From 60fd54279cd13d0012b94e923534ffa3b0afcd83 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Thu, 23 Jul 2026 10:30:50 +0900 Subject: [PATCH] Backport fix for CVE-2026-14957 Resolves: RHEL-212107 Signed-off-by: Daiki Ueno --- libreswan-4.15-CVE-2026-14957.patch | 76 +++++++++++++++++++++++++++++ libreswan.spec | 6 ++- 2 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 libreswan-4.15-CVE-2026-14957.patch diff --git a/libreswan-4.15-CVE-2026-14957.patch b/libreswan-4.15-CVE-2026-14957.patch new file mode 100644 index 0000000..e6e4b81 --- /dev/null +++ b/libreswan-4.15-CVE-2026-14957.patch @@ -0,0 +1,76 @@ +From 71a0653c9d4682b452da70145b548a3c48d490e7 Mon Sep 17 00:00:00 2001 +From: Andrew Cagney +Date: Thu, 9 Jul 2026 19:02:42 -0400 +Subject: [PATCH 1/2] x509: tighten nss_compat BER check + +--- + lib/libswan/x509dn.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/libswan/x509dn.c b/lib/libswan/x509dn.c +index b07e38b91d..626e6e4728 100644 +--- a/lib/libswan/x509dn.c ++++ b/lib/libswan/x509dn.c +@@ -378,6 +378,7 @@ static err_t format_dn(struct jambuf *buf, asn1_t dn, + * #BER. + */ + (nss_compatible && ++ value_content.len > 0 && + ((const char*)value_content.ptr)[0] == '#')) { + /* BER */ + jam(buf, "#"); +-- +2.54.0 + + +From b1672dca4628357808b3de88ecf9322beb04a6c5 Mon Sep 17 00:00:00 2001 +From: Andrew Cagney +Date: Thu, 9 Jul 2026 19:04:01 -0400 +Subject: [PATCH 2/2] ikev2: check the cert's pubkey unpacked before using it - + cve-2026-14957 + +--- + programs/pluto/nss_cert_verify.c | 27 +++++++++++++++++---------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c +index 3e16566fb1..43af788cb8 100644 +--- a/programs/pluto/nss_cert_verify.c ++++ b/programs/pluto/nss_cert_verify.c +@@ -392,16 +392,23 @@ static void add_decoded_cert(CERTCertDBHandle *handle, + */ + if (libreswan_fipsmode()) { + SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert); +- passert(pk != NULL); +- unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE; +- if (pk->keyType == rsaKey && key_bit_size < FIPS_MIN_RSA_KEY_SIZE) { +- llog(RC_LOG, logger, +- "FIPS: rejecting peer cert with key size %u under %u: %s", +- key_bit_size, FIPS_MIN_RSA_KEY_SIZE, +- cert->subjectName); +- SECKEY_DestroyPublicKey(pk); +- CERT_DestroyCertificate(cert); +- return; ++ if (pk == NULL) { ++ llog_nss_error(RC_LOG, logger, ++ "extracting certificate public key using CERT_ExtractPublicKey() failed"); ++ return; ++ } ++ ++ if (pk->keyType == rsaKey) { ++ unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE; ++ if (key_bit_size < FIPS_MIN_RSA_KEY_SIZE) { ++ llog(RC_LOG, logger, ++ "FIPS: rejecting peer cert with key size %u under %u: %s", ++ key_bit_size, FIPS_MIN_RSA_KEY_SIZE, ++ cert->subjectName); ++ SECKEY_DestroyPublicKey(pk); ++ CERT_DestroyCertificate(cert); ++ return; ++ } + } + SECKEY_DestroyPublicKey(pk); + } +-- +2.54.0 + diff --git a/libreswan.spec b/libreswan.spec index c182ded..798dc8d 100644 --- a/libreswan.spec +++ b/libreswan.spec @@ -31,7 +31,7 @@ Name: libreswan Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec # version is generated in the release script Version: 4.15 -Release: %{?prever:0.}9%{?prever:.%{prever}}%{?dist} +Release: %{?prever:0.}10%{?prever:.%{prever}}%{?dist} License: GPLv2 Url: https://libreswan.org/ Source0: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz @@ -48,6 +48,7 @@ Patch: libreswan-4.15-rereadsecrets.patch Patch: libreswan-4.15-CVE-2026-12413.patch Patch: libreswan-4.15-CVE-2026-50721.patch Patch: libreswan-4.15-CVE-2026-50722.patch +Patch: libreswan-4.15-CVE-2026-14957.patch BuildRequires: audit-libs-devel BuildRequires: bison @@ -203,6 +204,9 @@ certutil -N -d sql:$tmpdir --empty-password %doc %{_mandir}/*/* %changelog +* Thu Jul 23 2026 Daiki Ueno - 4.15-10 +- Backport fix for CVE-2026-14957 (RHEL-212107) + * Thu Jul 02 2026 Daiki Ueno - 4.15-9 - Backport fixes for CVE-2026-12413, CVE-2026-50721 and CVE-2026-50722 (RHEL-190120, RHEL-190125, RHEL-190155)