rpms/perl-Convert-ASN1
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Merged update from upstream sources

Browse Source 
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/perl-Convert-ASN1.git#509ce3dde9a6941484e3b90040f1bfcfb5703f1d
This commit is contained in:
DistroBaker 2020-11-23 15:05:26 +00:00
parent 9e8a7e4498
commit 9ed40ac39c
2 changed files with 53 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
Convert-ASN1-0.27-CVE-2013-7488.patch Normal file
View File

@ -0,0 +1,45 @@
From ce148a2e0872b708450005cf0b3a944014aae990 Mon Sep 17 00:00:00 2001
From: Dana Jacobsen <dana@acm.org>
Date: Tue, 29 Oct 2013 08:37:48 -0700
Subject: [PATCH 1/2] Fix unsafe decoding in indef case
Bug: https://github.com/gbarr/perl-Convert-ASN1/pull/15
---
lib/Convert/ASN1/_decode.pm | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/Convert/ASN1/_decode.pm b/lib/Convert/ASN1/_decode.pm
index e811e8d..eb2b584 100644
--- a/lib/Convert/ASN1/_decode.pm
+++ b/lib/Convert/ASN1/_decode.pm
@@ -685,6 +685,7 @@ sub _scan_indef {
if((unpack("C",$tag) & 0x1f) == 0x1f) {
my $b;
do {
+ return if $pos >= $end;
$tag .= substr($_[0],$pos++,1);
$b = ord substr($tag,-1);
} while($b & 0x80);
From 8125d99e15596fee1b5f904ed74a76bccf54082d Mon Sep 17 00:00:00 2001
From: Dana Jacobsen <dana@acm.org>
Date: Tue, 29 Oct 2013 08:53:09 -0700
Subject: [PATCH 2/2] Add second part of position check
Bug: https://github.com/gbarr/perl-Convert-ASN1/pull/15
---
lib/Convert/ASN1/_decode.pm | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/Convert/ASN1/_decode.pm b/lib/Convert/ASN1/_decode.pm
index eb2b584..67b95aa 100644
--- a/lib/Convert/ASN1/_decode.pm
+++ b/lib/Convert/ASN1/_decode.pm
@@ -679,6 +679,7 @@ sub _scan_indef {
$pos += 2;
next;
}
+ return if $pos >= $end;
my $tag = substr($_[0], $pos++, 1);

9
perl-Convert-ASN1.spec
View File

@ -4,7 +4,7 @@
Summary: ASN.1 encode/decode library
Name: perl-Convert-ASN1
Version: 0.27
Release: 20%{?dist}
Release: 21%{?dist}
License: GPL+ or Artistic
URL: https://metacpan.org/release/Convert-ASN1
Source0: https://cpan.metacpan.org/authors/id/G/GB/GBARR/Convert-ASN1-%{version}.tar.gz
@ -13,6 +13,9 @@ Patch0: Convert-ASN1-0.27-Correct-shebangs-in-tests.patch
# Allow running tests from a read-only location,
# <https://github.com/gbarr/perl-Convert-ASN1/pull/40>
Patch1: Convert-ASN1-0.27-Use-temporary-output-files-for-tests.patch
# Fix unsafe decoding in indef case,
# <https://github.com/gbarr/perl-Convert-ASN1/pull/15>
Patch2: Convert-ASN1-0.27-CVE-2013-7488.patch
BuildArch: noarch
BuildRequires: coreutils
BuildRequires: make
@ -74,6 +77,7 @@ with "%{_libexecdir}/%{name}/test".
%setup -q -n Convert-ASN1-%{version}
%patch0 -p1
%patch1 -p1
%patch2 -p1
chmod +x t/*.t
%build
@ -105,6 +109,9 @@ make test
%{_libexecdir}/%{name}
%changelog
* Mon Nov 23 2020 Jitka Plesnikova <jplesnik@redhat.com> - 0.27-21
- Fix unsafe decoding in indef case (CVE-2013-7488)
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.27-20
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild