From c92aaa75be5b8ea52b59b8d4c7692e6382bdd9e8 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Mon, 27 Jul 2026 15:59:48 +0000 Subject: [PATCH] Fix CVE-2026-59692: DTLS certificate subject DN buffer overflow Backport upstream commit 9bb455393b to fix CVE-2026-59692, a buffer overflow in ext/dtls/gstdtlsconnection.c where a fixed 2048-byte stack buffer was used to store the peer certificate subject DN. The fix replaces the stack buffer with a dynamically allocated buffer sized to the actual length returned by X509_NAME_print_ex(), and adds proper error handling for the length check and BIO_read() call. The patch was manually rebased to account for line number differences between the upstream monorepo layout and the RHEL 8 standalone source tree. CVE: CVE-2026-59692 Upstream patches: - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/9bb455393b8ccb48e63027f3e30285f80cf3762c.patch Resolves: RHEL-193570 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- 0001-dtlsconnection-CVE-2026-59692.patch | 53 ++++++++++++++++++++++++ gstreamer1-plugins-bad-free.spec | 10 ++++- 2 files changed, 62 insertions(+), 1 deletion(-) create mode 100644 0001-dtlsconnection-CVE-2026-59692.patch diff --git a/0001-dtlsconnection-CVE-2026-59692.patch b/0001-dtlsconnection-CVE-2026-59692.patch new file mode 100644 index 0000000..d20c717 --- /dev/null +++ b/0001-dtlsconnection-CVE-2026-59692.patch @@ -0,0 +1,53 @@ +From 67ad927b1bef598ce1587b55a2eae949241f10cd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Thu, 25 Jun 2026 11:47:44 +0300 +Subject: [PATCH] dtlsconnection: Allocate large enough buffer for the peer + certificate subject DN + +Fix provided by Clouditera Security. + +Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5172 + +Part-of: +--- + ext/dtls/gstdtlsconnection.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/ext/dtls/gstdtlsconnection.c b/ext/dtls/gstdtlsconnection.c +index 244ec99..9202f3c 100644 +--- a/ext/dtls/gstdtlsconnection.c ++++ b/ext/dtls/gstdtlsconnection.c +@@ -823,16 +823,29 @@ openssl_verify_callback (int preverify_ok, X509_STORE_CTX * x509_ctx) + } else { + bio = BIO_new (BIO_s_mem ()); + if (bio) { +- gchar buffer[2048]; + gint len; ++ gint read_len; + + len = + X509_NAME_print_ex (bio, + X509_get_subject_name (X509_STORE_CTX_get0_cert (x509_ctx)), 1, + XN_FLAG_MULTILINE); +- BIO_read (bio, buffer, len); +- buffer[len] = '\0'; +- GST_DEBUG_OBJECT (self, "Peer certificate received:\n%s", buffer); ++ ++ if (len > 0) { ++ gchar *buffer; ++ ++ buffer = g_new (gchar, (gsize) len + 1); ++ read_len = BIO_read (bio, buffer, len); ++ if (read_len > 0) { ++ buffer[read_len] = '\0'; ++ GST_DEBUG_OBJECT (self, "Peer certificate received:\n%s", buffer); ++ } else { ++ GST_DEBUG_OBJECT (self, "failed to read certificate subject"); ++ } ++ g_free (buffer); ++ } else { ++ GST_DEBUG_OBJECT (self, "failed to read certificate subject"); ++ } + BIO_free (bio); + } else { + GST_DEBUG_OBJECT (self, "failed to create certificate print membio"); diff --git a/gstreamer1-plugins-bad-free.spec b/gstreamer1-plugins-bad-free.spec index 7c00288..4929dbc 100644 --- a/gstreamer1-plugins-bad-free.spec +++ b/gstreamer1-plugins-bad-free.spec @@ -14,7 +14,7 @@ Name: gstreamer1-plugins-bad-free Version: 1.16.1 -Release: 9%{?gitcommit:.git%{shortcommit}}%{?dist} +Release: 9%{?gitcommit:.git%{shortcommit}}%{?dist}.1 Summary: GStreamer streaming media framework "bad" plugins License: LGPLv2+ and LGPLv2 @@ -45,6 +45,8 @@ Patch7: 0001-librfb-Validate-framebuffer-update-rectangles-agains.patch # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/85cdda978b01a8cf8227a64bbc5fba37b3df0cb3 # https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/340428be2a37e5131049dea35703ad47f4db631f Patch8: 0001-rfbsrc-CVE-2026-59691.patch +# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/9bb455393b8ccb48e63027f3e30285f80cf3762c +Patch9: 0001-dtlsconnection-CVE-2026-59692.patch BuildRequires: gstreamer1-devel >= %{version} BuildRequires: gstreamer1-plugins-base-devel >= %{version} @@ -206,6 +208,7 @@ aren't tested well enough, or the code is not of good enough quality. %patch6 -p1 %patch7 -p1 %patch8 -p1 +%patch9 -p1 %build %configure --disable-silent-rules --disable-fatal-warnings \ @@ -494,6 +497,11 @@ find $RPM_BUILD_ROOT -name '*.la' -exec rm -fv {} ';' %changelog +* Mon Jul 27 2026 RHEL Packaging Agent - 1.16.1-9.1 +- Fix buffer overflow in DTLS certificate subject DN handling + (CVE-2026-59692) + Resolves: RHEL-193570 + * Sat Jul 11 2026 RHEL Packaging Agent - 1.16.1-9 - Fix rfbsrc/librfb vulnerabilities in rfbdecoder.c (CVE-2026-59691) Resolves: RHEL-193559