已开启
fix CVE-2025-5987 #92
AtomGit-Bot创建于 2025年7月14日
fix CVE-2025-5987 #92
已开启
从refs/pull/92/head合入到openEuler-24.03-LTS-SP2
共 2 个文件变更+38-1
| @@ -0,0 +1,30 @@ | |||
| 1 | +From 90b4845e0c98574bbf7bea9e97796695f064bf57 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Jakub Jelen <jjelen@redhat.com> | ||
| 3 | +Date: Tue, 6 May 2025 22:51:41 +0200 | ||
| 4 | +Subject: CVE-2025-5987 libcrypto: Correctly detect failures of chacha initialization | ||
| 5 | + | ||
| 6 | +Signed-off-by: Jakub Jelen <jjelen@redhat.com> | ||
| 7 | +Reviewed-by: Andreas Schneider <asn@cryptomilk.org> | ||
| 8 | +--- | ||
| 9 | + src/libcrypto.c | 4 ++-- | ||
| 10 | + 1 file changed, 2 insertions(+), 2 deletions(-) | ||
| 11 | + | ||
| 12 | +diff --git a/src/libcrypto.c b/src/libcrypto.c | ||
| 13 | +index 4f945d9..911b363 100644 | ||
| 14 | +--- a/src/libcrypto.c | ||
| 15 | ++++ b/src/libcrypto.c | ||
| 16 | + chacha20_poly1305_set_key(struct ssh_cipher_struct *cipher, | ||
| 17 | + SSH_LOG(SSH_LOG_WARNING, "EVP_CIPHER_CTX_new failed"); | ||
| 18 | + goto out; | ||
| 19 | + } | ||
| 20 | +- ret = EVP_EncryptInit_ex(ctx->header_evp, EVP_chacha20(), NULL, | ||
| 21 | ++ rv = EVP_EncryptInit_ex(ctx->header_evp, EVP_chacha20(), NULL, | ||
| 22 | + u8key + CHACHA20_KEYLEN, NULL); | ||
| 23 | +- if (ret != 1) { | ||
| 24 | ++ if (rv != 1) { | ||
| 25 | + SSH_LOG(SSH_LOG_WARNING, "EVP_CipherInit failed"); | ||
| 26 | + goto out; | ||
| 27 | + } | ||
| 28 | +-- | ||
| 29 | +2.43.0 | ||
| 30 | + | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: libssh | 1 | Name: libssh |
| 2 | Version: 0.10.5 | 2 | Version: 0.10.5 |
| 3 | -Release: 4 | 3 | +Release: 5 |
| 4 | Summary: A library implementing the SSH protocol | 4 | Summary: A library implementing the SSH protocol |
| 5 | License: LGPLv2+ | 5 | License: LGPLv2+ |
| 6 | URL: http://www.libssh.org | 6 | URL: http://www.libssh.org |
| @@ -30,6 +30,7 @@ Patch18: backport-0018-CVE-2023-6918-kdf-Detect-context-init-failures.pat | |||
| 30 | Patch19: backport-0019-CVE-2023-6918-tests-Code-coverage-for-ssh_get_pubkey.patch | 30 | Patch19: backport-0019-CVE-2023-6918-tests-Code-coverage-for-ssh_get_pubkey.patch |
| 31 | Patch20: backport-Fix-regression-in-IPv6-addresses-in-hostname-parsing.patch | 31 | Patch20: backport-Fix-regression-in-IPv6-addresses-in-hostname-parsing.patch |
| 32 | Patch21: backport-0020-CVE-2025-5318-fix-possible-buffer-overrun.patch | 32 | Patch21: backport-0020-CVE-2025-5318-fix-possible-buffer-overrun.patch |
| 33 | +Patch22: backport-0021-CVE-2025-5987-Correctly-detect-failures-of-chacha.patch | ||
| 33 | 34 | ||
| 34 | BuildRequires: cmake gcc-c++ gnupg2 openssl-devel pkgconfig zlib-devel | 35 | BuildRequires: cmake gcc-c++ gnupg2 openssl-devel pkgconfig zlib-devel |
| 35 | BuildRequires: krb5-devel libcmocka-devel openssh-clients openssh-server | 36 | BuildRequires: krb5-devel libcmocka-devel openssh-clients openssh-server |
| @@ -115,6 +116,12 @@ popd | |||
| 115 | %doc CHANGELOG README | 116 | %doc CHANGELOG README |
| 116 | 117 | ||
| 117 | %changelog | 118 | %changelog |
| 119 | +* Mon Jul 14 2025 andy <liuyang01@kylinos.cn> - 0.10.5-5 | ||
| 120 | +- Type:CVE | ||
| 121 | +- Id:CVE-2025-5987 | ||
| 122 | +- SUG:NA | ||
| 123 | +- DESC:fix CVE-2025-5987 | ||
| 124 | + | ||
| 118 | * Wed Jul 2 2025 zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-4 | 125 | * Wed Jul 2 2025 zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-4 |
| 119 | - Type:CVE | 126 | - Type:CVE |
| 120 | - Id:CVE-2025-5318 | 127 | - Id:CVE-2025-5318 |