Compare commits
No commits in common. "imports/c8-beta/libksba-1.3.5-7.el8" and "c8s" have entirely different histories.
imports/c8
...
c8s
17
.gitignore
vendored
17
.gitignore
vendored
@ -1 +1,16 @@
|
|||||||
SOURCES/libksba-1.3.5.tar.bz2
|
libksba-1.0.8.tar.bz2
|
||||||
|
libksba-1.0.8.tar.bz2.sig
|
||||||
|
/libksba-1.2.0.tar.bz2
|
||||||
|
/libksba-1.2.0.tar.bz2.sig
|
||||||
|
/libksba-1.3.0.tar.bz2
|
||||||
|
/libksba-1.3.0.tar.bz2.sig
|
||||||
|
/libksba-1.3.1.tar.bz2
|
||||||
|
/libksba-1.3.1.tar.bz2.sig
|
||||||
|
/libksba-1.3.2.tar.bz2
|
||||||
|
/libksba-1.3.2.tar.bz2.sig
|
||||||
|
/libksba-1.3.3.tar.bz2
|
||||||
|
/libksba-1.3.3.tar.bz2.sig
|
||||||
|
/libksba-1.3.4.tar.bz2
|
||||||
|
/libksba-1.3.4.tar.bz2.sig
|
||||||
|
/libksba-1.3.5.tar.bz2
|
||||||
|
/libksba-1.3.5.tar.bz2.sig
|
||||||
|
@ -1 +0,0 @@
|
|||||||
a98385734a0c3f5b713198e8d6e6e4aeb0b76fde SOURCES/libksba-1.3.5.tar.bz2
|
|
Binary file not shown.
7
gating.yaml
Normal file
7
gating.yaml
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
--- !Policy
|
||||||
|
product_versions:
|
||||||
|
- rhel-8
|
||||||
|
decision_context: osci_compose_gate
|
||||||
|
rules:
|
||||||
|
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
|
||||||
|
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tedude.validation}
|
104
libksba-1.5.1-overflow.patch
Normal file
104
libksba-1.5.1-overflow.patch
Normal file
@ -0,0 +1,104 @@
|
|||||||
|
From 4b7d9cd4a018898d7714ce06f3faf2626c14582b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Werner Koch <wk@gnupg.org>
|
||||||
|
Date: Wed, 5 Oct 2022 14:19:06 +0200
|
||||||
|
Subject: [PATCH] Detect a possible overflow directly in the TLV parser.
|
||||||
|
|
||||||
|
* src/ber-help.c (_ksba_ber_read_tl): Check for overflow of a commonly
|
||||||
|
used sum.
|
||||||
|
--
|
||||||
|
|
||||||
|
It is quite common to have checks like
|
||||||
|
|
||||||
|
if (ti.nhdr + ti.length >= DIM(tmpbuf))
|
||||||
|
return gpg_error (GPG_ERR_TOO_LARGE);
|
||||||
|
|
||||||
|
This patch detects possible integer overflows immmediately when
|
||||||
|
creating the TI object.
|
||||||
|
|
||||||
|
Reported-by: ZDI-CAN-18927, ZDI-CAN-18928, ZDI-CAN-18929
|
||||||
|
---
|
||||||
|
src/ber-help.c | 6 ++++++
|
||||||
|
1 file changed, 6 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/src/ber-help.c b/src/ber-help.c
|
||||||
|
index 81c31ed..56efb6a 100644
|
||||||
|
--- a/src/ber-help.c
|
||||||
|
+++ b/src/ber-help.c
|
||||||
|
@@ -182,6 +182,12 @@ _ksba_ber_read_tl (ksba_reader_t reader, struct tag_info *ti)
|
||||||
|
ti->length = len;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (ti->length > ti->nhdr && (ti->nhdr + ti->length) < ti->length)
|
||||||
|
+ {
|
||||||
|
+ ti->err_string = "header+length would overflow";
|
||||||
|
+ return gpg_error (GPG_ERR_EOVERFLOW);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/* Without this kludge some example certs can't be parsed */
|
||||||
|
if (ti->class == CLASS_UNIVERSAL && !ti->tag)
|
||||||
|
ti->length = 0;
|
||||||
|
--
|
||||||
|
2.37.3
|
||||||
|
|
||||||
|
commit f61a5ea4e0f6a80fd4b28ef0174bee77793cf070
|
||||||
|
Author: Werner Koch <wk@gnupg.org>
|
||||||
|
Date: Tue Nov 22 16:36:46 2022 +0100
|
||||||
|
|
||||||
|
Fix an integer overflow in the CRL signature parser.
|
||||||
|
|
||||||
|
* src/crl.c (parse_signature): N+N2 now checked for overflow.
|
||||||
|
|
||||||
|
* src/ocsp.c (parse_response_extensions): Do not accept too large
|
||||||
|
values.
|
||||||
|
(parse_single_extensions): Ditto.
|
||||||
|
--
|
||||||
|
|
||||||
|
The second patch is an extra safegourd not related to the reported
|
||||||
|
bug.
