bughz/tinyproxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
942d0c6b03
tinyproxy/src
History
rofl0r 12a8484265 fix potential UAF in header handling (CVE-2023-49606) 
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1889

this bug was brought to my attention today by the debian tinyproxy
package maintainer. the above link states that the issue was known
since last year and that maintainers have been contacted, but if
that is even true then it probably was done via a private email
to a potentially outdated email address of one of the maintainers,
not through the channels described clearly on the tinyproxy homepage:

> Feel free to report a new bug or suggest features via github issues.
> Tinyproxy developers hang out in #tinyproxy on irc.libera.chat.

no github issue was filed, and nobody mentioned a vulnerability on
the mentioned IRC chat. if the issue had been reported on github or
IRC, the bug would have been fixed within a day.
2024-05-05 10:37:29 +00:00
..
.gitignore Removed obsolete ignore rules 2008-06-19 21:33:20 +05:30
acl.c Include limits.h to fix build on OSX 2021-05-13 01:15:13 +01:00
acl.h make acl lookup 450x faster by using sblist 2020-09-07 22:09:35 +01:00
anonymous.c replace leftover users of hashmap with htab 2020-09-15 23:12:00 +01:00
anonymous.h replace leftover users of hashmap with htab 2020-09-15 23:12:00 +01:00
base64.c move base64 code into own file 2018-02-06 16:57:02 +00:00
base64.h move base64 code into own file 2018-02-06 16:57:02 +00:00
basicauth.c basicauth: use sblist 2020-09-16 02:39:09 +01:00
basicauth.h basicauth: use sblist 2020-09-16 02:39:09 +01:00
buffer.c buffer: fix log message in read_buffer(). 2013-11-23 12:21:59 +01:00
buffer.h Convert tabs to spaces 2008-12-08 13:39:44 +00:00
child.c fix omission to reset socklen parameter for accept() 2023-06-07 18:57:05 +00:00
child.h listen_addrs: use sblist 2020-09-16 02:39:09 +01:00
common.h Include limits.h to fix build on OSX 2021-05-13 01:15:13 +01:00
conf-tokens.c implement filtertype keyword and fnmatch-based filtering 2022-05-02 13:13:40 +00:00
conf-tokens.gperf implement filtertype keyword and fnmatch-based filtering 2022-05-02 13:13:40 +00:00
conf-tokens.h implement filtertype keyword and fnmatch-based filtering 2022-05-02 13:13:40 +00:00
conf.c BasicAuth: Accept special chars in username and password (#516) 2023-11-02 19:24:42 +00:00
conf.h implement filtertype keyword and fnmatch-based filtering 2022-05-02 13:13:40 +00:00
connect-ports.c connect_ports: use sblist 2020-09-16 02:39:09 +01:00
connect-ports.h connect_ports: use sblist 2020-09-16 02:39:09 +01:00
conns.c refactor conns.[ch], put conn_s into child struct 2020-09-15 23:12:00 +01:00
conns.h refactor conns.[ch], put conn_s into child struct 2020-09-15 23:12:00 +01:00
daemon.c daemon.c: fix #if NDEBUG --> #ifdef NDEBUG 2009-11-10 17:59:40 +01:00
daemon.h Reformat code to GNU coding style 2008-12-01 15:01:11 +00:00
filter.c implement filtertype keyword and fnmatch-based filtering 2022-05-02 13:13:40 +00:00
filter.h implement filtertype keyword and fnmatch-based filtering 2022-05-02 13:13:40 +00:00
heap.c simplify codebase by using one thread/conn, instead of preforked procs 2019-12-21 00:43:45 +00:00
heap.h simplify codebase by using one thread/conn, instead of preforked procs 2019-12-21 00:43:45 +00:00
hostspec.c fix regression failing to parse dotted netmask in upstream 2021-08-23 14:00:05 +00:00
