!41 fix CVE-2020-8286
From: @xielhxie Reviewed-by: @wangxp006 Signed-off-by: @wangxp006
This commit is contained in:
openeuler-ci-bot
Gitee
commit
dd5fda7640
125
backport-CVE-2020-8286.patch
Normal file
125
backport-CVE-2020-8286.patch
Normal file
@ -0,0 +1,125 @@
|
||||
From d9d01672785b8ac04aab1abb6de95fe3072ae199 Mon Sep 17 00:00:00 2001
|
||||
From: Daniel Stenberg <daniel@haxx.se>
|
||||
Date: Wed, 2 Dec 2020 23:01:11 +0100
|
||||
Subject: [PATCH] openssl: make the OCSP verification verify the certificate id
|
||||
|
||||
CVE-2020-8286
|
||||
|
||||
Reported by anonymous
|
||||
|
||||
Bug: https://curl.se/docs/CVE-2020-8286.html
|
||||
---
|
||||
lib/vtls/openssl.c | 83 ++++++++++++++++++++++++++++++----------------
|
||||
1 file changed, 54 insertions(+), 29 deletions(-)
|
||||
|
||||
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
|
||||
index c905465a0..e9c535f8f 100644
|
||||
--- a/lib/vtls/openssl.c
|
||||
+++ b/lib/vtls/openssl.c
|
||||
@@ -1795,6 +1795,11 @@ static CURLcode verifystatus(struct connectdata *conn,
|
||||
X509_STORE *st = NULL;
|
||||
STACK_OF(X509) *ch = NULL;
|
||||
struct ssl_backend_data *backend = connssl->backend;
|
||||
+ X509 *cert;
|
||||
+ OCSP_CERTID *id = NULL;
|
||||
+ int cert_status, crl_reason;
|
||||
+ ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
|
||||
+ int ret;
|
||||
|
||||
long len = SSL_get_tlsext_status_ocsp_resp(backend->handle, &status);
|
||||
|
||||
@@ -1863,43 +1868,63 @@ static CURLcode verifystatus(struct connectdata *conn,
|
||||
goto end;
|
||||
}
|
||||
|
||||
- for(i = 0; i < OCSP_resp_count(br); i++) {
|
||||
- int cert_status, crl_reason;
|
||||
- OCSP_SINGLERESP *single = NULL;
|
||||
-
|
||||
- ASN1_GENERALIZEDTIME *rev, *thisupd, *nextupd;
|
||||
+ /* Compute the certificate's ID */
|
||||
+ cert = SSL_get_peer_certificate(backend->handle);
|
||||
+ if(!cert) {
|
||||
+ failf(data, "Error getting peer certficate");
|
||||
+ result = CURLE_SSL_INVALIDCERTSTATUS;
|
||||
+ goto end;
|
||||
+ }
|
||||
|
||||
- single = OCSP_resp_get0(br, i);
|
||||
- if(!single)
|
||||
- continue;
|
||||
+ for(i = 0; i < sk_X509_num(ch); i++) {
|
||||
+ X509 *issuer = sk_X509_value(ch, i);
|
||||
+ if(X509_check_issued(issuer, cert) == X509_V_OK) {
|
||||
+ id = OCSP_cert_to_id(EVP_sha1(), cert, issuer);
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+ X509_free(cert);
|
||||
|
||||
- cert_status = OCSP_single_get0_status(single, &crl_reason, &rev,
|
||||
- &thisupd, &nextupd);
|
||||
+ if(!id) {
|
||||
+ failf(data, "Error computing OCSP ID");
|
||||
+ result = CURLE_SSL_INVALIDCERTSTATUS;
|
||||
+ goto end;
|
||||
+ }
|
||||
|
||||
- if(!OCSP_check_validity(thisupd, nextupd, 300L, -1L)) {
|
||||
- failf(data, "OCSP response has expired");
|
||||
- result = CURLE_SSL_INVALIDCERTSTATUS;
|
||||
- goto end;
|
||||
- }
|
||||
+ /* Find the single OCSP response corresponding to the certificate ID */
|
