rpms/gstreamer1-plugins-bad-free
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-59692: DTLS certificate subject DN buffer overflow

Browse Source 
Backport upstream commit 9bb455393b to fix CVE-2026-59692,
a buffer overflow in ext/dtls/gstdtlsconnection.c where a
fixed 2048-byte stack buffer was used to store the peer
certificate subject DN. The fix replaces the stack buffer
with a dynamically allocated buffer sized to the actual
length returned by X509_NAME_print_ex(), and adds proper
error handling for the length check and BIO_read() call.

The patch was manually rebased to account for line number
differences between the upstream monorepo layout and the
RHEL 8 standalone source tree.

CVE: CVE-2026-59692
Upstream patches:
 - 9bb455393b.patch
Resolves: RHEL-193570

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-27 15:59:48 +00:00
parent 772eed30e2
commit c92aaa75be
2 changed files with 62 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

53
0001-dtlsconnection-CVE-2026-59692.patch Normal file
View File

@ -0,0 +1,53 @@
From 67ad927b1bef598ce1587b55a2eae949241f10cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Thu, 25 Jun 2026 11:47:44 +0300
Subject: [PATCH] dtlsconnection: Allocate large enough buffer for the peer
certificate subject DN
Fix provided by Clouditera Security.
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5172
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12076>
---
ext/dtls/gstdtlsconnection.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
diff --git a/ext/dtls/gstdtlsconnection.c b/ext/dtls/gstdtlsconnection.c
index 244ec99..9202f3c 100644
--- a/ext/dtls/gstdtlsconnection.c
+++ b/ext/dtls/gstdtlsconnection.c
@@ -823,16 +823,29 @@ openssl_verify_callback (int preverify_ok, X509_STORE_CTX * x509_ctx)
} else {
bio = BIO_new (BIO_s_mem ());
if (bio) {
- gchar buffer[2048];
gint len;
+ gint read_len;
len =
X509_NAME_print_ex (bio,
X509_get_subject_name (X509_STORE_CTX_get0_cert (x509_ctx)), 1,
XN_FLAG_MULTILINE);
- BIO_read (bio, buffer, len);
- buffer[len] = '\0';
- GST_DEBUG_OBJECT (self, "Peer certificate received:\n%s", buffer);
+
+ if (len > 0) {
+ gchar *buffer;
+
+ buffer = g_new (gchar, (gsize) len + 1);
+ read_len = BIO_read (bio, buffer, len);
+ if (read_len > 0) {
+ buffer[read_len] = '\0';
+ GST_DEBUG_OBJECT (self, "Peer certificate received:\n%s", buffer);
+ } else {
+ GST_DEBUG_OBJECT (self, "failed to read certificate subject");
+ }
+ g_free (buffer);
+ } else {
+ GST_DEBUG_OBJECT (self, "failed to read certificate subject");
+ }
BIO_free (bio);
} else {
GST_DEBUG_OBJECT (self, "failed to create certificate print membio");

10
gstreamer1-plugins-bad-free.spec
View File

@ -14,7 +14,7 @@
Name: gstreamer1-plugins-bad-free
Version: 1.16.1
Release: 9%{?gitcommit:.git%{shortcommit}}%{?dist}
Release: 9%{?gitcommit:.git%{shortcommit}}%{?dist}.1
Summary: GStreamer streaming media framework "bad" plugins
License: LGPLv2+ and LGPLv2
@ -45,6 +45,8 @@ Patch7: 0001-librfb-Validate-framebuffer-update-rectangles-agains.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/85cdda978b01a8cf8227a64bbc5fba37b3df0cb3
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/340428be2a37e5131049dea35703ad47f4db631f
Patch8: 0001-rfbsrc-CVE-2026-59691.patch
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/9bb455393b8ccb48e63027f3e30285f80cf3762c
Patch9: 0001-dtlsconnection-CVE-2026-59692.patch
BuildRequires: gstreamer1-devel >= %{version}
BuildRequires: gstreamer1-plugins-base-devel >= %{version}
@ -206,6 +208,7 @@ aren't tested well enough, or the code is not of good enough quality.
%patch6 -p1
%patch7 -p1
%patch8 -p1
%patch9 -p1
%build
%configure --disable-silent-rules --disable-fatal-warnings \
@ -494,6 +497,11 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';'
%changelog
* Mon Jul 27 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-9.1
- Fix buffer overflow in DTLS certificate subject DN handling
(CVE-2026-59692)
Resolves: RHEL-193570
* Sat Jul 11 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.16.1-9
- Fix rfbsrc/librfb vulnerabilities in rfbdecoder.c (CVE-2026-59691)
Resolves: RHEL-193559