diff options
author | Stig Palmquist <git@stig.io> | 2022-07-03 03:42:49 +0200 |
---|---|---|
committer | Stig Palmquist <git@stig.io> | 2022-07-03 03:48:18 +0200 |
commit | 3d0e70ae2ad9a6545eb70b067b5c081eba45ee6c (patch) | |
tree | a0cae5761e8351f50a250d2b3bd738ad6b87a93b /pkgs/tools/security/gnupg | |
parent | 1b2929cd91ad76a9b46555d01beb8a0f84ccb418 (diff) |
gnupg: Add patch for CVE-2022-34903
https://www.openwall.com/lists/oss-security/2022/06/30/1 https://dev.gnupg.org/T6027
Diffstat (limited to 'pkgs/tools/security/gnupg')
-rw-r--r-- | pkgs/tools/security/gnupg/23.nix | 3 | ||||
-rw-r--r-- | pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch | 45 |
2 files changed, 48 insertions, 0 deletions
diff --git a/pkgs/tools/security/gnupg/23.nix b/pkgs/tools/security/gnupg/23.nix index 3687a1e9582e5..b07a3550c76dd 100644 --- a/pkgs/tools/security/gnupg/23.nix +++ b/pkgs/tools/security/gnupg/23.nix @@ -34,6 +34,9 @@ stdenv.mkDerivation rec { ./tests-add-test-cases-for-import-without-uid.patch ./allow-import-of-previously-known-keys-even-without-UI.patch ./accept-subkeys-with-a-good-revocation-but-no-self-sig.patch + + # Patch from upstream 34c649b36013, https://dev.gnupg.org/T6027 + ./CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch ]; postPatch = '' sed -i 's,\(hkps\|https\)://keyserver.ubuntu.com,hkps://keys.openpgp.org,g' configure configure.ac doc/dirmngr.texi doc/gnupg.info-1 diff --git a/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch b/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch new file mode 100644 index 0000000000000..4383475a1c83d --- /dev/null +++ b/pkgs/tools/security/gnupg/CVE-2022-34903-g10-fix-garbled-status-messages-in-NOTATION_DATA.patch @@ -0,0 +1,45 @@ +commit 34c649b3601383cd11dbc76221747ec16fd68e1b +Author: Werner Koch <wk@gnupg.org> +Date: 2022-06-14 11:33:27 +0200 + + g10: Fix garbled status messages in NOTATION_DATA + + * g10/cpr.c (write_status_text_and_buffer): Fix off-by-one + -- + + Depending on the escaping and line wrapping the computed remaining + buffer length could be wrong. Fixed by always using a break to + terminate the escape detection loop. Might have happened for all + status lines which may wrap. + + GnuPG-bug-id: T6027 + +diff --git a/g10/cpr.c b/g10/cpr.c +index 9bfdd3c34..fa8005d6f 100644 +--- a/g10/cpr.c ++++ b/g10/cpr.c +@@ -372,20 +372,15 @@ write_status_text_and_buffer (int no, const char *string, + } + first = 0; + } +- for (esc=0, s=buffer, n=len; n && !esc; s++, n--) ++ for (esc=0, s=buffer, n=len; n; s++, n--) + { + if (*s == '%' || *(const byte*)s <= lower_limit + || *(const byte*)s == 127 ) + esc = 1; + if (wrap && ++count > wrap) +- { +- dowrap=1; +- break; +- } +- } +- if (esc) +- { +- s--; n++; ++ dowrap=1; ++ if (esc || dowrap) ++ break; + } + if (s != buffer) + es_fwrite (buffer, s-buffer, 1, statusfp); |