1 files changed, 48 insertions, 0 deletions
diff --git a/debian/patches/CVE-2017-7521.patch b/debian/patches/CVE-2017-7521.patch
new file mode 100644
index 0000000..574ab4b
--- /dev/null
+++ b/debian/patches/CVE-2017-7521.patch
@@ -0,0 +1,48 @@
+commit 040084067119dd5a9e15eb3bcfc0079debaa3777
+Author: Steffan Karger <steffan.karger@fox-it.com>
+Date:   Mon Jun 19 11:28:40 2017 +0200
+
+    Fix potential double-free in --x509-alt-username (CVE-2017-7521)
+    
+    We didn't check the return value of ASN1_STRING_to_UTF8() in
+    extract_x509_extension().  Ignoring such a failure could result in buf
+    being free'd twice.  An error in ASN1_STRING_to_UTF8() can be caused
+    remotely if the peer can make the local process run out of memory.
+    
+    The problem can only be triggered for configurations that use the
+    --x509-alt-username option with an x509 extension (i.e. the option
+    parameter starts with "ext:").
+    
+    This issue was discovered, analysed and reported to the OpenVPN team by
+    Guido Vranken.
+    
+    Extensive testing by Guido Vranken gives confidence that this function
+    is very unlikely to fail in real-world usage (using subjectAltName or
+    issuerAltName extensions) for other reasons than memory exhaustion.
+    
+    CVE: 2017-7521
+    Signed-off-by: Steffan Karger <steffan.karger@fox-it.com>
+    Acked-by: Gert Doering <gert@greenie.muc.de>
+    Acked-by: David Sommerseth <davids@openvpn.net>
+    Acked-by: Guido Vranken <guidovranken@gmail.com>
+    Message-Id: <1497864520-12219-6-git-send-email-steffan.karger@fox-it.com>
+    URL: https://www.mail-archive.com/search?l=mid&q=1497864520-12219-6-git-send-email-steffan.karger@fox-it.com
+    Signed-off-by: Gert Doering <gert@greenie.muc.de>
+    (cherry picked from commit cb4e35ece4a5b70b10ef9013be3bff263d82f32b)
+
+Index: openvpn-2.4.0/src/openvpn/ssl_verify_openssl.c
+===================================================================
+--- openvpn-2.4.0.orig/src/openvpn/ssl_verify_openssl.c
++++ openvpn-2.4.0/src/openvpn/ssl_verify_openssl.c
+@@ -142,7 +142,10 @@ extract_x509_extension(X509 *cert, char
+             switch (name->type)
+             {
+                 case GEN_EMAIL:
+-                    ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5);
++                    if (ASN1_STRING_to_UTF8((unsigned char **)&buf, name->d.ia5) < 0)
++                    {
++                        continue;
++                    }
+                     if (strlen(buf) != name->d.ia5->length)
+                     {
+                         msg(D_TLS_ERRORS, "ASN1 ERROR: string contained terminating zero");