mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-03-17 04:39:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

gnupg: CVE-2013-4351

Browse Source 
GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits
cleared (no usage permitted) as if it has all bits set (all usage permitted),
which might allow remote attackers to bypass intended cryptographic protection
mechanisms by leveraging the subkey.

(From OE-Core rev: 259aebc9dbcaeb1587aaaab849942f55fa321724)

Signed-off-by: Ming Liu <ming.liu@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Ming Liu
2014-03-26 16:32:12 +08:00
committed by Richard Purdie
parent f6548c56cb
commit 0abd9418b1
2 changed files with 47 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
meta/recipes-support/gnupg/gnupg-1.4.7/CVE-2013-4351.patch Normal file
View File

@@ -0,0 +1,44 @@
Upstream-Status: Backport
Index: gnupg-1.4.7/g10/getkey.c
===================================================================
--- gnupg-1.4.7.orig/g10/getkey.c 2007-03-05 16:54:41.000000000 +0800
+++ gnupg-1.4.7/g10/getkey.c 2013-11-28 14:41:59.640212240 +0800
@@ -1454,7 +1454,11 @@
if(flags)
key_usage |= PUBKEY_USAGE_UNKNOWN;
+ if (!key_usage)
+ key_usage |= PUBKEY_USAGE_NONE;
}
+ else if (p)
+ key_usage |= PUBKEY_USAGE_NONE;
/* We set PUBKEY_USAGE_UNKNOWN to indicate that this key has a
capability that we do not handle. This serves to distinguish
Index: gnupg-1.4.7/g10/keygen.c
===================================================================
--- gnupg-1.4.7.orig/g10/keygen.c 2007-02-05 00:27:40.000000000 +0800
+++ gnupg-1.4.7/g10/keygen.c 2013-11-28 14:43:05.016670092 +0800
@@ -209,9 +209,6 @@
if (use & PUBKEY_USAGE_AUTH)
buf[0] |= 0x20;
- if (!buf[0])
- return;
-
build_sig_subpkt (sig, SIGSUBPKT_KEY_FLAGS, buf, 1);
}
Index: gnupg-1.4.7/include/cipher.h
===================================================================
--- gnupg-1.4.7.orig/include/cipher.h 2006-04-21 20:39:49.000000000 +0800
+++ gnupg-1.4.7/include/cipher.h 2013-11-28 14:49:24.159322744 +0800
@@ -52,6 +52,7 @@
#define PUBKEY_USAGE_CERT 4 /* key is also good to certify other keys*/
#define PUBKEY_USAGE_AUTH 8 /* key is good for authentication */
#define PUBKEY_USAGE_UNKNOWN 128 /* key has an unknown usage bit */
+#define PUBKEY_USAGE_NONE 256 /* No usage given. */
#define DIGEST_ALGO_MD5 1
#define DIGEST_ALGO_SHA1 2

4
meta/recipes-support/gnupg/gnupg_1.4.7.bb
View File

@@ -14,7 +14,9 @@ SRC_URI = "ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-${PV}.tar.bz2 \
file://configure.patch \
file://mips_gcc4.4.patch \
file://GnuPG1-CVE-2012-6085.patch \
file://curl_typeof_fix_backport.patch"
file://curl_typeof_fix_backport.patch \
file://CVE-2013-4351.patch \
"
SRC_URI[md5sum] = "b06a141cca5cd1a55bbdd25ab833303c"
SRC_URI[sha256sum] = "69d18b7d193f62ca27ed4febcb4c9044aa0c95305d3258fe902e2fae5fc6468d"