From 494e393e58c611b8652f3b1046c8906a863e35bb Mon Sep 17 00:00:00 2001
From: Miroslav Rezanina <mrezanin@redhat.com>
Date: Sun, 17 Sep 2023 23:15:09 -0400
Subject: [PATCH] * Wed Sep 20 2023 Miroslav Rezanina <mrezanin@redhat.com> -
 12.2.5-3

- Rebuild CVE-2023-20900 for 8.10
- Resolves: RHEL-4584
  (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-8.10.0])
---
 open-vm-tools.spec                            |  9 ++++-
 ...y-X509-certs-to-verify-the-SAML-toke.patch | 38 +++++++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch

diff --git a/open-vm-tools.spec b/open-vm-tools.spec
index 42b99b8..0bef59b 100644
--- a/open-vm-tools.spec
+++ b/open-vm-tools.spec
@@ -32,7 +32,7 @@
 
 Name:             open-vm-tools
 Version:          %{toolsversion}
-Release:          1%{?dist}
+Release:          3%{?dist}
 Summary:          Open Virtual Machine Tools for virtual machines hosted on VMware
 License:          GPLv2
 URL:              https://github.com/vmware/%{name}
@@ -52,6 +52,8 @@ ExclusiveArch:    %{ix86} x86_64 aarch64
 %endif
 
 # Patch0: name.patch
+# For RHEL-4584 - CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-8.10.0]
+Patch1: ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch
 
 BuildRequires:    autoconf
 BuildRequires:    automake
@@ -410,6 +412,11 @@ fi
 %{_bindir}/vmware-vgauth-smoketest
 
 %changelog
+* Wed Sep 20 2023 Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-3
+- Rebuild CVE-2023-20900 for 8.10
+- Resolves: RHEL-4584
+  (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-8.10.0])
+
 * Tue Jul 11 2023 Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-1
 - Rebase to open-vm-tools 12.2.5 [bz#2214861]
 - Resolves: bz#2214861
diff --git a/ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch b/ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch
new file mode 100644
index 0000000..2aebc81
--- /dev/null
+++ b/ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch
@@ -0,0 +1,38 @@
+From a839cb975d58968237bd871b1fb4cbe191af085b Mon Sep 17 00:00:00 2001
+From: Miroslav Rezanina <mrezanin@redhat.com>
+Date: Thu, 7 Sep 2023 02:27:50 -0400
+Subject: [PATCH] VGAuth: Allow only X509 certs to verify the SAML token
+ signature.
+
+RH-Author: Miroslav Rezanina <mrezanin@redhat.com>
+RH-Bugzilla: 2236543
+RH-CVE: CVE-2023-20900
+
+Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
+---
+ open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c b/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c
+index f5541a9a..0b2a945b 100644
+--- a/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c
++++ b/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c
+@@ -1335,7 +1335,14 @@ VerifySignature(xmlDocPtr doc,
+     */
+    bRet = RegisterID(xmlDocGetRootElement(doc), "ID");
+    if (bRet == FALSE) {
+-      g_warning("failed to register ID\n");
++      g_warning("Failed to register ID\n");
++      goto done;
++   }
++
++   /* Use only X509 certs to validate the signature */
++   if (xmlSecPtrListAdd(&(dsigCtx->keyInfoReadCtx.enabledKeyData),
++                        BAD_CAST xmlSecKeyDataX509Id) < 0) {
++      g_warning("Failed to limit allowed key data\n");
+       goto done;
+    }
+ 
+-- 
+2.39.3
+