Control: tags 1133535 + patch Control: tags 1133535 + pending Control: tags 1141390 + patch Control: tags 1143067 + patch Control: tags 1143067 + pending
Dear maintainer, I've prepared an NMU for libreswan (versioned as 5.2-2.5) and uploaded it to DELAYED/2. Please feel free to tell me if I should cancel it. cu Adrian
diffstat for libreswan-5.2 libreswan-5.2 changelog | 14 + patches/0001-crypto-in-RSA_authenticate_hash_signature_raw_rsa-us.patch | 83 ++++++++ patches/0002-crypto-in-RSA_authenticate_hash_signature_pkcs1_1_5_.patch | 96 ++++++++++ patches/0003-Fix-for-CVE-2026-12413.patch | 25 ++ patches/0004-Fix-compilation-error-on-Fedora-44.patch | 53 +++++ patches/0005-x509-tighten-nss_compat-BER-check.patch | 24 ++ patches/0006-ikev2-check-the-cert-s-pubkey-unpacked-before-using-.patch | 51 +++++ patches/series | 6 8 files changed, 352 insertions(+) diff -Nru libreswan-5.2/debian/changelog libreswan-5.2/debian/changelog --- libreswan-5.2/debian/changelog 2026-01-15 22:39:49.000000000 +0200 +++ libreswan-5.2/debian/changelog 2026-08-06 16:04:55.000000000 +0300 @@ -1,3 +1,17 @@ +libreswan (5.2-2.5) unstable; urgency=medium + + * Non-maintainer upload. + * Backport upstream fix for FTBFS with GCC 16. (Closes: #1133535) + * CVE-2026-50721: IKEv1 Denial of Service via RSA-SHA1 + authentication payload + * CVE-2026-50722: IKEv2 Denial of Service via RSA-SHA1 + authentication payload + * CVE-2026-12413: IKEv2 Denial of Service via malformed fragmentation + * (Closes: #1141390) + * CVE-2026-14957: FIPS mode reachable assertion (Closes: #1143067) + + -- Adrian Bunk <[email protected]> Thu, 06 Aug 2026 16:04:55 +0300 + libreswan (5.2-2.4) unstable; urgency=medium * Non-maintainer upload. diff -Nru libreswan-5.2/debian/patches/0001-crypto-in-RSA_authenticate_hash_signature_raw_rsa-us.patch libreswan-5.2/debian/patches/0001-crypto-in-RSA_authenticate_hash_signature_raw_rsa-us.patch --- libreswan-5.2/debian/patches/0001-crypto-in-RSA_authenticate_hash_signature_raw_rsa-us.patch 1970-01-01 02:00:00.000000000 +0200 +++ libreswan-5.2/debian/patches/0001-crypto-in-RSA_authenticate_hash_signature_raw_rsa-us.patch 2026-08-06 16:04:55.000000000 +0300 @@ -0,0 +1,83 @@ +From bf11916429c411800be7c20968e1c9d58cb4558f Mon Sep 17 00:00:00 2001 +From: Andrew Cagney <[email protected]> +Date: Thu, 9 Apr 2026 21:02:51 -0400 +Subject: crypto: in RSA_authenticate_hash_signature_raw_rsa() use + PK11_Verify() + +--- + lib/libswan/pubkey_rsa.c | 52 ++++++---------------------------------- + 1 file changed, 7 insertions(+), 45 deletions(-) + +diff --git a/lib/libswan/pubkey_rsa.c b/lib/libswan/pubkey_rsa.c +index 36db8941c0..559f1c8532 100644 +--- a/lib/libswan/pubkey_rsa.c ++++ b/lib/libswan/pubkey_rsa.c +@@ -403,58 +403,20 @@ static bool RSA_authenticate_signature_raw_rsa(const struct crypt_mac *expected_ + *expected_hash); + } + +- /* +- * Use the same space used by the out going hash. +- */ +- +- SECItem decrypted_signature = { +- .type = siBuffer, +- }; +- +- if (SECITEM_AllocItem(NULL, &decrypted_signature, signature.len) == NULL) { +- llog_nss_error(RC_LOG, logger, "allocating space for decrypted RSA signature"); +- return false; +- } +- + /* NSS doesn't do const */ +- const SECItem encrypted_signature = { +- .type = siBuffer, +- .data = DISCARD_CONST(unsigned char *, signature.ptr), +- .len = signature.len, +- }; +- +- if (PK11_VerifyRecover(seckey_public, &encrypted_signature, &decrypted_signature, +- lsw_nss_get_password_context(logger)) != SECSuccess) { +- SECITEM_FreeItem(&decrypted_signature, PR_FALSE/*not-pointer*/); +- dbg("NSS RSA verify: decrypting signature is failed"); +- *fatal_diag = NULL; +- return false; +- } + +- if (DBGP(DBG_CRYPT)) { +- LLOG_JAMBUF(DEBUG_STREAM, logger, buf) { +- jam_string(buf, "NSS RSA verify: decrypted sig: "); +- jam_nss_secitem(buf, &decrypted_signature); +- } +- } ++ const SECItem signature_secitem = ++ same_shunk_as_secitem(signature, siBuffer); ++ const SECItem expected_hash_secitem = ++ same_shunk_as_secitem(HUNK_AS_SHUNK(*expected_hash), siBuffer); + +- /* +- * Expect the matching hash to appear at the end. See above +- * for length check. It may, or may not, be prefixed by a +- * PKCS#1 1.5 RSA ASN.1 blob. +- */ +- passert(decrypted_signature.len >= expected_hash->len); +- uint8_t *start = (decrypted_signature.data +- + decrypted_signature.len +- - expected_hash->len); +- if (!memeq(start, expected_hash->ptr, expected_hash->len)) { +- dbg("RSA Signature NOT verified"); +- SECITEM_FreeItem(&decrypted_signature, PR_FALSE/*not-pointer*/); ++ if (PK11_Verify(seckey_public, &signature_secitem, &expected_hash_secitem, ++ lsw_nss_get_password_context(logger)) != SECSuccess) { ++ dbg("NSS RSA verify: decrypting signature is failed"); + *fatal_diag = NULL; + return false; + } + +- SECITEM_FreeItem(&decrypted_signature, PR_FALSE/*not-pointer*/); + *fatal_diag = NULL; + return true; + } +-- +2.47.3 + diff -Nru libreswan-5.2/debian/patches/0002-crypto-in-RSA_authenticate_hash_signature_pkcs1_1_5_.patch libreswan-5.2/debian/patches/0002-crypto-in-RSA_authenticate_hash_signature_pkcs1_1_5_.patch --- libreswan-5.2/debian/patches/0002-crypto-in-RSA_authenticate_hash_signature_pkcs1_1_5_.patch 1970-01-01 02:00:00.000000000 +0200 +++ libreswan-5.2/debian/patches/0002-crypto-in-RSA_authenticate_hash_signature_pkcs1_1_5_.patch 2026-08-06 16:04:55.000000000 +0300 @@ -0,0 +1,96 @@ +From 5e6233574e5fd6bfc33b2de524f900e07ee4593d Mon Sep 17 00:00:00 2001 +From: Andrew Cagney <[email protected]> +Date: Fri, 10 Apr 2026 00:25:19 -0400 +Subject: crypto: in RSA_authenticate_hash_signature_pkcs1_1_5_rsa() use + VFY_VerifyDigestDirect() + +--- + lib/libswan/pubkey_rsa.c | 58 +++++++++------------------------------- + 1 file changed, 12 insertions(+), 46 deletions(-) + +diff --git a/lib/libswan/pubkey_rsa.c b/lib/libswan/pubkey_rsa.c +index 559f1c8532..b67d0f9b46 100644 +--- a/lib/libswan/pubkey_rsa.c ++++ b/lib/libswan/pubkey_rsa.c +@@ -492,7 +492,7 @@ static struct hash_signature RSA_pkcs1_1_5_sign_hash(const struct secret_pubkey_ + static bool RSA_authenticate_signature_pkcs1_1_5_rsa(const struct crypt_mac *expected_hash, + shunk_t signature, + struct pubkey *pubkey, +- const struct hash_desc *unused_hash_algo UNUSED, ++ const struct hash_desc *hash_alg, + diag_t *fatal_diag, + struct logger *logger) + { +@@ -510,58 +510,24 @@ static bool RSA_authenticate_signature_pkcs1_1_5_rsa(const struct crypt_mac *exp + *expected_hash); + } + +- /* +- * Use the same space used by the out going hash. +- */ +- +- SECItem decrypted_signature = { +- .type = siBuffer, +- }; +- +- if (SECITEM_AllocItem(NULL, &decrypted_signature, signature.len) == NULL) { +- llog_nss_error(RC_LOG, logger, "allocating space for decrypted RSA signature"); +- return false; +- } ++ SECItem hash_item = ++ same_shunk_as_secitem(HUNK_AS_SHUNK(*expected_hash), siBuffer); + + /* NSS doesn't do const */ +- const SECItem encrypted_signature = { +- .type = siBuffer, +- .data = DISCARD_CONST(unsigned char *, signature.ptr), +- .len = signature.len, +- }; +- +- if (PK11_VerifyRecover(seckey_public, &encrypted_signature, &decrypted_signature, +- lsw_nss_get_password_context(logger)) != SECSuccess) { +- SECITEM_FreeItem(&decrypted_signature, PR_FALSE/*not-pointer*/); +- dbg("NSS RSA verify: decrypting signature is failed"); +- *fatal_diag = NULL; +- return false; +- } +- +- if (DBGP(DBG_CRYPT)) { +- LLOG_JAMBUF(DEBUG_STREAM, logger, buf) { +- jam_string(buf, "NSS RSA verify: decrypted sig: "); +- jam_nss_secitem(buf, &decrypted_signature); +- } +- } ++ SECItem signature_item = ++ same_shunk_as_secitem(signature, siBuffer); + +- /* +- * Expect the matching hash to appear at the end. See above +- * for length check. It may, or may not, be prefixed by a +- * PKCS#1 1.5 RSA ASN.1 blob. +- */ +- passert(decrypted_signature.len >= expected_hash->len); +- uint8_t *start = (decrypted_signature.data +- + decrypted_signature.len +- - expected_hash->len); +- if (!memeq(start, expected_hash->ptr, expected_hash->len)) { +- dbg("RSA Signature NOT verified"); +- SECITEM_FreeItem(&decrypted_signature, PR_FALSE/*not-pointer*/); ++ if (VFY_VerifyDigestDirect(&hash_item, ++ seckey_public, ++ &signature_item, ++ /*pubkey algorithm*/SEC_OID_PKCS1_RSA_ENCRYPTION, ++ /*hash algorithm*/hash_alg->nss.oid_tag, ++ lsw_nss_get_password_context(logger)) != SECSuccess) { ++ ldbg_nss_error(logger, "NSS VFY_VerifyDigest() failed"); + *fatal_diag = NULL; + return false; + } + +- SECITEM_FreeItem(&decrypted_signature, PR_FALSE/*not-pointer*/); + *fatal_diag = NULL; + return true; + } +-- +2.47.3 + diff -Nru libreswan-5.2/debian/patches/0003-Fix-for-CVE-2026-12413.patch libreswan-5.2/debian/patches/0003-Fix-for-CVE-2026-12413.patch --- libreswan-5.2/debian/patches/0003-Fix-for-CVE-2026-12413.patch 1970-01-01 02:00:00.000000000 +0200 +++ libreswan-5.2/debian/patches/0003-Fix-for-CVE-2026-12413.patch 2026-08-06 16:04:55.000000000 +0300 @@ -0,0 +1,25 @@ +From e685bee4c698cf862a8a6422d22ccf4555c4ba77 Mon Sep 17 00:00:00 2001 +From: Paul Wouters <[email protected]> +Date: Tue, 16 Jun 2026 12:42:47 -0400 +Subject: Fix for CVE-2026-12413 + +--- + programs/pluto/ikev2_message.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/programs/pluto/ikev2_message.c b/programs/pluto/ikev2_message.c +index e822e7b083..cd057a7275 100644 +--- a/programs/pluto/ikev2_message.c ++++ b/programs/pluto/ikev2_message.c +@@ -977,7 +977,7 @@ struct msg_digest *reassemble_v2_incoming_fragments(struct v2_incoming_fragments + passert(md->chain[ISAKMP_NEXT_v2SK] == NULL); + passert(md->chain[ISAKMP_NEXT_v2SKF] != NULL); + pexpect(md->chain[ISAKMP_NEXT_v2SKF]->payload.v2skf.isaskf_number == 1); +- passert(md->digest_roof < elemsof(md->digest)); ++ passert(md->digest_roof <= elemsof(md->digest)); + + /* + * Pass 