1. photon
  2. Commit f5976e889d90cdd273f5c1f8f757078faf0b49ec
Browse code

librelp : Fix CVE-2018-1000140

Change-Id: Ic3119b7e54c601ba34bf9bd16a450cc5a4211033
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/5047
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Sharath George

Xiaolin Li authored on 2018/04/21 03:17:03
Showing 2 changed files
SPECS/librelp/librelp-CVE-2018-1000140.patch
History View file @ f5976e8
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,73 @@
0 
+From 2cfe657672636aa5d7d2a14cfcb0a6ab9d1f00cf Mon Sep 17 00:00:00 2001
1 
+From: Rainer Gerhards <rgerhards@adiscon.com>
2 
+Date: Tue, 20 Mar 2018 12:30:12 +0100
3 
+Subject: [PATCH] unify error message generation
4 
+
5 
+---
6 
+ src/tcp.c | 38 +++++++++++++++++++++++++++++++++-----
7 
+ 1 file changed, 33 insertions(+), 5 deletions(-)
8 
+
9 
+diff --git a/src/tcp.c b/src/tcp.c
10 
+index a587627..d2d48f5 100644
11 
+--- a/src/tcp.c
12 
+@@ -1127,9 +1127,34 @@ done:
13 
+ 	return r;
14 
+ }
15 
+
16 
++/* helper to consistently add names to error message buffer */
17 
++static int
18 
++relpTcpAddToCertNamesBuffer(relpTcp_t *const pThis,
19 
++	char *const buf,
20 
++	const size_t buflen,
21 
++	int *p_currIdx,
22 
++	const char *const certName)
23 
++{
24 
++	int r = 0;
25 
++	assert(buf != NULL);
26 
++	assert(p_currIdx != NULL);
27 
++	const int currIdx = *p_currIdx;
28 
++	const int n = snprintf(buf + currIdx, buflen - currIdx,
29 
++		"DNSname: %s; ", certName);
30 
++	if(n < 0 || n >= (int) (buflen - currIdx)) {
31 
++		callOnAuthErr(pThis, "", "certificate validation failed, names "
32 
++			"inside certifcate are way to long (> 32KiB)",
33 
++			RELP_RET_AUTH_CERT_INVL);
34 
++		r = GNUTLS_E_CERTIFICATE_ERROR;
35 
++	} else {
36 
++		*p_currIdx += n;
37 
++	}
38 
++	return r;
39 
++}
40 
++
41 
+ /* Check the peer's ID in name auth mode. */
42 
+ static int
43 
+-relpTcpChkPeerName(relpTcp_t *pThis, gnutls_x509_crt cert)
44 
++relpTcpChkPeerName(relpTcp_t *const pThis, gnutls_x509_crt_t cert)
45 
+ {
46 
+ 	int r = 0;
47 
+ 	int ret;
48 
+@@ -1213,8 +1239,9 @@ relpTcpChkPeerName(relpTcp_t *pThis, gnutls_x509_crt_t cert)
49 
+ 			break;
50 
+ 		else if(gnuRet == GNUTLS_SAN_DNSNAME) {
51 
+ 			pThis->pEngine->dbgprint("librelp: subject alt dnsName: '%s'\n", szAltName);
52 
+-			iAllNames += snprintf(allNames+iAllNames, sizeof(allNames)-iAllNames,
53 
+-					      "DNSname: %s; ", szAltName);
54 
++			r = relpTcpAddToCertNamesBuffer(pThis, allNames, sizeof(allNames),
55 
++				&iAllNames, szAltName);
56 
++			if(r != 0) goto done;
57 
+ 			relpTcpChkOnePeerName(pThis, szAltName, &bFoundPositiveMatch);
58 
+ 			/* do NOT break, because there may be multiple dNSName's! */
59 
+ 		}
60 
+@@ -1225,8 +1252,9 @@ relpTcpChkPeerName(relpTcp_t *pThis, gnutls_x509_crt_t cert)
61 
+ 		/* if we did not succeed so far, we try the CN part of the DN... */
62 
+ 		if(relpTcpGetCN(pThis, cert, cnBuf, sizeof(cnBuf)) == 0) {
63 
+ 			pThis->pEngine->dbgprint("librelp: relpTcp now checking auth for CN '%s'\n", cnBuf);
64 
+-			iAllNames += snprintf(allNames+iAllNames, sizeof(allNames)-iAllNames,
65 
+-					      "CN: %s; ", cnBuf);
66 
++			r = relpTcpAddToCertNamesBuffer(pThis, allNames, sizeof(allNames),
67 
