Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openssl-1_0_0 for openSUSE:Factory checked in at 2024-02-06 16:35:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openssl-1_0_0 (Old) and /work/SRC/openSUSE:Factory/.openssl-1_0_0.new.1815 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openssl-1_0_0" Tue Feb 6 16:35:53 2024 rev:42 rq:1144563 version:1.0.2u Changes: -------- --- /work/SRC/openSUSE:Factory/openssl-1_0_0/openssl-1_0_0.changes 2023-11-16 20:28:40.192608882 +0100 +++ /work/SRC/openSUSE:Factory/.openssl-1_0_0.new.1815/openssl-1_0_0.changes 2024-02-06 16:36:36.499519269 +0100 @@ -1,0 +2,7 @@ +Tue Jan 30 14:15:25 UTC 2024 - Otto Hollmann <[email protected]> + +- Security fix: [bsc#1219243, CVE-2024-0727] + * Add NULL checks where ContentInfo data can be NULL + * Add openssl-CVE-2024-0727.patch + +------------------------------------------------------------------- New: ---- openssl-CVE-2024-0727.patch BETA DEBUG BEGIN: New: * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openssl-1_0_0.spec ++++++ --- /var/tmp/diff_new_pack.4havBB/_old 2024-02-06 16:36:37.643560656 +0100 +++ /var/tmp/diff_new_pack.4havBB/_new 2024-02-06 16:36:37.647560800 +0100 @@ -1,7 +1,7 @@ # # spec file for package openssl-1_0_0 # -# Copyright (c) 2023 SUSE LLC +# Copyright (c) 2024 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -135,6 +135,8 @@ # PATCH-FIX-UPSTREAM: bsc#1216922 CVE-2023-5678 Generating excessively long X9.42 DH keys or # checking excessively long X9.42 DH keys or parameters may be very slow Patch104: openssl-CVE-2023-5678.patch +# PATCH-FIX-UPSTREAM: bsc#1219243 CVE-2024-0727: denial of service via null dereference +Patch105: openssl-CVE-2024-0727.patch # steam patches Patch150: openssl-fix-cpuid_setup.patch # compat patches to build with soversion 10 (bsc#1175429) @@ -302,6 +304,7 @@ %patch102 -p1 %patch103 -p1 %patch104 -p1 +%patch105 -p1 # clean up patching leftovers find . -name '*.orig' -delete ++++++ openssl-CVE-2024-0727.patch ++++++ >From 09df4395b5071217b76dc7d3d2e630eb8c5a79c2 Mon Sep 17 00:00:00 2001 From: Matt Caswell <[email protected]> Date: Fri, 19 Jan 2024 11:28:58 +0000 Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL PKCS12 structures contain PKCS7 ContentInfo fields. These fields are optional and can be NULL even if the "type" is a valid value. OpenSSL was not properly accounting for this and a NULL dereference can occur causing a crash. CVE-2024-0727 Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Neil Horman <[email protected]> (Merged from https://github.com/openssl/openssl/pull/23362) (cherry picked from commit d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c) --- crypto/pkcs12/p12_add.c | 18 ++++++++++++++++++ crypto/pkcs12/p12_mutl.c | 5 +++++ crypto/pkcs12/p12_npas.c | 5 +++-- crypto/pkcs7/pk7_mime.c | 7 +++++-- 4 files changed, 31 insertions(+), 4 deletions(-) Index: openssl-1.0.2p/crypto/pkcs12/p12_add.c =================================================================== --- openssl-1.0.2p.orig/crypto/pkcs12/p12_add.c +++ openssl-1.0.2p/crypto/pkcs12/p12_add.c @@ -171,6 +171,12 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_ PKCS12_R_CONTENT_TYPE_NOT_DATA); return NULL; } + + if (p7->d.data == NULL) { + PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA, PKCS12_R_DECODE_ERROR); + return NULL; + } + return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS)); } @@ -226,6 +232,12 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_ { if (!PKCS7_type_is_encrypted(p7)) return