1: Compute the total payload size. +-- +2.47.3 + diff -Nru libreswan-5.2/debian/patches/0004-Fix-compilation-error-on-Fedora-44.patch libreswan-5.2/debian/patches/0004-Fix-compilation-error-on-Fedora-44.patch --- libreswan-5.2/debian/patches/0004-Fix-compilation-error-on-Fedora-44.patch 1970-01-01 02:00:00.000000000 +0200 +++ libreswan-5.2/debian/patches/0004-Fix-compilation-error-on-Fedora-44.patch 2026-08-06 16:04:55.000000000 +0300 @@ -0,0 +1,53 @@ +From 0b1dafb72aee149102ceb759023e209df35f9bca Mon Sep 17 00:00:00 2001 +From: Daiki Ueno <[email protected]> +Date: Thu, 29 Jan 2026 11:34:17 +0900 +Subject: Fix compilation error on Fedora 44 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +On Fedora 44, where -Wunused-but-set-variable is enabled with GCC 16, +the build fails with: + + ikev2_proposals.c: In function ‘process_transforms’: + ikev2_proposals.c:453:46: error: variable ‘local_proposal’ set but not used [-Werror=unused-but-set-variable=] + 453 | const struct ikev2_proposal *local_proposal; + | ^~~~~~~~~~~~~~ + ikev2_proposals.c:773:32: error: variable ‘local_proposal’ set but not used [-Werror=unused-but-set-variable=] + 773 | struct ikev2_proposal *local_proposal; + | ^~~~~~~~~~~~~~ + cc1: all warnings being treated as errors + +This fixes it by adding the UNUSED attribute to the local variable. + +Signed-off-by: Daiki Ueno <[email protected]> +Signed-off-by: Andrew Cagney <[email protected]> +--- + programs/pluto/ikev2_proposals.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/programs/pluto/ikev2_proposals.c b/programs/pluto/ikev2_proposals.c +index b5c023089f..713440dc6a 100644 +--- a/programs/pluto/ikev2_proposals.c ++++ b/programs/pluto/ikev2_proposals.c +@@ -440,7 +440,7 @@ static int process_transforms(struct pbs_in *prop_pbs, struct jambuf *remote_jam + */ + { + int local_propnum; +- const struct ikev2_proposal *local_proposal; ++ const struct ikev2_proposal *local_proposal UNUSED; + FOR_EACH_V2_PROPOSAL_IN_RANGE(local_propnum, local_proposal, local_proposals, + local_propnum_base, local_propnum_bound) { + struct ikev2_proposal_match *matching_local_proposal = &matching_local_proposals[local_propnum]; +@@ -689,7 +689,7 @@ static int process_transforms(struct pbs_in *prop_pbs, struct jambuf *remote_jam + } + + int local_propnum; +- struct ikev2_proposal *local_proposal; ++ struct ikev2_proposal *local_proposal UNUSED; + FOR_EACH_V2_PROPOSAL_IN_RANGE(local_propnum, local_proposal, local_proposals, + local_propnum_base, local_propnum_bound) { + struct ikev2_proposal_match *matching_local_proposal = &matching_local_proposals[local_propnum]; +-- +2.47.3 + diff -Nru libreswan-5.2/debian/patches/0005-x509-tighten-nss_compat-BER-check.patch libreswan-5.2/debian/patches/0005-x509-tighten-nss_compat-BER-check.patch --- libreswan-5.2/debian/patches/0005-x509-tighten-nss_compat-BER-check.patch 1970-01-01 02:00:00.000000000 +0200 +++ libreswan-5.2/debian/patches/0005-x509-tighten-nss_compat-BER-check.patch 2026-08-06 16:04:55.000000000 +0300 @@ -0,0 +1,24 @@ +From 77c8584b25f6b8a307644d88dee1fca08ee93b25 Mon Sep 17 00:00:00 2001 +From: Andrew Cagney <[email protected]> +Date: Thu, 9 Jul 2026 19:02:42 -0400 +Subject: x509: tighten nss_compat BER check + +--- + lib/libswan/x509dn.