rpms/libreswan
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Backport fix for CVE-2026-14957

Browse Source 
Resolves: RHEL-212498
Signed-off-by: Daiki Ueno <dueno@redhat.com>
This commit is contained in:
Daiki Ueno 2026-07-23 10:36:34 +09:00
parent 459896cfac
commit ad06e5c908
2 changed files with 82 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
libreswan-4.12-CVE-2026-14957.patch Normal file
View File

@ -0,0 +1,76 @@
From bb98559906f03b5d0eb5e598d36d6607f65dfa51 Mon Sep 17 00:00:00 2001
From: Andrew Cagney <cagney@gnu.org>
Date: Thu, 9 Jul 2026 19:02:42 -0400
Subject: [PATCH 1/2] x509: tighten nss_compat BER check
---
lib/libswan/x509dn.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/libswan/x509dn.c b/lib/libswan/x509dn.c
index 913b944b56..d01f794d7d 100644
--- a/lib/libswan/x509dn.c
+++ b/lib/libswan/x509dn.c
@@ -378,6 +378,7 @@ static err_t format_dn(struct jambuf *buf, asn1_t dn,
* #BER.
*/
(nss_compatible &&
+ value_content.len > 0 &&
((const char*)value_content.ptr)[0] == '#')) {
/* BER */
jam(buf, "#");
--
2.54.0
From 784a2d2bf54e38efdd2c6dd64835013c850ad1e0 Mon Sep 17 00:00:00 2001
From: Andrew Cagney <cagney@gnu.org>
Date: Thu, 9 Jul 2026 19:04:01 -0400
Subject: [PATCH 2/2] ikev2: check the cert's pubkey unpacked before using it -
cve-2026-14957
---
programs/pluto/nss_cert_verify.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c
index 3e16566fb1..43af788cb8 100644
--- a/programs/pluto/nss_cert_verify.c
+++ b/programs/pluto/nss_cert_verify.c
@@ -392,16 +392,23 @@ static void add_decoded_cert(CERTCertDBHandle *handle,
*/
if (libreswan_fipsmode()) {
SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert);
- passert(pk != NULL);
- unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
- if (pk->keyType == rsaKey && key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
- llog(RC_LOG, logger,
- "FIPS: rejecting peer cert with key size %u under %u: %s",
- key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
- cert->subjectName);
- SECKEY_DestroyPublicKey(pk);
- CERT_DestroyCertificate(cert);
- return;
+ if (pk == NULL) {
+ llog_nss_error(RC_LOG, logger,
+ "extracting certificate public key using CERT_ExtractPublicKey() failed");
+ return;
+ }
+
+ if (pk->keyType == rsaKey) {
+ unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
+ if (key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
+ llog(RC_LOG, logger,
+ "FIPS: rejecting peer cert with key size %u under %u: %s",
+ key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
+ cert->subjectName);
+ SECKEY_DestroyPublicKey(pk);
+ CERT_DestroyCertificate(cert);
+ return;
+ }
}
SECKEY_DestroyPublicKey(pk);
}
--
2.54.0

7
libreswan.spec
View File

@ -37,7 +37,7 @@ Name: libreswan
Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
# version is generated in the release script
Version: 4.12
Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}.5
Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}.6
License: GPLv2
Url: https://libreswan.org/
@ -58,6 +58,7 @@ Patch9: libreswan-4.12-ikev1-compute-keymat-default.patch
Patch10: libreswan-4.12-CVE-2026-12413.patch
Patch11: libreswan-4.12-CVE-2026-50721.patch
Patch12: libreswan-4.12-CVE-2026-50722.patch
Patch13: libreswan-4.12-CVE-2026-14957.patch
BuildRequires: audit-libs-devel
BuildRequires: bison
@ -122,6 +123,7 @@ Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04
%patch10 -p1
%patch11 -p1
%patch12 -p1
%patch13 -p1
# linking to freebl is not needed
sed -i "s/-lfreebl //" mk/config.mk
@ -225,6 +227,9 @@ certutil -N -d sql:$tmpdir --empty-password
%attr(0644,root,root) %doc %{_mandir}/*/*
%changelog
* Thu Jul 23 2026 Daiki Ueno <dueno@redhat.com> - 4.12-2.6
- Backport fix for CVE-2026-14957 (RHEL-212498)
* Thu Jul 09 2026 Daiki Ueno <dueno@redhat.com> - 4.12-2.5
- Backport fixes for CVE-2026-12413, CVE-2026-50721 and CVE-2026-50722 (RHEL-190146, RHEL-190140, RHEL-190132)