diff --git a/backport-CVE-2022-3515-Detect-a-possible-overflow-directly-in-the-TLV-parse.patch b/backport-CVE-2022-3515-Detect-a-possible-overflow-directly-in-the-TLV-parse.patch deleted file mode 100644 index 26cf34b22019f2edc22be7ec565296b077adf896..0000000000000000000000000000000000000000 --- a/backport-CVE-2022-3515-Detect-a-possible-overflow-directly-in-the-TLV-parse.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 4b7d9cd4a018898d7714ce06f3faf2626c14582b Mon Sep 17 00:00:00 2001 -From: Werner Koch -Date: Wed, 5 Oct 2022 14:19:06 +0200 -Subject: [PATCH] Detect a possible overflow directly in the TLV parser. - -* src/ber-help.c (_ksba_ber_read_tl): Check for overflow of a commonly -used sum. --- - -It is quite common to have checks like - - if (ti.nhdr + ti.length >= DIM(tmpbuf)) - return gpg_error (GPG_ERR_TOO_LARGE); - -This patch detects possible integer overflows immmediately when -creating the TI object. - -Reported-by: ZDI-CAN-18927, ZDI-CAN-18928, ZDI-CAN-18929 ---- - src/ber-help.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/src/ber-help.c b/src/ber-help.c -index 81c31ed..56efb6a 100644 ---- a/src/ber-help.c -+++ b/src/ber-help.c -@@ -182,6 +182,12 @@ _ksba_ber_read_tl (ksba_reader_t reader, struct tag_info *ti) - ti->length = len; - } - -+ if (ti->length > ti->nhdr && (ti->nhdr + ti->length) < ti->length) -+ { -+ ti->err_string = "header+length would overflow"; -+ return gpg_error (GPG_ERR_EOVERFLOW); -+ } -+ - /* Without this kludge some example certs can't be parsed */ - if (ti->class == CLASS_UNIVERSAL && !ti->tag) - ti->length = 0; --- -2.27.0 - diff --git a/backport-CVE-2022-47629-Fix-an-integer-overflow-in-the-CRL-signature-parser.patch b/backport-CVE-2022-47629-Fix-an-integer-overflow-in-the-CRL-signature-parser.patch deleted file mode 100644 index 62921896d180bf5ace4cd47ff9b292959a725adb..0000000000000000000000000000000000000000 --- a/backport-CVE-2022-47629-Fix-an-integer-overflow-in-the-CRL-signature-parser.patch +++ /dev/null @@ -1,68 +0,0 @@ -From f61a5ea4e0f6a80fd4b28ef0174bee77793cf070 Mon Sep 17 00:00:00 2001 -From: Werner Koch -Date: Tue, 22 Nov 2022 16:36:46 +0100 -Subject: [PATCH] Fix an integer overflow in the CRL signature parser. - -* src/crl.c (parse_signature): N+N2 now checked for overflow. - -* src/ocsp.c (parse_response_extensions): Do not accept too large -values. -(parse_single_extensions): Ditto. --- - -The second patch is an extra safegourd not related to the reported -bug. - -GnuPG-bug-id: 6284 -Reported-by: Joseph Surin, elttam ---- - src/crl.c | 2 +- - src/ocsp.c | 12 ++++++++++++ - 2 files changed, 13 insertions(+), 1 deletion(-) - -diff --git a/src/crl.c b/src/crl.c -index 9f71c85..2e6ca29 100644 ---- a/src/crl.c -+++ b/src/crl.c -@@ -1349,7 +1349,7 @@ parse_signature (ksba_crl_t crl) - && !ti.is_constructed) ) - return gpg_error (GPG_ERR_INV_CRL_OBJ); - n2 = ti.nhdr + ti.length; -- if (n + n2 >= DIM(tmpbuf)) -+ if (n + n2 >= DIM(tmpbuf) || (n + n2) < n) - return