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/libswan/x509dn.c b/lib/libswan/x509dn.c +index 10ee7d5a3c..4862ed5393 100644 +--- a/lib/libswan/x509dn.c ++++ b/lib/libswan/x509dn.c +@@ -382,6 +382,7 @@ static err_t format_dn(struct jambuf *buf, asn1_t dn, + * #BER. + */ + (nss_compatible && ++ value_content.len > 0 && + ((const char*)value_content.ptr)[0] == '#')) { + /* BER */ + s += jam_string(buf, "#"); +-- +2.47.3 + diff -Nru libreswan-5.2/debian/patches/0006-ikev2-check-the-cert-s-pubkey-unpacked-before-using-.patch libreswan-5.2/debian/patches/0006-ikev2-check-the-cert-s-pubkey-unpacked-before-using-.patch --- libreswan-5.2/debian/patches/0006-ikev2-check-the-cert-s-pubkey-unpacked-before-using-.patch 1970-01-01 02:00:00.000000000 +0200 +++ libreswan-5.2/debian/patches/0006-ikev2-check-the-cert-s-pubkey-unpacked-before-using-.patch 2026-08-06 16:04:55.000000000 +0300 @@ -0,0 +1,51 @@ +From 1fa0125acb20a55be369c0aa0a64cb2cf5706093 Mon Sep 17 00:00:00 2001 +From: Andrew Cagney <[email protected]> +Date: Thu, 9 Jul 2026 19:04:01 -0400 +Subject: ikev2: check the cert's pubkey unpacked before using it - + cve-2026-14957 + +--- + programs/pluto/nss_cert_verify.c | 27 +++++++++++++++++---------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c +index e784deff5b..13468a3d58 100644 +--- a/programs/pluto/nss_cert_verify.c ++++ b/programs/pluto/nss_cert_verify.c +@@ -402,16 +402,23 @@ static void add_decoded_cert(CERTCertDBHandle *handle, + */ + if (is_fips_mode()) { + SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert); +- passert(pk != NULL); +- unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_IN_BYTE; +- if (pk->keyType == rsaKey && key_bit_size < FIPS_MIN_RSA_KEY_SIZE) { +- llog(RC_LOG, logger, +- "FIPS: rejecting peer cert with key size %u under %u: %s", +- key_bit_size, FIPS_MIN_RSA_KEY_SIZE, +- cert->subjectName); +- SECKEY_DestroyPublicKey(pk); +- CERT_DestroyCertificate(cert); +- return; ++ if (pk == NULL) { ++ llog_nss_error(RC_LOG, logger, ++ "extracting certificate public key using CERT_ExtractPublicKey() failed"); ++ return; ++ } ++ ++ if (pk->keyType == rsaKey) { ++ unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_IN_BYTE; ++ if (key_bit_size < FIPS_MIN_RSA_KEY_SIZE) { ++ llog(RC_LOG, logger, ++ "FIPS: rejecting peer cert with key size %u under %u: %s", ++ key_bit_size, FIPS_MIN_RSA_KEY_SIZE, ++ cert->subjectName); ++ SECKEY_DestroyPublicKey(pk); ++ CERT_DestroyCertificate(cert); ++ return; ++ } + } + SECKEY_DestroyPublicKey(pk); + } +-- +2.47.3 + diff -Nru libreswan-5.2/debian/patches/series libreswan-5.2/debian/patches/series --- libreswan-5.2/debian/patches/series 2026-01-15 22:39:48.000000000 +0200 +++ libreswan-5.2/debian/patches/series 2026-08-06 16:04:55.000000000 +0300 @@ -2,3 +2,9 @@ 0002-debian-pam.d-pluto.patch 0004-Include-features.h-to-enable-NSPR-workaround-for-854.patch 0001-building-pass-1L-into-curl_easy_setopt-CURLOPT_NOSIG.patch +0001-crypto-in-RSA_authenticate_hash_signature_raw_rsa-us.patch +0002-crypto-in-RSA_authenticate_hash_signature_pkcs1_1_5_.patch +0003-Fix-for-CVE-2026-12413.patch +0004-Fix-compilation-error-on-Fedora-44.patch +0005-x509-tighten-nss_compat-BER-check.patch +0006-ikev2-check-the-cert-s-pubkey-unpacked-before-using-.patch
