Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package opensc for openSUSE:Factory checked in at 2024-02-29 21:50:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/opensc (Old) and /work/SRC/openSUSE:Factory/.opensc.new.1770 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "opensc" Thu Feb 29 21:50:21 2024 rev:56 rq:1153161 version:0.24.0 Changes: -------- --- /work/SRC/openSUSE:Factory/opensc/opensc.changes 2023-12-13 18:36:49.766543123 +0100 +++ /work/SRC/openSUSE:Factory/.opensc.new.1770/opensc.changes 2024-02-29 21:50:41.138718115 +0100 @@ -1,0 +2,6 @@ +Sun Feb 25 20:35:05 UTC 2024 - Martin Schreiner <[email protected]> + +- Add CVE-2024-1454.patch. + Fix for CVE-2024-1454 / bsc#1219868. + +------------------------------------------------------------------- New: ---- CVE-2024-1454.patch BETA DEBUG BEGIN: New: - Add CVE-2024-1454.patch. Fix for CVE-2024-1454 / bsc#1219868. BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ opensc.spec ++++++ --- /var/tmp/diff_new_pack.dZAUvK/_old 2024-02-29 21:50:42.798779314 +0100 +++ /var/tmp/diff_new_pack.dZAUvK/_new 2024-02-29 21:50:42.814779904 +0100 @@ -1,7 +1,7 @@ # # spec file for package opensc # -# Copyright (c) 2023 SUSE LLC +# Copyright (c) 2024 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -31,6 +31,8 @@ # https://web.archive.org/web/20111225073733/http://www.opensc-project.org/opensc/ticket/390 Source3: opensc.module Patch0: opensc-gcc11.patch +# PATCH-FIX-UPSTREAM [email protected] CVE-2024-1454 bsc#1219868 +Patch1: CVE-2024-1454.patch BuildRequires: docbook-xsl-stylesheets BuildRequires: libxslt BuildRequires: pkgconfig ++++++ CVE-2024-1454.patch ++++++ >From 5835f0d4f6c033bd58806d33fa546908d39825c9 Mon Sep 17 00:00:00 2001 From: Jakub Jelen <[email protected]> Date: Mon, 18 Dec 2023 11:09:50 +0100 Subject: [PATCH] authentic: Avoid use after free Thanks oss-fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898 --- src/pkcs15init/pkcs15-authentic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pkcs15init/pkcs15-authentic.c b/src/pkcs15init/pkcs15-authentic.c index a6d8b8ffad..798bc44138 100644 --- a/src/pkcs15init/pkcs15-authentic.c +++ b/src/pkcs15init/pkcs15-authentic.c @@ -868,7 +868,7 @@ authentic_emu_update_tokeninfo(struct sc_profile *profile, struct sc_pkcs15_card rv = sc_select_file(p15card->card, &path, &file); if (!rv) { rv = sc_get_challenge(p15card->card, buffer, sizeof(buffer)); - if (!rv) { + if (rv < 0) { sc_file_free(file); LOG_TEST_RET(ctx, rv, "Get challenge error"); }
