From 44c4d61c2a9af2e7556a35cc2ffd30a940b1f970 Mon Sep 17 00:00:00 2001 From: zhangruifang2020 Date: Thu, 25 Jan 2024 11:25:48 +0800 Subject: [PATCH] Backport patches from upstream community (cherry picked from commit b1968d480c23660ee4ea12addb7f8cd80c468245) --- ...heck-for-null-PKCS7-enveloped-fields.patch | 36 +++++++++++++++++++ krb5.spec | 7 ++-- 2 files changed, 41 insertions(+), 2 deletions(-) create mode 100644 backport-In-PKINIT-check-for-null-PKCS7-enveloped-fields.patch diff --git a/backport-In-PKINIT-check-for-null-PKCS7-enveloped-fields.patch b/backport-In-PKINIT-check-for-null-PKCS7-enveloped-fields.patch new file mode 100644 index 0000000..ff74945 --- /dev/null +++ b/backport-In-PKINIT-check-for-null-PKCS7-enveloped-fields.patch @@ -0,0 +1,36 @@ +From 48ccd81656381522d1f9ccb8705c13f0266a46ab Mon Sep 17 00:00:00 2001 +From: Greg Hudson +Date: Sat, 25 Nov 2023 11:04:56 -0500 +Subject: [PATCH] In PKINIT, check for null PKCS7 enveloped fields + +The PKCS7 ContentInfo content field and EncryptedContentInfo +encryptedContent field are optional. Check for null values in +cms_envelopeddata_verify() before calling pkcs7_decrypt(). Reported +by Bahaa Naamneh. + +ticket: 9107 (new) +tags: pullup +target_version: 1.21-next +target_version: 1.20-next +--- + src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +index 453b1119a..15c6cd8c4 100644 +--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c ++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c +@@ -2464,7 +2464,9 @@ cms_envelopeddata_verify(krb5_context context, + } + + /* verify that the received message is PKCS7 EnvelopedData message */ +- if (OBJ_obj2nid(p7->type) != NID_pkcs7_enveloped) { ++ if (OBJ_obj2nid(p7->type) != NID_pkcs7_enveloped || ++ p7->d.enveloped == NULL || ++ p7->d.enveloped->enc_data->enc_data == NULL) { + pkiDebug("Expected id-enveloped PKCS7 msg (received type = %d)\n", + OBJ_obj2nid(p7->type)); + krb5_set_error_message(context, retval, "wrong oid\n"); +-- +2.33.0 + diff --git a/krb5.spec b/krb5.spec index d6844c1..f4db694 100644 --- a/krb5.spec +++ b/krb5.spec @@ -3,7 +3,7 @@ Name: krb5 Version: 1.19.2 -Release: 13 +Release: 14 Summary: The Kerberos network authentication protocol License: MIT URL: http://web.mit.edu/kerberos/www/ @@ -45,7 +45,7 @@ Patch21: backport-Fix-unimportant-memory-leaks.patch Patch22: backport-Add-and-use-ts_interval-helper.patch Patch23: backport-Avoid-small-read-overrun-in-UTF8-normalization.patch Patch24: backport-Use-memmove-in-Unicode-functions.patch - +Patch25: backport-In-PKINIT-check-for-null-PKCS7-enveloped-fields.patch BuildRequires: gettext BuildRequires: gcc make automake autoconf pkgconfig pam-devel libselinux-devel byacc @@ -338,6 +338,9 @@ make -C src check || : %changelog +* Thu Jan 25 2024 zhangruifang - 1.19.2-14 +- Backport patches from upstream community + * Fri Dec 29 2023 xuraoqing - 1.19.2-13 - backport patches -- Gitee