rpms/libgcrypt
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI libgcrypt-1.11.0-7.el10_2

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-04 14:15:20 -04:00
parent a1e051cdda
commit ba0eb36f09
2 changed files with 59 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
libgcrypt-1.11.0-montgomery-zeroes.patch Normal file
View File

@ -0,0 +1,40 @@
From 5ba63ec41a6e734c9ff82e20e4f84ac94c59ae27 Mon Sep 17 00:00:00 2001
From: NIIBE Yutaka <gniibe@fsij.org>
Date: Fri, 10 Apr 2026 16:58:57 +0900
Subject: [PATCH] cipher:ecc: Fix decoding a point on Montgomery curve.
* cipher/ecc-misc.c (_gcry_ecc_mont_decodepoint): Fix the padding
mistake and add updating RAWMPILEN.
--
Reported by Calif.io in collaboration with Claude and Anthropic
Research.
GnuPG-bug-id: 8211
Fixes-commit: bbe15758c893dbf546416c1a6bccdad1ab000ad7
Suggested-by: Bronson Yen <bronson@calif.io>
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
---
cipher/ecc-misc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/cipher/ecc-misc.c b/cipher/ecc-misc.c
index 0c387c27..be4e2862 100644
--- a/cipher/ecc-misc.c
+++ b/cipher/ecc-misc.c
@@ -324,7 +324,10 @@ _gcry_ecc_mont_decodepoint (gcry_mpi_t pk, mpi_ec_t ctx, mpi_point_t result)
*--p = *buf++;
if (rawmpilen < nbytes)
- memset (rawmpi + nbytes - rawmpilen, 0, nbytes - rawmpilen);
+ {
+ memset (rawmpi + rawmpilen, 0, nbytes - rawmpilen);
+ rawmpilen = nbytes;
+ }
}
else
{
--
2.54.0

20
libgcrypt.spec
View File

@ -15,7 +15,7 @@ print(string.sub(hash, 0, 16))
Name: libgcrypt
Version: 1.11.0
Release: 5%{?dist}
Release: 7%{?dist}
URL: https://www.gnupg.org/
Source0: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2
Source1: https://www.gnupg.org/ftp/gcrypt/libgcrypt/libgcrypt-%{version}.tar.bz2.sig
@ -31,6 +31,8 @@ Patch4: libgcrypt-1.11.0-cf-protection.patch
Patch5: libgcrypt-1.11.0-pac-bti-protection.patch
# https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/19/
Patch6: libgcrypt-1.11.0-marvin.patch
# https://dev.gnupg.org/T8211.html
Patch7: libgcrypt-1.11.0-montgomery-zeroes.patch
%global gcrylibdir %{_libdir}
%global gcrysoname libgcrypt.so.20
@ -71,6 +73,7 @@ applications using libgcrypt.
%patch 4 -p1
%patch 5 -p1
%patch 6 -p1
%patch 7 -p1
%build
# should be all algorithms except SM3 and SM4, aria
@ -101,7 +104,15 @@ make check
# try in faked FIPS mode too
LIBGCRYPT_FORCE_FIPS_MODE=1 make check
# annocheck currently fails on riscv64 with the following error:
#
# MAYB: test: gaps, reason: not all of the .text section is covered by notes
# Overall: FAIL (due to MAYB results).
#
# Disable it on the architecture until the issue can be sorted out.
%ifnarch riscv64
PROFILE=%{?dist} annocheck --ignore-unknown --verbose --profile=${PROFILE:1} $RPM_BUILD_ROOT%{gcrylibdir}/libgcrypt.so.20.5.0
%endif
# Add generation of HMAC checksums of the final stripped binaries
@ -185,6 +196,13 @@ mkdir -p -m 755 $RPM_BUILD_ROOT/etc/gcrypt
%license COPYING
%changelog
* Fri Jun 26 2026 Jakub Jelen <jjelen@redhat.com> - 1.11.0-7
- Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext
* Tue Apr 29 2025 Andrea Bolognani <abologna@redhat.com> - 1.11.0-6
- Disable annocheck on riscv64 (fixes build)
Resolves: RHEL-88837
* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.11.0-5
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018