diff options
| author | Xe Iaso <me@xeiaso.net> | 2025-03-31 18:27:01 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-03-31 18:27:01 -0400 |
| commit | f844fffd1ebd4178292df09ce181ad0d6db4038f (patch) | |
| tree | 3e6c8beed46530575703aa523b95eec7a0862587 | |
| parent | 4b8efcba9bec96f03e55ce3151cf02c0f269ca02 (diff) | |
| download | anubis-f844fffd1ebd4178292df09ce181ad0d6db4038f.tar.xz anubis-f844fffd1ebd4178292df09ce181ad0d6db4038f.zip | |
v1.15.1: Zenos yae Galvus: Echo 1 (#181)v1.15.1
* version 1.15.0 (#144)
Signed-off-by: Xe Iaso <me@xeiaso.net>
* cmd/anubis actually check the result with the correct difficulty
Signed-off-by: Xe Iaso <me@xeiaso.net>
* v1.15.1: Zenos yae Galvus: Echo 1
Signed-off-by: Xe Iaso <me@xeiaso.net>
---------
Signed-off-by: Xe Iaso <me@xeiaso.net>
Co-authored-by: Henri Vasserman <henv@hot.ee>
| -rw-r--r-- | VERSION | 2 | ||||
| -rw-r--r-- | docs/docs/CHANGELOG.md | 12 | ||||
| -rw-r--r-- | lib/anubis.go | 19 |
3 files changed, 22 insertions, 11 deletions
@@ -1 +1 @@ -1.15.0 +1.15.1 diff --git a/docs/docs/CHANGELOG.md b/docs/docs/CHANGELOG.md index 86c728f..d2a6498 100644 --- a/docs/docs/CHANGELOG.md +++ b/docs/docs/CHANGELOG.md @@ -11,6 +11,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## v1.15.1 + +Zenos yae Galvus: Echo 1 + +Fixes a recurrence of [CVE-2025-24369](https://github.com/Xe/x/security/advisories/GHSA-56w8-8ppj-2p4f) +due to an incorrect logic change in a refactor. This allows an attacker to mint a valid +access token by passing any SHA-256 hash instead of one that matches the proof-of-work +test. + +This case has been added as a regression test. It was not when CVE-2025-24369 was released +due to the project not having the maturity required to enable this kind of regression testing. + ## v1.15.0 Zenos yae Galvus diff --git a/lib/anubis.go b/lib/anubis.go index 83e04dd..026f912 100644 --- a/lib/anubis.go +++ b/lib/anubis.go @@ -145,14 +145,13 @@ func New(opts Options) (*Server, error) { } type Server struct { - mux *http.ServeMux - next http.Handler - priv ed25519.PrivateKey - pub ed25519.PublicKey - policy *policy.ParsedConfig - opts Options - DNSBLCache *decaymap.Impl[string, dnsbl.DroneBLResponse] - ChallengeDifficulty int + mux *http.ServeMux + next http.Handler + priv ed25519.PrivateKey + pub ed25519.PublicKey + policy *policy.ParsedConfig + opts Options + DNSBLCache *decaymap.Impl[string, dnsbl.DroneBLResponse] } func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { @@ -428,9 +427,9 @@ func (s *Server) PassChallenge(w http.ResponseWriter, r *http.Request) { } // compare the leading zeroes - if !strings.HasPrefix(response, strings.Repeat("0", s.ChallengeDifficulty)) { + if !strings.HasPrefix(response, strings.Repeat("0", rule.Challenge.Difficulty)) { s.ClearCookie(w) - lg.Debug("difficulty check failed", "response", response, "difficulty", s.ChallengeDifficulty) + lg.Debug("difficulty check failed", "response", response, "difficulty", rule.Challenge.Difficulty) templ.Handler(web.Base("Oh noes!", web.ErrorPage("invalid response")), templ.WithStatus(http.StatusForbidden)).ServeHTTP(w, r) failedValidations.Inc() return |