||||
+ ret = OCSP_resp_find_status(br, id, &cert_status, &crl_reason, &rev,
|
||||
+ &thisupd, &nextupd);
|
||||
+ OCSP_CERTID_free(id);
|
||||
+ if(ret != 1) {
|
||||
+ failf(data, "Could not find certificate ID in OCSP response");
|
||||
+ result = CURLE_SSL_INVALIDCERTSTATUS;
|
||||
+ goto end;
|
||||
+ }
|
||||
|
||||
- infof(data, "SSL certificate status: %s (%d)\n",
|
||||
- OCSP_cert_status_str(cert_status), cert_status);
|
||||
+ /* Validate the corresponding single OCSP response */
|
||||
+ if(!OCSP_check_validity(thisupd, nextupd, 300L, -1L)) {
|
||||
+ failf(data, "OCSP response has expired");
|
||||
+ result = CURLE_SSL_INVALIDCERTSTATUS;
|
||||
+ goto end;
|
||||
+ }
|
||||
|
||||
- switch(cert_status) {
|
||||
- case V_OCSP_CERTSTATUS_GOOD:
|
||||
- break;
|
||||
+ infof(data, "SSL certificate status: %s (%d)\n",
|
||||
+ OCSP_cert_status_str(cert_status), cert_status);
|
||||
|
||||
- case V_OCSP_CERTSTATUS_REVOKED:
|
||||
- result = CURLE_SSL_INVALIDCERTSTATUS;
|
||||
+ switch(cert_status) {
|
||||
+ case V_OCSP_CERTSTATUS_GOOD:
|
||||
+ break;
|
||||
|
||||
- failf(data, "SSL certificate revocation reason: %s (%d)",
|
||||
- OCSP_crl_reason_str(crl_reason), crl_reason);
|
||||
- goto end;
|
||||
+ case V_OCSP_CERTSTATUS_REVOKED:
|
||||
+ result = CURLE_SSL_INVALIDCERTSTATUS;
|
||||
+ failf(data, "SSL certificate revocation reason: %s (%d)",
|
||||
+ OCSP_crl_reason_str(crl_reason), crl_reason);
|
||||
+ goto end;
|
||||
|
||||
- case V_OCSP_CERTSTATUS_UNKNOWN:
|
||||
- result = CURLE_SSL_INVALIDCERTSTATUS;
|
||||
- goto end;
|
||||
- }
|
||||
+ case V_OCSP_CERTSTATUS_UNKNOWN:
|
||||
+ default:
|
||||
+ result = CURLE_SSL_INVALIDCERTSTATUS;
|
||||
+ goto end;
|
||||
}
|
||||
|
||||
end:
|
||||
--
|
||||
2.17.1
|
||||
@ -6,7 +6,7 @@
|
||||
|
||||
Name: curl
|
||||
Version: 7.71.1
|
||||
Release: 4
|
||||
Release: 5
|
||||
Summary: Curl is used in command lines or scripts to transfer data
|
||||
License: MIT
|
||||
URL: https://curl.haxx.se/
|
||||
@ -20,6 +20,7 @@ Patch106: 0106-curl-fix-CVE-2019-15601.patch
|
||||
Patch107: 0107-curl-close-unused-connect-only-connections.patch
|
||||
Patch108: 0108-curl-fix-CVE-2020-8231.patch
|
||||
Patch109: backport-CVE-2020-8284.patch
|
||||
Patch110: backport-CVE-2020-8286.patch
|
||||
|
||||
BuildRequires: automake brotli-devel coreutils gcc groff krb5-devel
|
||||
BuildRequires: libidn2-devel libmetalink-devel libnghttp2-devel libpsl-devel
|
||||
@ -161,6 +162,12 @@ rm -rf ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
|
||||
%{_mandir}/man3/*
|
||||
|
||||
%changelog
|
||||
* Tue Jan 19 2021 xielh2000 <xielh2000@163.com> - 7.71.1-5
|
||||
- Type:CVE
|
||||
- CVE:CVE-2020-8286
|
||||
- SUG:NA
|
||||
- DESC:fix CVE-2020-8286
|
||||
|
||||
* Mon Jan 18 2021 xihaochen <xihaochen@huawei.com> - 7.71.1-4
|
||||
- Type:CVE
|
||||
- CVE:CVE-2020-8284
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user