hostspec.h make upstream site-spec ipv6 compatible, refactor acl code 2021-04-16 14:46:02 +01:00
hsearch.c hsearch: fix potential UB (pointer arithmetics on nullptr) 2023-02-01 13:16:58 +00:00
hsearch.h orderedmap: fix memory leak when using orderedmap_remove() 2021-03-14 16:06:10 +00:00
html-error.c print error message if errorfile is configured but can't be opened 2022-05-27 12:48:41 +00:00
html-error.h refactor html-error so send_http_headers() can take extra arg 2021-03-28 20:24:23 +01:00
http-message.c http-message: fix UB passing long to format string expecting int 2020-10-19 20:33:04 +01:00
http-message.h http_message_add_headers: make argument num_headers unsigned 2009-08-07 09:24:32 +02:00
log.c log: replace non-mt-safe localtime() with localtime_r() 2020-10-19 20:26:12 +01:00
log.h make send_stored_logs static 2018-02-25 18:35:34 +00:00
loop.c free() loop records too 2020-09-15 23:12:00 +01:00
loop.h free() loop records too 2020-09-15 23:12:00 +01:00
main.c main: print filename of config file used on (re)load 2024-05-01 23:48:37 +00:00
main.h remove duplicate code calling reload_config_file() 2020-01-15 16:35:43 +00:00
Makefile.am add gperf generated files to make dist 2022-05-27 14:06:16 +00:00
mypoll.c use poll() where available 2020-09-15 23:12:00 +01:00
mypoll.h tune error messages to show select or poll depending on what is used 2020-09-17 21:03:51 +01:00
network.c safe_write/read: take void* buffer for generic use 2017-12-04 11:33:01 +00:00
network.h safe_write/read: take void* buffer for generic use 2017-12-04 11:33:01 +00:00
orderedmap.c orderedmap: fix memory leak when using orderedmap_remove() 2021-03-14 16:06:10 +00:00
orderedmap.h save headers in an ordered dictionary 2020-09-15 23:11:59 +01:00
reqs.c fix potential UAF in header handling (CVE-2023-49606) 2024-05-05 10:37:29 +00:00
reqs.h refactor conns.[ch], put conn_s into child struct 2020-09-15 23:12:00 +01:00
reverse-proxy.c reverse: redirect if path without trailing slash is detected 2021-04-16 14:41:40 +01:00
reverse-proxy.h reverse: redirect if path without trailing slash is detected 2021-04-16 14:41:40 +01:00
sblist.c simplify codebase by using one thread/conn, instead of preforked procs 2019-12-21 00:43:45 +00:00
sblist.h simplify codebase by using one thread/conn, instead of preforked procs 2019-12-21 00:43:45 +00:00
sock.c bind_socket(): improve log output 2022-03-01 15:17:32 +00:00
sock.h fix timeout not being applied to outgoing connections 2022-01-20 20:25:42 +00:00
stats.c refactor html-error so send_http_headers() can take extra arg 2021-03-28 20:24:23 +01:00
stats.h Indent code to Tinyproxy coding style 2009-09-15 01:11:25 +05:30
text.c Indent code to Tinyproxy coding style 2009-09-15 01:11:25 +05:30
text.h Reformat code to GNU coding style 2008-12-01 15:01:11 +00:00
transparent-proxy.c transparent: workaround old glibc bug on RHEL7 2020-09-18 12:12:14 +01:00
transparent-proxy.h save headers in an ordered dictionary 2020-09-15 23:11:59 +01:00
upstream.c make upstream site-spec ipv6 compatible, refactor acl code 2021-04-16 14:46:02 +01:00
upstream.h make upstream site-spec ipv6 compatible, refactor acl code 2021-04-16 14:46:02 +01:00
utils.c Use correct format string for POSIX pid_t in pidfile_create() 2009-09-27 08:09:24 +05:30
utils.h Convert tabs to spaces 2008-12-08 13:39:44 +00:00