Debian Patches

Status for libevent/2.1.12-stable-8+deb12u1

Patch Description Author Forwarded Bugs Origin Last update
0001-Always-build-with-no-undefined.patch Always build with -no-undefined Balint Reczey <balint.reczey@canonical.com> not-needed 2020-07-09
evutil_secure_rng_add_bytes_noop.patch Make evutil_secure_rng_add_bytes noop with glibc's implemtation of arc4random Shengjing Zhu <zhsj@debian.org> not-needed
CVE-2026-63382.patch http: Tighten acceptable headers to prevent request smuggling.
Previously, we accepted a wider variety of combinations of
Content-Length and Transfer-Encoding, and we didn't parse
Transfer-Encoding according to the full rules of the relevant RFC.
This made evhttp interpret these headers in a
non-standards-compliant way that had the potential to differ from
a more compliant proxy or HTTP server. Thus, when used _as_ an
HTTP proxy, evhttp had the potential to enable http smuggling
attacks.

Fixes GHSA-q39v-w2g7-gr8j.

Originally reported by @xclow3n; and then by @kodareef5,
@nstaller0490, @AsafMeizneer, and @yaotushaozhu (in that order).

(Note that this fix assumes that we have _also_ disabled support for
CR and LF in header lines.)

(cherry picked from commit ac38703b2d312200c4f967f02936af0118d384a0)		 Nick Mathewson <nickm@torproject.org> no 2026-06-26
CVE-2026-63379.patch http: Discard trailers.
Previously, we would insert any trailers directly into the header
list. But this was incorrect, since trailers are not supposed to be
treated as normal headers. This behavior could lead to conflicting
interpretation between HTTP servers and proxies, and enable
different kinds of attacks.

Fixes GHSA-2gmv-p5m7-98p6.

Reported by @sebastianosrt.

(cherry picked from commit 87e8e44fa774e9677b089b1a5114ee68aefa1636)		 Nick Mathewson <nickm@torproject.org> no 2026-06-26
CVE-2026-63381.patch Fix a dangling pointer in evbuffer_add_buffer_reference.
If `evbuffer_add_buffer_reference` was called to add a reference to
an empty buffer, the resulting code would produce dangling pointers
that could later lead to a use-after-free.

Fixes GHSA-c2pj-cg4r-88c8.

(cherry picked from commit 5cb95ba2f804f8aff46f88d58391c71e1251cd1c)		 Alexis <alexis.challande@trailofbits.com> no 2026-06-09
CVE-2026-63383.patch evrpc: Fix out-of-bounds read in decode_tag_internal
This bug could allow an attacker to cause an evrpc client or server
to read out of bounds when decoding a tag.

Fixes GHSA-fj29-64w6-73h6.

Reported by @Brubbish.

(cherry picked from commit e1f9e21887c6b104e206a718385ba3ffc75180cb)		 Nick Mathewson <nickm@torproject.org> no 2026-06-24
CVE-2026-63384.patch evrpc: Fix integer overflow in evtag_unmarshal_header.
On platforms where int is 32 bits, if this function tried to decode
a header declaring a payload longer than INT_MAX bytes long, this
function would return a negative value, which could cause incorrect
behaviors, incorrect allocations, or denial-of-service.

We solve this (for now) by rejecting any payload length larger
than INT_MAX.

Fixes GHSA-45c6-qx49-89m8

Reported by @Brubbish

(cherry picked from commit 5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416)		 Nick Mathewson <nickm@torproject.org> no 2026-06-24
CVE-2026-63385.patch http: Reject headers containing CRLF.
This causes us to reject obfs-fold, which is deprecated in RFC 9112.

Otherwise, we would have a header injection opportunity for
certain proxy chains.

Reported by @AsafMeizner

Part of GHSA-jcwh-pvf2-73p2

(cherry picked from commit 9170dd35e64714613e8d13b290587cfc28e258e2)		 Nick Mathewson <nickm@torproject.org> no 2026-06-26
CVE-2026-63387.patch evdns: Fix out-of-bounds write in dnsname_to_labels
This bug would cause the program to write a single 0 byte off the
end of a stack buffer, if the code ever tried to make a DNS response
exactly 2^16 + 1 bytes long, ending with a DNS name.

Resolves issue GHSA-58rx-7448-jw47.

This issue was identified by Michał Majchrowicz and
Marcin Wyczechowski, members of the AFINE Team.

(cherry picked from commit 377b9022c3ac61aa4540b5dc4b70c60bf74c663d)		 Nick Mathewson <nickm@torproject.org> no 2026-06-24
CVE-2026-63388.patch bufferevent: Fix heap out-of-bounds write via AF_UNIX+http+NDEBUG
When running an evhttp server over an AF_UNIX socket,
on a copy of libevent compiled with NDEBUG,
it was possible for an attacker to use a crafted AF_UNIX address to
cause a heap overflow when recording the address.

This issue could also be triggered by direct calls
to the internal function bufferevent_socket_set_conn_address_
on a copy of libevent compiled with NDEBUG.

This bug still affected copies of libevent compiled without NDEBUG:
except that under those conditions, it would cause an assertion
failure with an abort() rather than a heap overflow.

As a fix:
- We check the length of the provided address unconditionally
(regardless of NDEBUG)
- We handle failures caused by the provided address being too long.
- We allocate enough room to store an AF_UNIX address.

Resolves GHSA-cvq5-vrvr-j338.

Reported by @mat-mo.

(cherry picked from commit ef38f926e9cd1f082416c6fff13587bc1f431d72)		 Nick Mathewson <nickm@torproject.org> no 2026-06-24

All known versions for source package 'libevent'

Links