NULL; + + if (p7->d.encrypted == NULL) { + PKCS12err(PKCS12_F_PKCS12_UNPACK_P7ENCDATA, PKCS12_R_DECODE_ERROR); + return NULL; + } + return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm, ASN1_ITEM_rptr(PKCS12_SAFEBAGS), pass, passlen, @@ -253,6 +265,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes PKCS12_R_CONTENT_TYPE_NOT_DATA); return NULL; } + + if (p12->authsafes->d.data == NULL) { + PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES, + PKCS12_R_DECODE_ERROR); + return NULL; + } + return ASN1_item_unpack(p12->authsafes->d.data, ASN1_ITEM_rptr(PKCS12_AUTHSAFES)); } Index: openssl-1.0.2p/crypto/pkcs12/p12_mutl.c =================================================================== --- openssl-1.0.2p.orig/crypto/pkcs12/p12_mutl.c +++ openssl-1.0.2p/crypto/pkcs12/p12_mutl.c @@ -80,6 +80,11 @@ int PKCS12_gen_mac(PKCS12 *p12, const ch return 0; } + if (p12->authsafes->d.data == NULL) { + PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR); + return 0; + } + salt = p12->mac->salt->data; saltlen = p12->mac->salt->length; if (!p12->mac->iter) Index: openssl-1.0.2p/crypto/pkcs12/p12_npas.c =================================================================== --- openssl-1.0.2p.orig/crypto/pkcs12/p12_npas.c +++ openssl-1.0.2p/crypto/pkcs12/p12_npas.c @@ -126,8 +126,9 @@ static int newpass_p12(PKCS12 *p12, cons bags = PKCS12_unpack_p7data(p7); } else if (bagnid == NID_pkcs7_encrypted) { bags = PKCS12_unpack_p7encdata(p7, oldpass, -1); - if (!alg_get(p7->d.encrypted->enc_data->algorithm, - &pbe_nid, &pbe_iter, &pbe_saltlen)) + if (p7->d.encrypted == NULL + || !alg_get(p7->d.encrypted->enc_data->algorithm, + &pbe_nid, &pbe_iter, &pbe_saltlen)) goto err; } else { continue; Index: openssl-1.0.2p/crypto/pkcs7/pk7_mime.c =================================================================== --- openssl-1.0.2p.orig/crypto/pkcs7/pk7_mime.c +++ openssl-1.0.2p/crypto/pkcs7/pk7_mime.c @@ -78,10 +78,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p { STACK_OF(X509_ALGOR) *mdalgs; int ctype_nid = OBJ_obj2nid(p7->type); - if (ctype_nid == NID_pkcs7_signed) + if (ctype_nid == NID_pkcs7_signed) { + if (p7->d.sign == NULL) + return 0; mdalgs = p7->d.sign->md_algs; - else + } else { mdalgs = NULL; + } flags ^= SMIME_OLDMIME; Index: openssl-1.0.2p/crypto/pkcs12/pkcs12.h =================================================================== --- openssl-1.0.2p.orig/crypto/pkcs12/pkcs12.h +++ openssl-1.0.2p/crypto/pkcs12/pkcs12.h @@ -308,6 +308,7 @@ void ERR_load_PKCS12_strings(void); # define PKCS12_F_PKCS12_SET_MAC 123 # define PKCS12_F_PKCS12_UNPACK_AUTHSAFES 130 # define PKCS12_F_PKCS12_UNPACK_P7DATA 131 +# define PKCS12_F_PKCS12_UNPACK_P7ENCDATA 233 # define PKCS12_F_PKCS12_VERIFY_MAC 126 # define PKCS12_F_PKCS8_ADD_KEYUSAGE 124 # define PKCS12_F_PKCS8_ENCRYPT 125 Index: openssl-1.0.2p/crypto/pkcs12/pk12err.c =================================================================== --- openssl-1.0.2p.orig/crypto/pkcs12/pk12err.c +++ openssl-1.0.2p/crypto/pkcs12/pk12err.c @@ -98,6 +98,7 @@ static ERR_STRING_DATA PKCS12_str_functs {ERR_FUNC(PKCS12_F_PKCS12_SET_MAC), "PKCS12_set_mac"}, {ERR_FUNC(PKCS12_F_PKCS12_UNPACK_AUTHSAFES), "PKCS12_unpack_authsafes"}, {ERR_FUNC(PKCS12_F_PKCS12_UNPACK_P7DATA), "PKCS12_unpack_p7data"}, + {ERR_FUNC(PKCS12_F_PKCS12_UNPACK_P7ENCDATA), "PKCS12_unpack_p7encdata"}, {ERR_FUNC(PKCS12_F_PKCS12_VERIFY_MAC), "PKCS12_verify_mac"}, {ERR_FUNC(PKCS12_F_PKCS8_ADD_KEYUSAGE), "PKCS8_add_keyusage"}, {ERR_FUNC(PKCS12_F_PKCS8_ENCRYPT), "PKCS8_encrypt"},
