summaryrefslogtreecommitdiff
path: root/gnu/packages
diff options
context:
space:
mode:
authorTobias Geerinckx-Rice <me@tobias.gr>2019-02-28 23:53:26 +0100
committerTobias Geerinckx-Rice <me@tobias.gr>2019-03-01 00:00:16 +0100
commita92c6b1a2b5b8b69f248c732db4a11ddf130f0f1 (patch)
tree0e0c390d4eb7c7013d333ca1a98971d43f999c2e /gnu/packages
parent884910970332c92f77bd9e079b413e5683870f27 (diff)
gnu: openssl: Fix CVE-2019-1559.
* gnu/packages/tls.scm (openssl)[replacement]: New field. (openssl/fixed): New variable. (openssl-next)[inherit]: Inherit from it instead. * gnu/packages/patches/openssl-CVE-2019-1559.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it.
Diffstat (limited to 'gnu/packages')
-rw-r--r--gnu/packages/patches/openssl-CVE-2019-1559.patch60
-rw-r--r--gnu/packages/tls.scm14
2 files changed, 72 insertions, 2 deletions
diff --git a/gnu/packages/patches/openssl-CVE-2019-1559.patch b/gnu/packages/patches/openssl-CVE-2019-1559.patch
new file mode 100644
index 0000000000..3e630037b5
--- /dev/null
+++ b/gnu/packages/patches/openssl-CVE-2019-1559.patch
@@ -0,0 +1,60 @@
+From e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e Mon Sep 17 00:00:00 2001
+From: Matt Caswell <matt@openssl.org>
+Date: Fri, 14 Dec 2018 07:28:30 +0000
+Subject: [PATCH] Go into the error state if a fatal alert is sent or received
+
+If an application calls SSL_shutdown after a fatal alert has occured and
+then behaves different based on error codes from that function then the
+application may be vulnerable to a padding oracle.
+
+CVE-2019-1559
+
+Reviewed-by: Richard Levitte <levitte@openssl.org>
+---
+ ssl/d1_pkt.c | 1 +
+ ssl/s3_pkt.c | 10 +++++++---
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/ssl/d1_pkt.c b/ssl/d1_pkt.c
+index 23aa9db..c7fe977 100644
+--- a/ssl/d1_pkt.c
++++ b/ssl/d1_pkt.c
+@@ -1309,6 +1309,7 @@ int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
+ ERR_add_error_data(2, "SSL alert number ", tmp);
+ s->shutdown |= SSL_RECEIVED_SHUTDOWN;
+ SSL_CTX_remove_session(s->session_ctx, s->session);
++ s->state = SSL_ST_ERR;
+ return (0);
+ } else {
+ al = SSL_AD_ILLEGAL_PARAMETER;
+diff --git a/ssl/s3_pkt.c b/ssl/s3_pkt.c
+index 6527df8..830b723 100644
+--- a/ssl/s3_pkt.c
++++ b/ssl/s3_pkt.c
+@@ -1500,6 +1500,7 @@ int ssl3_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek)
+ ERR_add_error_data(2, "SSL alert number ", tmp);
+ s->shutdown |= SSL_RECEIVED_SHUTDOWN;
+ SSL_CTX_remove_session(s->session_ctx, s->session);
++ s->state = SSL_ST_ERR;
+ return (0);
+ } else {
+ al = SSL_AD_ILLEGAL_PARAMETER;
+@@ -1719,9 +1720,12 @@ int ssl3_send_alert(SSL *s, int level, int desc)
+ * protocol_version alerts */
+ if (desc < 0)
+ return -1;
+- /* If a fatal one, remove from cache */
+- if ((level == 2) && (s->session != NULL))
+- SSL_CTX_remove_session(s->session_ctx, s->session);
++ /* If a fatal one, remove from cache and go into the error state */
++ if (level == SSL3_AL_FATAL) {
++ if (s->session != NULL)
++ SSL_CTX_remove_session(s->session_ctx, s->session);
++ s->state = SSL_ST_ERR;
++ }
+
+ s->s3->alert_dispatch = 1;
+ s->s3->send_alert[0] = level;
+--
+2.7.4
+
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index c10b1a5320..6e91a46608 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -10,7 +10,7 @@
;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
;;; Copyright © 2017, 2018 Marius Bakke <mbakke@fastmail.com>
-;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2017, 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
;;; Copyright © 2018 Clément Lassieur <clement@lassieur.org>
;;;
@@ -271,6 +271,7 @@ required structures.")
(define-public openssl
(package
(name "openssl")
+ (replacement openssl/fixed)
(version "1.0.2p")
(source (origin
(method url-fetch)
@@ -399,9 +400,18 @@ required structures.")
(license license:openssl)
(home-page "https://www.openssl.org/")))
+(define-public openssl/fixed
+ (hidden-package
+ (package
+ (inherit openssl)
+ (source (origin
+ (inherit (package-source openssl))
+ (patches (append (origin-patches (package-source openssl))
+ (search-patches "openssl-CVE-2019-1559.patch"))))))))
+
(define-public openssl-next
(package
- (inherit openssl)
+ (inherit openssl/fixed)
(name "openssl")
(version "1.1.1a")
(source (origin