From 078bd3636ad240e3a4335c606094688974bdc40f Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 4 Aug 2026 16:11:08 -0400 Subject: [PATCH] import CS git libgcrypt-1.10.0-13.el9_8 --- .../libgcrypt-1.11.0-montgomery-zeroes.patch | 40 +++++++++++++++++++ SPECS/libgcrypt.spec | 11 ++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 SOURCES/libgcrypt-1.11.0-montgomery-zeroes.patch diff --git a/SOURCES/libgcrypt-1.11.0-montgomery-zeroes.patch b/SOURCES/libgcrypt-1.11.0-montgomery-zeroes.patch new file mode 100644 index 0000000..e735100 --- /dev/null +++ b/SOURCES/libgcrypt-1.11.0-montgomery-zeroes.patch @@ -0,0 +1,40 @@ +From 5ba63ec41a6e734c9ff82e20e4f84ac94c59ae27 Mon Sep 17 00:00:00 2001 +From: NIIBE Yutaka +Date: Fri, 10 Apr 2026 16:58:57 +0900 +Subject: [PATCH] cipher:ecc: Fix decoding a point on Montgomery curve. + +* cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix the padding +mistake and add updating RAWMPILEN. + +-- + +Reported by Calif.io in collaboration with Claude and Anthropic +Research. + +GnuPG-bug-id: 8211 +Fixes-commit: bbe15758c893dbf546416c1a6bccdad1ab000ad7 +Suggested-by: Bronson Yen +Signed-off-by: NIIBE Yutaka +--- + cipher/ecc-misc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/cipher/ecc-misc.c b/cipher/ecc-misc.c +index 0c387c27..be4e2862 100644 +--- a/cipher/ecc-misc.c ++++ b/cipher/ecc-misc.c +@@ -324,7 +324,10 @@ _gcry_ecc_mont_decodepoint (gcry_mpi_t pk, mpi_ec_t ctx, mpi_point_t result) + *--p = *buf++; + + if (rawmpilen < nbytes) +- memset (rawmpi + nbytes - rawmpilen, 0, nbytes - rawmpilen); ++ { ++ memset (rawmpi + rawmpilen, 0, nbytes - rawmpilen); ++ rawmpilen = nbytes; ++ } + } + else + { +-- +2.54.0 + diff --git a/SPECS/libgcrypt.spec b/SPECS/libgcrypt.spec index ba1e300..1887979 100644 --- a/SPECS/libgcrypt.spec +++ b/SPECS/libgcrypt.spec @@ -16,7 +16,7 @@ print(string.sub(hash, 0, 16)) Name: libgcrypt Version: 1.10.0 -Release: 11%{?dist} +Release: 13%{?dist} URL: https://www.gnupg.org/ Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2 Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig @@ -88,6 +88,8 @@ Patch22: libgcrypt-1.10.0-marvin.patch Patch23: libgcrypt-1.10.0-marvin2.patch # https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/ Patch24: libgcrypt-1.10.0-marvin3.patch +# https://dev.gnupg.org/T8211.html +Patch25: libgcrypt-1.11.0-montgomery-zeroes.patch %global gcrylibdir %{_libdir} %global gcrysoname libgcrypt.so.20 @@ -145,6 +147,7 @@ applications using libgcrypt. %patch22 -p1 %patch23 -p1 %patch24 -p1 +%patch25 -p1 %build # This package has a configure test which uses ASMs, but does not link the @@ -265,6 +268,12 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt %license COPYING %changelog +* Tue Jun 30 2026 Jakub Jelen - 1.10.0-13 +- Bump version to fix wrong build target. + +* Fri Jun 26 2026 Jakub Jelen - 1.10.0.12 +- Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext + * Thu Aug 01 2024 Jakub Jelen - 1.10.0-11 - Fix CVE-2024-2236 (RHEL-34579)