rpms/libreswan
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Backport fix for CVE-2026-14957

Browse Source 
Resolves: RHEL-212107
Signed-off-by: Daiki Ueno <dueno@redhat.com>
This commit is contained in:
Daiki Ueno 2026-07-23 10:30:50 +09:00
parent 936e2d3050
commit 60fd54279c
2 changed files with 81 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
libreswan-4.15-CVE-2026-14957.patch Normal file
View File

@ -0,0 +1,76 @@
From 71a0653c9d4682b452da70145b548a3c48d490e7 Mon Sep 17 00:00:00 2001
From: Andrew Cagney <cagney@gnu.org>
Date: Thu, 9 Jul 2026 19:02:42 -0400
Subject: [PATCH 1/2] x509: tighten nss_compat BER check
---
lib/libswan/x509dn.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/libswan/x509dn.c b/lib/libswan/x509dn.c
index b07e38b91d..626e6e4728 100644
--- a/lib/libswan/x509dn.c
+++ b/lib/libswan/x509dn.c
@@ -378,6 +378,7 @@ static err_t format_dn(struct jambuf *buf, asn1_t dn,
* #BER.
*/
(nss_compatible &&
+ value_content.len > 0 &&
((const char*)value_content.ptr)[0] == '#')) {
/* BER */
jam(buf, "#");
--
2.54.0
From b1672dca4628357808b3de88ecf9322beb04a6c5 Mon Sep 17 00:00:00 2001
From: Andrew Cagney <cagney@gnu.org>
Date: Thu, 9 Jul 2026 19:04:01 -0400
Subject: [PATCH 2/2] ikev2: check the cert's pubkey unpacked before using it -
cve-2026-14957
---
programs/pluto/nss_cert_verify.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c
index 3e16566fb1..43af788cb8 100644
--- a/programs/pluto/nss_cert_verify.c
+++ b/programs/pluto/nss_cert_verify.c
@@ -392,16 +392,23 @@ static void add_decoded_cert(CERTCertDBHandle *handle,
*/
if (libreswan_fipsmode()) {
SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert);
- passert(pk != NULL);
- unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
- if (pk->keyType == rsaKey && key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
- llog(RC_LOG, logger,
- "FIPS: rejecting peer cert with key size %u under %u: %s",
- key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
- cert->subjectName);
- SECKEY_DestroyPublicKey(pk);
- CERT_DestroyCertificate(cert);
- return;
+ if (pk == NULL) {
+ llog_nss_error(RC_LOG, logger,
+ "extracting certificate public key using CERT_ExtractPublicKey() failed");
+ return;
+ }
+
+ if (pk->keyType == rsaKey) {
+ unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
+ if (key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
+ llog(RC_LOG, logger,
+ "FIPS: rejecting peer cert with key size %u under %u: %s",
+ key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
+ cert->subjectName);
+ SECKEY_DestroyPublicKey(pk);
+ CERT_DestroyCertificate(cert);
+ return;
+ }
}
SECKEY_DestroyPublicKey(pk);
}
--
2.54.0

6
libreswan.spec
View File

@ -31,7 +31,7 @@ Name: libreswan
Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
# version is generated in the release script
Version: 4.15
Release: %{?prever:0.}9%{?prever:.%{prever}}%{?dist}
Release: %{?prever:0.}10%{?prever:.%{prever}}%{?dist}
License: GPLv2
Url: https://libreswan.org/
Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
@ -48,6 +48,7 @@ Patch: libreswan-4.15-rereadsecrets.patch
Patch: libreswan-4.15-CVE-2026-12413.patch
Patch: libreswan-4.15-CVE-2026-50721.patch
Patch: libreswan-4.15-CVE-2026-50722.patch
Patch: libreswan-4.15-CVE-2026-14957.patch
BuildRequires: audit-libs-devel
BuildRequires: bison
@ -203,6 +204,9 @@ certutil -N -d sql:$tmpdir --empty-password
%doc %{_mandir}/*/*
%changelog
* Thu Jul 23 2026 Daiki Ueno <dueno@redhat.com> - 4.15-10
- Backport fix for CVE-2026-14957 (RHEL-212107)
* Thu Jul 02 2026 Daiki Ueno <dueno@redhat.com> - 4.15-9
- Backport fixes for CVE-2026-12413, CVE-2026-50721 and CVE-2026-50722 (RHEL-190120, RHEL-190125, RHEL-190155)