security/CVE-2019-0215.t b/debian/perl-framework/t/security/CVE-2019-0215.t
new file mode 100644
index 0000000..978c1ef
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2019-0215.t
@@ -0,0 +1,47 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+
+my $vars = Apache::Test::vars();
+
+plan tests => 2, need $vars->{ssl_module_name}, need_lwp,
+    qw(LWP::Protocol::https);
+
+my $r;
+
+Apache::TestRequest::user_agent(ssl_opts => {SSL_version => 'TLSv13'});
+Apache::TestRequest::scheme('https');
+Apache::TestRequest::module('ssl_optional_cc');
+
+$r = GET "/require/none/";
+my $tls13_works = $r->is_success;
+
+# Forget the above user agent settings, start fresh
+Apache::TestRequest::user_agent(reset => 1);
+
+# If TLS 1.3 worked, run the tests using it and expect 403.
+# Older TLS versions seem to show the TLS alert client side as a 500.
+my $expected_status;
+if ($tls13_works) {
+  Apache::TestRequest::user_agent(ssl_opts => {SSL_version => 'TLSv13'});
+  $expected_status = 403;
+  t_debug "Using TLSv13, expecting status 403";
+} else {
+  t_debug "Using TLS before TLSv13, expecting status 500";
+  $expected_status = 500;
+}
+
+Apache::TestRequest::user_agent_keepalive(1);
+Apache::TestRequest::scheme('https');
+Apache::TestRequest::module('ssl_optional_cc');
+
+$r = GET "/require/any/";
+
+ok t_cmp($r->code, $expected_status, "first access denied without client cert");
+
+$r = GET "/require/any/";
+
+ok t_cmp($r->code, $expected_status, "second access denied without client cert");
diff --git a/debian/perl-framework/t/security/CVE-2020-1927.t b/debian/perl-framework/t/security/CVE-2020-1927.t
new file mode 100644
index 0000000..523feb6
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2020-1927.t
@@ -0,0 +1,60 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+use MIME::Base64;
+use Data::Dumper;
+use HTTP::Response;
+use Socket;
+
+plan tests => 1, need_min_apache_version('2.4.42');
+
+my $sock = Apache::TestRequest::vhost_socket("core");
+if (!$sock) {
+    print "# failed to connect\n";
+    ok(0);
+    next;
+}
+
+my $req = sprintf "GET /CVE-2020-1927/%%0D%%0Ahttp://127.0.0.1/ HTTP/1.1\r\nHost: merge-disabled\r\nConnection: close\r\n\r\n";
+print "# SENDING to " . peer($sock) . "\n# $req\n";
+$sock->print("$req");
+$sock->flush();
+sleep(0.1);
+$req = escape($req);
+print "# SENDING to " . peer($sock) . "\n# $req\n";
+
+my $response_data = "";
+my $buf;
+while ($sock->read($buf, 10000) > 0) {
+    $response_data .= $buf;
+}
+my $response = HTTP::Response->parse($response_data);
+if (! defined $response) {
+    die "HTTP::Response->parse failed";
+}
+ok t_cmp($response->code, 404,  "regex didn't match and redirect");
+
+sub escape
+{
+    my $in = shift;
+    $in =~ s{\\}{\\\\}g;
+    $in =~ s{\r}{\\r}g;
+    $in =~ s{\n}{\\n}g;
+    $in =~ s{\t}{\\t}g;
+    $in =~ s{([\x00-\x1f])}{sprintf("\\x%02x", ord($1))}ge;
+    return $in;
+}
+
+sub peer
+{
+   my $sock = shift;
+   my $hersockaddr    = getpeername($sock);
+   return "<disconnected>" if !$hersockaddr;
+   my ($port, $iaddr) = sockaddr_in($hersockaddr);
+   my $herhostname    = gethostbyaddr($iaddr, AF_INET);
+   my $herstraddr     = inet_ntoa($iaddr);
+   return "$herstraddr:$port";
+}