已开启
fix cve-2023-0767 #144
panzhe0328创建于 2025年6月30日
fix cve-2023-0767 #144
已开启
从refs/pull/144/head合入到openEuler-20.03-LTS-SP4
共 2 个文件变更+98-1
| @@ -0,0 +1,92 @@ | |||
| 1 | +diff --git a/lib/pkcs12/p12d.c b/lib/pkcs12/p12d.c | ||
| 2 | +--- a/lib/pkcs12/p12d.c | ||
| 3 | ++++ b/lib/pkcs12/p12d.c | ||
| 4 | + | ||
| 5 | + sec_PKCS12SafeContentsContext *safeContentsCtx = | ||
| 6 | + (sec_PKCS12SafeContentsContext *)arg; | ||
| 7 | + SEC_PKCS12DecoderContext *p12dcx; | ||
| 8 | + SECStatus rv; | ||
| 9 | + | ||
| 10 | +- /* make sure that we are not skipping the current safeBag, | ||
| 11 | +- * and that there are no errors. If so, just return rather | ||
| 12 | +- * than continuing to process. | ||
| 13 | +- */ | ||
| 14 | +- if (!safeContentsCtx || !safeContentsCtx->p12dcx || | ||
| 15 | +- safeContentsCtx->p12dcx->error || safeContentsCtx->skipCurrentSafeBag) { | ||
| 16 | ++ if (!safeContentsCtx || !safeContentsCtx->p12dcx || !safeContentsCtx->currentSafeBagA1Dcx) { | ||
| 17 | + return; | ||
| 18 | + } | ||
| 19 | + p12dcx = safeContentsCtx->p12dcx; | ||
| 20 | + | ||
| 21 | ++ /* make sure that there are no errors and we are not skipping the current safeBag */ | ||
| 22 | ++ if (p12dcx->error || safeContentsCtx->skipCurrentSafeBag) { | ||
| 23 | ++ goto loser; | ||
| 24 | ++ } | ||
| 25 | ++ | ||
| 26 | + rv = SEC_ASN1DecoderUpdate(safeContentsCtx->currentSafeBagA1Dcx, data, len); | ||
| 27 | + if (rv != SECSuccess) { | ||
| 28 | + p12dcx->errorValue = PORT_GetError(); | ||
| 29 | ++ p12dcx->error = PR_TRUE; | ||
| 30 | ++ goto loser; | ||
| 31 | ++ } | ||
| 32 | ++ | ||
| 33 | ++ /* The update may have set safeContentsCtx->skipCurrentSafeBag, and we | ||
| 34 | ++ * may not get another opportunity to clean up the decoder context. | ||
| 35 | ++ */ | ||
| 36 | ++ if (safeContentsCtx->skipCurrentSafeBag) { | ||
| 37 | + goto loser; | ||
| 38 | + } | ||
| 39 | + | ||
| 40 | + return; | ||
| 41 | + | ||
| 42 | + loser: | ||
| 43 | +- /* set the error, and finish the decoder context. because there | ||
| 44 | ++ /* Finish the decoder context. Because there | ||
| 45 | + * is not a way of returning an error message, it may be worth | ||
| 46 | + * while to do a check higher up and finish any decoding contexts | ||
| 47 | + * that are still open. | ||
| 48 | + */ | ||
| 49 | +- p12dcx->error = PR_TRUE; | ||
| 50 | + SEC_ASN1DecoderFinish(safeContentsCtx->currentSafeBagA1Dcx); | ||
| 51 | + safeContentsCtx->currentSafeBagA1Dcx = NULL; | ||
| 52 | + return; | ||
| 53 | + } | ||
| 54 | + | ||
| 55 | +diff --git a/lib/pkcs12/p12t.h b/lib/pkcs12/p12t.h | ||
| 56 | +--- a/lib/pkcs12/p12t.h | ||
| 57 | ++++ b/lib/pkcs12/p12t.h | ||
| 58 | + | ||
| 59 | + SECKEYEncryptedPrivateKeyInfo *pkcs8ShroudedKeyBag; | ||
| 60 | + sec_PKCS12CertBag *certBag; | ||
| 61 | + sec_PKCS12CRLBag *crlBag; | ||
| 62 | + sec_PKCS12SecretBag *secretBag; | ||
| 63 | + sec_PKCS12SafeContents *safeContents; | ||
| 64 | ++ SECItem *unknownBag; | ||
| 65 | + } safeBagContent; | ||
