From 108d81c70d0a6792847051d121a660ef3511517d Mon Sep 17 00:00:00 2001 From: Katy Feng Date: Fri, 22 Sep 2023 10:15:58 +0000 Subject: [PATCH] Allow only X509 certs to verify the SAML token signature. CVE: CVE-2023-20900 Upstream-Status: Backport [https://github.com/vmware/open-vm-tools/commit/74b6d0d9000eda1a2c8f31c40c725fb0b8520b16] Signed-off-by: Narpat Mali --- open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c b/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c index aaa5082a..ad8fe304 100644 --- a/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c +++ b/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c @@ -1273,7 +1273,14 @@ VerifySignature(xmlDocPtr doc, */ bRet = RegisterID(xmlDocGetRootElement(doc), "ID"); if (bRet == FALSE) { - g_warning("failed to register ID\n"); + g_warning("Failed to register ID\n"); + goto done; + } + + /* Use only X509 certs to validate the signature */ + if (xmlSecPtrListAdd(&(dsigCtx->keyInfoReadCtx.enabledKeyData), + BAD_CAST xmlSecKeyDataX509Id) < 0) { + g_warning("Failed to limit allowed key data\n"); goto done; } -- 2.40.0