openbsd/src/lib/libcrypto/cms/cms_env.c, branch OPENBSD_6_8_BASEA mirror of https://github.com/libressl/openbsd.git
https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE2019-10-04T18:03:56+00:00Fix a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey.2019-10-04T18:03:56+00:00tb2019-10-04T18:03:56+00:00urn:sha1:03a0a727a85c64d9828255b797ef2d1d59c061df
(Note that the CMS code is currently disabled.)
Port of Edlinger's Fix for CVE-2019-1563 from OpenSSL 1.1.1 (old license)
tests from bluhm@
ok jsing
commit e21f8cf78a125cd3c8c0d1a1a6c8bb0b901f893f
Author: Bernd Edlinger <bernd.edlinger@hotmail.de>
Date: Sun Sep 1 00:16:28 2019 +0200
Fix a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
An attack is simple, if the first CMS_recipientInfo is valid but the
second CMS_recipientInfo is chosen ciphertext. If the second
recipientInfo decodes to PKCS #1 v1.5 form plaintext, the correct
encryption key will be replaced by garbage, and the message cannot be
decoded, but if the RSA decryption fails, the correct encryption key is
used and the recipient will not notice the attack.
As a work around for this potential attack the length of the decrypted
key must be equal to the cipher default key length, in case the
certifiate is not given and all recipientInfo are tried out.
The old behaviour can be re-enabled in the CMS code by setting the
CMS_DEBUG_DECRYPT flag.
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/9777)
(cherry picked from commit 5840ed0cd1e6487d247efbc1a04136a41d7b3a37)
Include string.h for explicit_bzero().2019-08-11T11:07:40+00:00jsing2019-08-11T11:07:40+00:00urn:sha1:dc29fc5c7d6f8943b8439f40ea45d9d323d04d77Expand M_ASN1_new_of and M_ASN1_free_of macros.2019-08-11T11:04:18+00:00jsing2019-08-11T11:04:18+00:00urn:sha1:b62b2cda811eb26882ba6eb737b566e44c3e7d04Use freezero() rather than OPENSSL_clear_free().2019-08-11T10:43:57+00:00jsing2019-08-11T10:43:57+00:00urn:sha1:c385e0dffd770a9bd4e2ca787528391b4c0f8a96Use explicit_bzero() instead of OPENSSL_cleanse().2019-08-11T10:43:24+00:00jsing2019-08-11T10:43:24+00:00urn:sha1:a7aa291c374195c849faa353de43e476f7cfc258Use malloc(3) and free(3), rather than OPENSSL_{malloc,free}().2019-08-11T10:41:49+00:00jsing2019-08-11T10:41:49+00:00urn:sha1:54114f8225ed9f3d426ca49ff8e0df410a310372Convert CMSerr() to CMSerror().2019-08-11T10:38:27+00:00jsing2019-08-11T10:38:27+00:00urn:sha1:f7a527513ace17b70b14f3975dd212ba42e464c8More style(9), whitespace and readability fixes.2019-08-10T18:15:52+00:00jsing2019-08-10T18:15:52+00:00urn:sha1:cd017df13ee5f5ba7baa4ffe853ae05106ef3cac
Files are identical once whitespace and newlines are removed.
First pass at style(9).2019-08-10T16:42:20+00:00jsing2019-08-10T16:42:20+00:00urn:sha1:75125ce1cf513471883fff50db4a4638526bd785
Whitespace only and no change according to diff -w.
Fix includes for non-installed headers.2019-08-10T16:39:17+00:00jsing2019-08-10T16:39:17+00:00urn:sha1:5d7053e9dd0807d71499cb4dda1e06eb13a776c9