|
||||||
|
|
||||||
|
GnuPG-bug-id: 6284
|
||||||
|
Reported-by: Joseph Surin, elttam
|
||||||
|
|
||||||
|
diff --git a/src/crl.c b/src/crl.c
|
||||||
|
index 9f71c85..2e6ca29 100644
|
||||||
|
--- a/src/crl.c
|
||||||
|
+++ b/src/crl.c
|
||||||
|
@@ -1349,7 +1349,7 @@ parse_signature (ksba_crl_t crl)
|
||||||
|
&& !ti.is_constructed) )
|
||||||
|
return gpg_error (GPG_ERR_INV_CRL_OBJ);
|
||||||
|
n2 = ti.nhdr + ti.length;
|
||||||
|
- if (n + n2 >= DIM(tmpbuf))
|
||||||
|
+ if (n + n2 >= DIM(tmpbuf) || (n + n2) < n)
|
||||||
|
return gpg_error (GPG_ERR_TOO_LARGE);
|
||||||
|
memcpy (tmpbuf+n, ti.buf, ti.nhdr);
|
||||||
|
err = read_buffer (crl->reader, tmpbuf+n+ti.nhdr, ti.length);
|
||||||
|
diff --git a/src/ocsp.c b/src/ocsp.c
|
||||||
|
index d4cba04..657d15f 100644
|
||||||
|
--- a/src/ocsp.c
|
||||||
|
+++ b/src/ocsp.c
|
||||||
|
@@ -721,6 +721,12 @@ parse_response_extensions (ksba_ocsp_t ocsp,
|
||||||
|
else
|
||||||
|
ocsp->good_nonce = 1;
|
||||||
|
}
|
||||||
|
+ if (ti.length > (1<<24))
|
||||||
|
+ {
|
||||||
|
+ /* Bail out on much too large objects. */
|
||||||
|
+ err = gpg_error (GPG_ERR_BAD_BER);
|
||||||
|
+ goto leave;
|
||||||
|
+ }
|
||||||
|
ex = xtrymalloc (sizeof *ex + strlen (oid) + ti.length);
|
||||||
|
if (!ex)
|
||||||
|
{
|
||||||
|
@@ -788,6 +794,12 @@ parse_single_extensions (struct ocsp_reqitem_s *ri,
|
||||||
|
err = parse_octet_string (&data, &datalen, &ti);
|
||||||
|
if (err)
|
||||||
|
goto leave;
|
||||||
|
+ if (ti.length > (1<<24))
|
||||||
|
+ {
|
||||||
|
+ /* Bail out on much too large objects. */
|
||||||
|
+ err = gpg_error (GPG_ERR_BAD_BER);
|
||||||
|
+ goto leave;
|
||||||
|
+ }
|
||||||
|
ex = xtrymalloc (sizeof *ex + strlen (oid) + ti.length);
|
||||||
|
if (!ex)
|
||||||
|
{
|
@ -1,7 +1,7 @@
|
|||||||
Summary: CMS and X.509 library
|
Summary: CMS and X.509 library
|
||||||
Name: libksba
|
Name: libksba
|
||||||
Version: 1.3.5
|
Version: 1.3.5
|
||||||
Release: 7%{?dist}
|
Release: 9%{?dist}
|
||||||
|
|
||||||
# The library is licensed under LGPLv3+ or GPLv2+,
|
# The library is licensed under LGPLv3+ or GPLv2+,
|
||||||
# the rest of the package under GPLv3+
|
# the rest of the package under GPLv3+
|
||||||
@ -13,6 +13,8 @@ Source1: ftp://ftp.gnupg.org/gcrypt/libksba/libksba-%{version}.tar.bz2.sig
|
|||||||
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
|
||||||
|
|
||||||
Patch1: libksba-1.3.0-multilib.patch
|
Patch1: libksba-1.3.0-multilib.patch
|
||||||
|
# Fix for CVE-2022-3515
|
||||||
|
Patch2: libksba-1.5.1-overflow.patch
|
||||||
|
|
||||||
BuildRequires: gawk
|
BuildRequires: gawk
|
||||||
BuildRequires: libgpg-error-devel >= 1.8
|
BuildRequires: libgpg-error-devel >= 1.8
|
||||||
@ -37,6 +39,7 @@ Requires(preun): /sbin/install-info
|
|||||||
%setup -q
|
%setup -q
|
||||||
|
|
||||||
%patch1 -p1 -b .multilib
|
%patch1 -p1 -b .multilib
|
||||||
|
%patch2 -p1 -b .overflow
|
||||||
|
|
||||||
|
|
||||||
%build
|
%build
|
||||||
@ -87,6 +90,12 @@ fi
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jan 25 2023 Jakub Jelen <jjelen@redhat.com> - 1.3.5-9
|
||||||
|
- Fix for CVE-2022-47629 (#2161571)
|
||||||
|
|
||||||
|
* Wed Oct 19 2022 Jakub Jelen <jjelen@redhat.com> - 1.3.5-8
|
||||||
|
- Fix for CVE-2022-3515 (#2135702)
|
||||||
|
|
||||||
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.5-7
|
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.3.5-7
|
||||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||||
|
|
2
sources
Normal file
2
sources
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
SHA512 (libksba-1.3.5.tar.bz2) = 60179bfd109b7b4fd8d2b30a3216540f03f5a13620d9a5b63f1f95788028708a420911619f172ba57e945a6a2fcd2ef7eaafc5585a0eb2b9652cfadf47bf39a2
|
||||||
|
SHA512 (libksba-1.3.5.tar.bz2.sig) = 6b58b1c6ee924230e4f3b040836e85cb3b3f527f667bcb370c28d8ec702c884bcceab374688e02d0356dede81f9fcf975d726c1958d4d87e5c41757a6b2ba39e
|
Loading…
Reference in New Issue
Block a user