++				&iAllNames, cnBuf);
68 
++			if(r != 0) goto done;
69 
+ 			relpTcpChkOnePeerName(pThis, cnBuf, &bFoundPositiveMatch);
70 
+ 		}
71 
+ 	}
SPECS/librelp/librelp.spec
History View file @ f5976e8
... ... 
@@ -1,26 +1,27 @@
1 
-Summary:	RELP Library
2 
-Name:		librelp
3 
-Version:	1.2.9
4 
-Release:	2%{?dist}
5 
-License:	GPLv3+
6 
-URL:		http://www.librelp.com
7 
-Source0:	http://download.rsyslog.com/librelp/%{name}-%{version}.tar.gz
1 
+Summary:        RELP Library
2 
+Name:           librelp
3 
+Version:        1.2.9
4 
+Release:        3%{?dist}
5 
+License:        GPLv3+
6 
+URL:            http://www.librelp.com
7 
+Source0:        http://download.rsyslog.com/librelp/%{name}-%{version}.tar.gz
8 8 
 %define sha1 librelp=d8b61789a2775bbff08c1ac05b658a52afa4d729
9 
-Group:		System Environment/Libraries
10 
-Vendor:		VMware, Inc.
11 
-Distribution:	Photon
12 
-BuildRequires:	gnutls-devel
13 
-BuildRequires:	autogen
14 
-Requires:	gnutls
15 
-Requires:	gmp
9 
+Patch0:         librelp-CVE-2018-1000140.patch
10 
+Group:          System Environment/Libraries
11 
+Vendor:         VMware, Inc.
12 
+Distribution:   Photon
13 
+BuildRequires:  gnutls-devel
14 
+BuildRequires:  autogen
15 
+Requires:       gnutls
16 
+Requires:       gmp
16 17 
 %description
17 18 
 Librelp is an easy to use library for the RELP protocol. RELP (stands
18 19 
 for Reliable Event Logging Protocol) is a general-purpose, extensible
19 20 
 logging protocol.
20 21
21 22 
 %package devel
22 
-Summary:	Development libraries and header files for librelp
23 
-Requires:	librelp
23 
+Summary:        Development libraries and header files for librelp
24 
+Requires:       librelp
24 25
25 26 
 %description devel
26 27 
 The package contains libraries and header files for
... ... 
@@ -28,16 +29,17 @@ developing applications that use librelp.
28 28
29 29 
 %prep
30 30 
 %setup -q
31 
+%patch0 -p1
31 32 
 %build
32 33 
 ./configure \
33 
-	--prefix=%{_prefix}
34 
+        --prefix=%{_prefix}
34 35 
 make %{?_smp_mflags}
35 36 
 %install
36 37 
 make DESTDIR=%{buildroot} install
37 38 
 %check
38 39 
 make -k check |& tee %{_specdir}/%{name}-check-log || %{nocheck}
39 
-%post	-p /sbin/ldconfig
40 
-%postun	-p /sbin/ldconfig
40 
+%post   -p /sbin/ldconfig
41 
+%postun -p /sbin/ldconfig
41 42 
 %files
42 43 
 %defattr(-,root,root)
43 44 
 %{_libdir}/*.so.*
... ... 
@@ -49,10 +51,12 @@ make -k check |& tee %{_specdir}/%{name}-check-log || %{nocheck}
49 49 
 %{_libdir}/*.so
50 50 
 %{_libdir}/pkgconfig/*.pc
51 51 
 %changelog
52 
-*	Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 1.2.9-2
53 
--	GA - Bump release of all rpms
54 
-* 	Thu Feb 25 2016 Anish Swaminathan <anishs@vmware.com>  1.2.9-1
55 
-- 	Upgrade to 1.2.9
56 
-*	Thu Jun 18 2015 Divya Thaluru <dthaluru@vmware.com> 1.2.7-1
57 
--	Initial build. First version
52 
+*   Fri Apr 20 2018 Xiaolin Li <xiaolinl@vmware.com> 1.2.9-3
53 
+-   Fix CVE-2018-1000140
54 
+*   Tue May 24 2016 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 1.2.9-2
55 
+-   GA - Bump release of all rpms
56 
+*   Thu Feb 25 2016 Anish Swaminathan <anishs@vmware.com>  1.2.9-1
57 
+-   Upgrade to 1.2.9
58 
+*   Thu Jun 18 2015 Divya Thaluru <dthaluru@vmware.com> 1.2.7-1
59 
+-   Initial build. First version
58 60