77 lines
2.4 KiB
Diff
77 lines
2.4 KiB
Diff
From bb98559906f03b5d0eb5e598d36d6607f65dfa51 Mon Sep 17 00:00:00 2001
|
|
From: Andrew Cagney <cagney@gnu.org>
|
|
Date: Thu, 9 Jul 2026 19:02:42 -0400
|
|
Subject: [PATCH 1/2] x509: tighten nss_compat BER check
|
|
|
|
---
|
|
lib/libswan/x509dn.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/lib/libswan/x509dn.c b/lib/libswan/x509dn.c
|
|
index 913b944b56..d01f794d7d 100644
|
|
--- a/lib/libswan/x509dn.c
|
|
+++ b/lib/libswan/x509dn.c
|
|
@@ -378,6 +378,7 @@ static err_t format_dn(struct jambuf *buf, asn1_t dn,
|
|
* #BER.
|
|
*/
|
|
(nss_compatible &&
|
|
+ value_content.len > 0 &&
|
|
((const char*)value_content.ptr)[0] == '#')) {
|
|
/* BER */
|
|
jam(buf, "#");
|
|
--
|
|
2.54.0
|
|
|
|
|
|
From 784a2d2bf54e38efdd2c6dd64835013c850ad1e0 Mon Sep 17 00:00:00 2001
|
|
From: Andrew Cagney <cagney@gnu.org>
|
|
Date: Thu, 9 Jul 2026 19:04:01 -0400
|
|
Subject: [PATCH 2/2] ikev2: check the cert's pubkey unpacked before using it -
|
|
cve-2026-14957
|
|
|
|
---
|
|
programs/pluto/nss_cert_verify.c | 27 +++++++++++++++++----------
|
|
1 file changed, 17 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c
|
|
index 3e16566fb1..43af788cb8 100644
|
|
--- a/programs/pluto/nss_cert_verify.c
|
|
+++ b/programs/pluto/nss_cert_verify.c
|
|
@@ -392,16 +392,23 @@ static void add_decoded_cert(CERTCertDBHandle *handle,
|
|
*/
|
|
if (libreswan_fipsmode()) {
|
|
SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert);
|
|
- passert(pk != NULL);
|
|
- unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
|
|
- if (pk->keyType == rsaKey && key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
|
|
- llog(RC_LOG, logger,
|
|
- "FIPS: rejecting peer cert with key size %u under %u: %s",
|
|
- key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
|
|
- cert->subjectName);
|
|
- SECKEY_DestroyPublicKey(pk);
|
|
- CERT_DestroyCertificate(cert);
|
|
- return;
|
|
+ if (pk == NULL) {
|
|
+ llog_nss_error(RC_LOG, logger,
|
|
+ "extracting certificate public key using CERT_ExtractPublicKey() failed");
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ if (pk->keyType == rsaKey) {
|
|
+ unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
|
|
+ if (key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
|
|
+ llog(RC_LOG, logger,
|
|
+ "FIPS: rejecting peer cert with key size %u under %u: %s",
|
|
+ key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
|
|
+ cert->subjectName);
|
|
+ SECKEY_DestroyPublicKey(pk);
|
|
+ CERT_DestroyCertificate(cert);
|
|
+ return;
|
|
+ }
|
|
}
|
|
SECKEY_DestroyPublicKey(pk);
|
|
}
|
|
--
|
|
2.54.0
|
|
|