diff options
author | Steve Sakoman <steve@sakoman.com> | 2023-01-19 08:13:24 -1000 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2023-01-19 08:14:20 -1000 |
commit | 3573a3bf16fdcdbda7097bf12f2052a5b29fe0f7 (patch) | |
tree | 326089692274a8970051da3620c4727109e5c1a4 | |
parent | 39ef525391d2d39a3431d319a20a5b5fc9a916a3 (diff) | |
download | openembedded-core-contrib-3573a3bf16fdcdbda7097bf12f2052a5b29fe0f7.tar.gz |
Revert "libksba: fix CVE-2022-47629"
Prepare for stable version bump which includes this fix
This reverts commit e4cb0bf273ea556db91699594046a47514c8583c.
-rw-r--r-- | meta/recipes-support/libksba/libksba/0001-Fix-an-integer-overflow-in-the-CRL-signature-parser.patch | 72 | ||||
-rw-r--r-- | meta/recipes-support/libksba/libksba_1.6.2.bb | 3 |
2 files changed, 1 insertions, 74 deletions
diff --git a/meta/recipes-support/libksba/libksba/0001-Fix-an-integer-overflow-in-the-CRL-signature-parser.patch b/meta/recipes-support/libksba/libksba/0001-Fix-an-integer-overflow-in-the-CRL-signature-parser.patch deleted file mode 100644 index 8c0080d56b..0000000000 --- a/meta/recipes-support/libksba/libksba/0001-Fix-an-integer-overflow-in-the-CRL-signature-parser.patch +++ /dev/null @@ -1,72 +0,0 @@ -From f61a5ea4e0f6a80fd4b28ef0174bee77793cf070 Mon Sep 17 00:00:00 2001 -From: Werner Koch <wk@gnupg.org> -Date: Tue, 22 Nov 2022 16:36:46 +0100 -Subject: [PATCH] Fix an integer overflow in the CRL signature parser. - -* src/crl.c (parse_signature): N+N2 now checked for overflow. - -* src/ocsp.c (parse_response_extensions): Do not accept too large -values. -(parse_single_extensions): Ditto. --- - -The second patch is an extra safegourd not related to the reported -bug. - -CVE: CVE-2022-47629 - -Upstream-Status: Backport [https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070] - -GnuPG-bug-id: 6284 -Reported-by: Joseph Surin, elttam ---- - src/crl.c | 2 +- - src/ocsp.c | 12 ++++++++++++ - 2 files changed, 13 insertions(+), 1 deletion(-) - -diff --git a/src/crl.c b/src/crl.c -index 9f71c85..2e6ca29 100644 ---- a/src/crl.c -+++ b/src/crl.c -@@ -1349,7 +1349,7 @@ parse_signature (ksba_crl_t crl) - && !ti.is_constructed) ) - return gpg_error (GPG_ERR_INV_CRL_OBJ); - n2 = ti.nhdr + ti.length; -- if (n + n2 >= DIM(tmpbuf)) -+ if (n + n2 >= DIM(tmpbuf) || (n + n2) < n) - return gpg_error (GPG_ERR_TOO_LARGE); - memcpy (tmpbuf+n, ti.buf, ti.nhdr); - err = read_buffer (crl->reader, tmpbuf+n+ti.nhdr, ti.length); -diff --git a/src/ocsp.c b/src/ocsp.c -index d4cba04..657d15f 100644 ---- a/src/ocsp.c -+++ b/src/ocsp.c -@@ -721,6 +721,12 @@ parse_response_extensions (ksba_ocsp_t ocsp, - || memcmp (ocsp->nonce, data, ti.length)) - ocsp->bad_nonce = 1; - } -+ if (ti.length > (1<<24)) -+ { -+ /* Bail out on much too large objects. */ -+ err = gpg_error (GPG_ERR_BAD_BER); -+ goto leave; -+ } - ex = xtrymalloc (sizeof *ex + strlen (oid) + ti.length); - if (!ex) - { -@@ -788,6 +794,12 @@ parse_single_extensions (struct ocsp_reqitem_s *ri, - err = parse_octet_string (&data, &datalen, &ti); - if (err) - goto leave; -+ if (ti.length > (1<<24)) -+ { -+ /* Bail out on much too large objects. */ -+ err = gpg_error (GPG_ERR_BAD_BER); -+ goto leave; -+ } - ex = xtrymalloc (sizeof *ex + strlen (oid) + ti.length); - if (!ex) - { --- -2.32.0 - diff --git a/meta/recipes-support/libksba/libksba_1.6.2.bb b/meta/recipes-support/libksba/libksba_1.6.2.bb index d0ee8475f8..f6ecb9aec4 100644 --- a/meta/recipes-support/libksba/libksba_1.6.2.bb +++ b/meta/recipes-support/libksba/libksba_1.6.2.bb @@ -22,8 +22,7 @@ inherit autotools binconfig-disabled pkgconfig texinfo UPSTREAM_CHECK_URI = "https://gnupg.org/download/index.html" SRC_URI = "${GNUPG_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \ - file://ksba-add-pkgconfig-support.patch \ - file://0001-Fix-an-integer-overflow-in-the-CRL-signature-parser.patch" + file://ksba-add-pkgconfig-support.patch" SRC_URI[sha256sum] = "fce01ccac59812bddadffacff017dac2e4762bdb6ebc6ffe06f6ed4f6192c971" |