diff options
Diffstat (limited to 'debian/patches/CVE-2017-7521.patch')
| -rw-r--r-- | debian/patches/CVE-2017-7521.patch | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/debian/patches/CVE-2017-7521.patch b/debian/patches/CVE-2017-7521.patch new file mode 100644 index 0000000..574ab4b --- /dev/null +++ b/debian/patches/CVE-2017-7521.patch @@ -0,0 +1,48 @@ +commit 040084067119dd5a9e15eb3bcfc0079debaa3777 +Author: Steffan Karger <steffan.karger@fox-it.com> +Date: Mon Jun 19 11:28:40 2017 +0200 + + Fix potential double-free in --x509-alt-username (CVE-2017-7521) + + We didn't check the return value of ASN1_STRING_to_UTF8() in + extract_x509_extension(). Ignoring such a failure could result in buf + being free'd twice. An error in ASN1_STRING_to_UTF8() can be caused + remotely if the peer can make the local process run out of memory. + + The problem can only be triggered for configurations that use the + --x509-alt-username option with an x509 extension (i.e. the option + parameter starts with "ext:"). + + This issue was discovered, analysed and reported to the OpenVPN team by + Guido Vranken. + + Extensive testing by Guido Vranken gives confidence that this function + is very unlikely to fail in real-world usage (using subjectAltName or + issuerAltName extensions) for other reasons than memory exhaustion. + + CVE: 2017-7521 + Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> + Acked-by: Gert Doering <gert@greenie.muc.de> + Acked-by: David Sommerseth <davids@openvpn.net> + Acked-by: Guido Vranken <guidovranken@gmail.com> + Message-Id: <1497864520-12219-6-git-send-email-steffan.karger@fox-it.com> + URL: https://www.mail-archive.com/search?l=mid&q=1497864520-12219-6-git-send-email-steffan.karger@fox-it.com + Signed-off-by: Gert Doering <gert@greenie.muc.de> + (cherry picked from commit cb4e35ece4a5b70b10ef9013be3bff263d82f32b) + +Index: openvpn-2.4.0/src/openvpn/ssl_verify_openssl.c +=================================================================== +--- openvpn-2.4.0.orig/src/openvpn/ssl_verify_openssl.c ++++ openvpn-2.4.0/src/openvpn/ssl_verify_openssl.c +@@ -142,7 +142,10 @@ extract_x509_extension(X509 *cert, char + switch (name->type) + { + case GEN_EMAIL: +- ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5); ++ if (ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5) < 0) ++ { ++ continue; ++ } + if (strlen(buf) != name->d.ia5->length) + { + msg(D_TLS_ERRORS, "ASN1 ERROR: string contained terminating zero"); |