openSUSE-SU-2021:0443-1

This update for privoxy fixes the following issues:

Update to version 3.0.32:

• Security/Reliability (boo#1183129)

  • ssplit(): Remove an assertion that could be triggered with a crafted CGI request. Commit 2256d7b4d67. OVE-20210203-0001. CVE-2021-20272 Reported by: Joshua Rogers (Opera)
  • cgisendbanner(): Overrule invalid image types. Prevents a crash with a crafted CGI request if Privoxy is toggled off. Commit e711c505c48. OVE-20210206-0001. CVE-2021-20273 Reported by: Joshua Rogers (Opera)
  • socks5_connect(): Don't try to send credentials when none are configured. Fixes a crash due to a NULL-pointer dereference when the socks server misbehaves. Commit 85817cc55b9. OVE-20210207-0001. CVE-2021-20274 Reported by: Joshua Rogers (Opera)
  • chunkedbodyis_complete(): Prevent an invalid read of size two. Commit a912ba7bc9c. OVE-20210205-0001. CVE-2021-20275 Reported by: Joshua Rogers (Opera)
  • Obsolete pcre: Prevent invalid memory accesses with an invalid pattern passed to pcre_compile(). Note that the obsolete pcre code is scheduled to be removed before the 3.0.33 release. There has been a warning since 2008 already. Commit 28512e5b624. OVE-20210222-0001. CVE-2021-20276 Reported by: Joshua Rogers (Opera)

• Bug fixes:

  • Properly parse the client-tag-lifetime directive. Previously it was not accepted as an obsolete hash value was being used. Reported by: Joshua Rogers (Opera)
  • decompress_iob(): Prevent reading of uninitialized data. Reported by: Joshua Rogers (Opera).
  • decompress_iob(): Don't advance cur past eod when looking for the end of the file name and comment.
  • decompress_iob(): Cast value to unsigned char before shifting. Prevents a left-shift of a negative value which is undefined behaviour. Reported by: Joshua Rogers (Opera)
  • gif_deanimate(): Confirm that that we have enough data before doing any work. Fixes a crash when fuzzing with an empty document. Reported by: Joshua Rogers (Opera).
  • buf_copy(): Fail if there's no data to write or nothing to do. Prevents undefined behaviour 'applying zero offset to null pointer'. Reported by: Joshua Rogers (Opera)
  • logerror(): Treat LOGLEVEL_FATAL as fatal even when --stfu is being used while fuzzing. Reported by: Joshua Rogers (Opera).
  • Respect DESTDIR when considering whether or not to install config files with '.new' extension.
  • OpenSSL sslstorecert(): Fix two error messages.
  • Fix a couple of format specifiers.
  • Silence compiler warnings when compiling with NDEBUG.
  • fuzzserverheader(): Fix compiler warning.
  • fuzzclientheader(): Fix compiler warning.
  • cgisenduser_manual(): Also reject requests if the user-manual directive specifies a https:// URL. Previously Privoxy would try and fail to open a local file.

• General improvements:

  • Log the TLS version and the the cipher when debug 2 is enabled.
  • sslsendcertificate_error(): Respect HEAD requests by not sending a body.
  • sslsendcertificate_error(): End the body with a single new line.
  • serve(): Increase the chances that the host is logged when closing a server socket.
  • handleestablishedconnection(): Add parentheses to clarify an expression Suggested by: David Binderman
  • continuehttpschat(): Explicitly unset CSPFLAGCLIENTCONNECTIONKEEPALIVE if processencryptedrequest() fails. This makes it more obvious that the connection will not be reused. Previously serve() relied on CSPFLAGSERVERCONTENTLENGTHSET and CSPFLAGCHUNKED being unset. Inspired by a patch from Joshua Rogers (Opera).
  • decompress_iob(): Add periods to a couple of log messages
  • Terminate the body of the HTTP snipplets with a single new line instead of '\r\n'.
  • configure: Add --with-assertions option and only enable assertions when it is used
  • windows build: Use --with-brotli and --with-mbedtls by default and enable dynamic error checking.
  • gifdeanimate(): Confirm we've got an image before trying to write it Saves a pointless bufcopy() call.
  • OpenSSL sslstorecert(): Remove a superfluous space before the serial number.

• Action file improvements:

  • Disable fast-redirects for .golem.de/
  • Unblock requests to adri*.
  • Block requests for trc*.taboola.com/
  • Disable fast-redirects for .linkedin.com/

• Filter file improvements:

  • Make the second pcrs job of the img-reorder filter greedy again. The ungreedy version broke the img tags on: https://bulk.fefe.de/scalability/.

• Privoxy-Log-Parser:

  • Highlight a few more messages.
  • Clarify the --statistics output. The shown 'Reused connections' are server connections so name them appropriately.
  • Bump version to 0.9.3.

• Privoxy-Regression-Test:

  • Add the --check-bad-ssl option to the --help output.
  • Bump version to 0.7.3.

• Documentation:

  • Add pushing the created tag to the release steps in the developer manual.
  • Clarify that 'debug 32768' should be used in addition to the other debug directives when reporting problems.
  • Add a 'Third-party licenses and copyrights' section to the user manual.