mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-03-08 08:19:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

openssl: fix CVE-2025-69419

Browse Source 
Backport patch from NVD report: https://nvd.nist.gov/vuln/detail/CVE-2025-69419

(From OE-Core rev: 0ad28133e04d439fbee5710ab4b43042d1101ff6)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hitendra Prajapati
2026-02-20 10:13:22 +05:30
committed by Richard Purdie
parent dbdc8de0ef
commit 113e92bd8b
2 changed files with 62 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch Normal file
View File

@@ -0,0 +1,61 @@
From 41be0f216404f14457bbf3b9cc488dba60b49296 Mon Sep 17 00:00:00 2001
From: Norbert Pocs <norbertp@openssl.org>
Date: Thu, 11 Dec 2025 12:49:00 +0100
Subject: [PATCH] Check return code of UTF8_putc
Signed-off-by: Norbert Pocs <norbertp@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/29376)
CVE: CVE-2025-69419
Upstream-Status: Backport [https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296]
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
crypto/asn1/a_strex.c | 6 ++++--
crypto/pkcs12/p12_utl.c | 11 +++++++++--
2 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c
index f64e352..7d76700 100644
--- a/crypto/asn1/a_strex.c
+++ b/crypto/asn1/a_strex.c
@@ -204,8 +204,10 @@ static int do_buf(unsigned char *buf, int buflen,
orflags = CHARTYPE_LAST_ESC_2253;
if (type & BUF_TYPE_CONVUTF8) {
unsigned char utfbuf[6];
- int utflen;
- utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
+ int utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
+
+ if (utflen < 0)
+ return -1; /* error happened with UTF8 */
for (i = 0; i < utflen; i++) {
/*
* We don't need to worry about setting orflags correctly
diff --git a/crypto/pkcs12/p12_utl.c b/crypto/pkcs12/p12_utl.c
index a96623f..b109dab 100644
--- a/crypto/pkcs12/p12_utl.c
+++ b/crypto/pkcs12/p12_utl.c
@@ -206,8 +206,15 @@ char *OPENSSL_uni2utf8(const unsigned char *uni, int unilen)
/* re-run the loop emitting UTF-8 string */
for (asclen = 0, i = 0; i < unilen; ) {
j = bmp_to_utf8(asctmp+asclen, uni+i, unilen-i);
- if (j == 4) i += 4;
- else i += 2;
+ /* when UTF8_putc fails */
+ if (j < 0) {
+ OPENSSL_free(asctmp);
+ return NULL;
+ }
+ if (j == 4)
+ i += 4;
+ else
+ i += 2;
asclen += j;
}
--
2.50.1

1
meta/recipes-connectivity/openssl/openssl_3.2.6.bb
View File

@@ -14,6 +14,7 @@ SRC_URI = "https://github.com/openssl/openssl/releases/download/openssl-${PV}/op
file://0001-Added-handshake-history-reporting-when-test-fails.patch \
file://CVE-2024-41996.patch \
file://CVE-2025-15468.patch \
file://CVE-2025-69419.patch \
"
SRC_URI:append:class-nativesdk = " \