gpg_error (GPG_ERR_TOO_LARGE); - memcpy (tmpbuf+n, ti.buf, ti.nhdr); - err = read_buffer (crl->reader, tmpbuf+n+ti.nhdr, ti.length); -diff --git a/src/ocsp.c b/src/ocsp.c -index d4cba04..657d15f 100644 ---- a/src/ocsp.c -+++ b/src/ocsp.c -@@ -721,6 +721,12 @@ parse_response_extensions (ksba_ocsp_t ocsp, - else - ocsp->good_nonce = 1; - } -+ if (ti.length > (1<<24)) -+ { -+ /* Bail out on much too large objects. */ -+ err = gpg_error (GPG_ERR_BAD_BER); -+ goto leave; -+ } - ex = xtrymalloc (sizeof *ex + strlen (oid) + ti.length); - if (!ex) - { -@@ -788,6 +794,12 @@ parse_single_extensions (struct ocsp_reqitem_s *ri, - err = parse_octet_string (&data, &datalen, &ti); - if (err) - goto leave; -+ if (ti.length > (1<<24)) -+ { -+ /* Bail out on much too large objects. */ -+ err = gpg_error (GPG_ERR_BAD_BER); -+ goto leave; -+ } - ex = xtrymalloc (sizeof *ex + strlen (oid) + ti.length); - if (!ex) - { --- -2.27.0 - diff --git a/libksba-1.6.0.tar.bz2 b/libksba-1.6.0.tar.bz2 deleted file mode 100644 index 36f82263d8282b4b85664c3c9dd56cd8e253824a..0000000000000000000000000000000000000000 Binary files a/libksba-1.6.0.tar.bz2 and /dev/null differ diff --git a/libksba-1.6.0.tar.bz2.sig b/libksba-1.6.0.tar.bz2.sig deleted file mode 100644 index 25ce400bed95b5150a70ddc6f8c84e8b71d6b53e..0000000000000000000000000000000000000000 Binary files a/libksba-1.6.0.tar.bz2.sig and /dev/null differ diff --git a/libksba-1.6.4.tar.bz2 b/libksba-1.6.4.tar.bz2 new file mode 100644 index 0000000000000000000000000000000000000000..add598a2b17f33f3d1284b5f6c9b3de5a1bff2a8 Binary files /dev/null and b/libksba-1.6.4.tar.bz2 differ diff --git a/libksba-1.6.4.tar.bz2.sig b/libksba-1.6.4.tar.bz2.sig new file mode 100644 index 0000000000000000000000000000000000000000..c712bd81c21e942fbf9973d2c532a71d1b3d8a85 Binary files /dev/null and b/libksba-1.6.4.tar.bz2.sig differ diff --git a/libksba.spec b/libksba.spec index a47c13bb39b454b8e4fd17af3f817020578faa95..75c5da3a78432007b73796ed5fdde3cbb25f2110 100644 --- a/libksba.spec +++ b/libksba.spec @@ -1,15 +1,12 @@ Name: libksba -Version: 1.6.0 -Release: 3 +Version: 1.6.4 +Release: 1 Summary: A library for X.509 and CMS License: (LGPL-3.0+ or GPL-2.0+) and GPL-3.0+ and MIT URL: https://www.gnupg.org/software/libksba/index.html Source0: https://www.gnupg.org/ftp/gcrypt/libksba/libksba-%{version}.tar.bz2 Source1: https://www.gnupg.org/ftp/gcrypt/libksba/libksba-%{version}.tar.bz2.sig -Patch1: backport-CVE-2022-3515-Detect-a-possible-overflow-directly-in-the-TLV-parse.patch -Patch2: backport-CVE-2022-47629-Fix-an-integer-overflow-in-the-CRL-signature-parser.patch - BuildRequires: gcc gawk libgpg-error-devel >= 1.8 libgcrypt-devel >= 1.2.0 %description @@ -68,6 +65,12 @@ make check %{_datadir}/info/ksba.info.gz %changelog +* Wed Oct 25 2023 yixiangzhike - 1.6.4-1 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:update version to 1.6.4 + * Thu Dec 22 2022 yixiangzhike - 1.6.0-3 - Type:cve - ID:CVE-2022-47629