| 66 | + | ||
| 67 | + sec_PKCS12Attribute **attribs; | ||
| 68 | + | ||
| 69 | + /* used locally */ | ||
| 70 | +diff --git a/lib/pkcs12/p12tmpl.c b/lib/pkcs12/p12tmpl.c | ||
| 71 | +--- a/lib/pkcs12/p12tmpl.c | ||
| 72 | ++++ b/lib/pkcs12/p12tmpl.c | ||
| 73 | + | ||
| 74 | + | ||
| 75 | + safeBag = (sec_PKCS12SafeBag *)src_or_dest; | ||
| 76 | + | ||
| 77 | + oiddata = SECOID_FindOID(&safeBag->safeBagType); | ||
| 78 | + if (oiddata == NULL) { | ||
| 79 | +- return SEC_ASN1_GET(SEC_AnyTemplate); | ||
| 80 | ++ return SEC_ASN1_GET(SEC_PointerToAnyTemplate); | ||
| 81 | + } | ||
| 82 | + | ||
| 83 | + switch (oiddata->offset) { | ||
| 84 | + default: | ||
| 85 | +- theTemplate = SEC_ASN1_GET(SEC_AnyTemplate); | ||
| 86 | ++ theTemplate = SEC_ASN1_GET(SEC_PointerToAnyTemplate); | ||
| 87 | + break; | ||
| 88 | + case SEC_OID_PKCS12_V1_KEY_BAG_ID: | ||
| 89 | + theTemplate = SEC_ASN1_GET(SECKEY_PointerToPrivateKeyInfoTemplate); | ||
| 90 | + break; | ||
| 91 | + case SEC_OID_PKCS12_V1_CERT_BAG_ID: | ||
| 92 | + | ||
| @@ -14,7 +14,7 @@ | |||
| 14 | Summary: Network Security Services | 14 | Summary: Network Security Services |
| 15 | Name: nss | 15 | Name: nss |
| 16 | Version: %{nss_version} | 16 | Version: %{nss_version} |
| 17 | -Release: 11 | 17 | +Release: 12 |
| 18 | License: MPLv2.0 | 18 | License: MPLv2.0 |
| 19 | URL: http://www.mozilla.org/projects/security/pki/nss/ | 19 | URL: http://www.mozilla.org/projects/security/pki/nss/ |
| 20 | Provides: nss-system-init | 20 | Provides: nss-system-init |
| @@ -48,6 +48,7 @@ Patch5: backport-0001-CVE-2020-12403.patch | |||
| 48 | Patch6: backport-0002-CVE-2020-12403.patch | 48 | Patch6: backport-0002-CVE-2020-12403.patch |
| 49 | Patch7: backport-Bug-1666891-Add-PK11_Pub-Wrap-Unwrap.patch | 49 | Patch7: backport-Bug-1666891-Add-PK11_Pub-Wrap-Unwrap.patch |
| 50 | Patch8: backport-CVE-2022-22747-Bug-1735028-check-for-missing.patch | 50 | Patch8: backport-CVE-2022-22747-Bug-1735028-check-for-missing.patch |
| 51 | +Patch9: cve-2023-0767.patch | ||
| 51 | 52 | ||
| 52 | Patch6000: backport-CVE-2021-43527.patch | 53 | Patch6000: backport-CVE-2021-43527.patch |
| 53 | 54 | ||
| @@ -142,6 +143,7 @@ Help document for NSS | |||
| 142 | pushd nss | 143 | pushd nss |
| 143 | %patch7 -p1 | 144 | %patch7 -p1 |
| 144 | %patch8 -p1 | 145 | %patch8 -p1 |
| 146 | +%patch9 -p1 | ||
| 145 | %patch6000 -p1 | 147 | %patch6000 -p1 |
| 146 | popd | 148 | popd |
| 147 | 149 | ||
| @@ -564,6 +566,9 @@ update-crypto-policies &> /dev/null || : | |||
| 564 | %doc %{_mandir}/man* | 566 | %doc %{_mandir}/man* |
| 565 | 567 | ||
| 566 | %changelog | 568 | %changelog |
| 569 | +* Mon Jun 30 2025 panzhe <panzhe@kylinos.cn> - 3.54.0-12 | ||
| 570 | +- fix cve-2023-0767 | ||
| 571 | + | ||
| 567 | * Tue May 20 2025 steven <steven_ygui@163.com> - 3.54.0-11 | 572 | * Tue May 20 2025 steven <steven_ygui@163.com> - 3.54.0-11 |
| 568 | - fix cve-2022-22747 | 573 | - fix cve-2022-22747 |
| 569 | 574 | ||