Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
systemsmanagement:saltstack:bundle:Fedora35
saltbundle-zeromq
CVE-2019-13132.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2019-13132.patch of Package saltbundle-zeromq
From b2fe2a2c957af991df0d7acc9217f6ed5daf2a38 Mon Sep 17 00:00:00 2001 From: Luca Boccassi <luca.boccassi@gmail.com> Date: Tue, 2 Jul 2019 01:24:19 +0100 Subject: [PATCH] Problem: application metadata not parsed correctly when using CURVE Solution: create buffers large enough to contain arbitrary metadata --- src/curve_server.cpp | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-) diff --git a/src/curve_server.cpp b/src/curve_server.cpp index 643e887b..97700dac 100644 --- a/src/curve_server.cpp +++ b/src/curve_server.cpp @@ -326,8 +326,12 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_) const size_t clen = (size - 113) + crypto_box_BOXZEROBYTES; uint8_t initiate_nonce [crypto_box_NONCEBYTES]; - uint8_t initiate_plaintext [crypto_box_ZEROBYTES + 128 + 256]; - uint8_t initiate_box [crypto_box_BOXZEROBYTES + 144 + 256]; + uint8_t *initiate_plaintext = + static_cast<uint8_t *> (malloc (crypto_box_ZEROBYTES + clen)); + alloc_assert (initiate_plaintext); + uint8_t *initiate_box = + static_cast<uint8_t *> (malloc (crypto_box_BOXZEROBYTES + clen)); + alloc_assert (initiate_box); // Open Box [C + vouch + metadata](C'->S') memset (initiate_box, 0, crypto_box_BOXZEROBYTES); @@ -338,6 +342,8 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_) memcpy (initiate_nonce + 16, initiate + 105, 8); cn_peer_nonce = get_uint64(initiate + 105); + const uint8_t *client_key = initiate_plaintext + crypto_box_ZEROBYTES; + rc = crypto_box_open (initiate_plaintext, initiate_box, clen, initiate_nonce, cn_client, cn_secret); if (rc != 0) { @@ -345,11 +351,10 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_) session->get_socket ()->event_handshake_failed_protocol ( session->get_endpoint (), ZMQ_PROTOCOL_ERROR_ZMTP_CRYPTOGRAPHIC); errno = EPROTO; - return -1; + rc = -1; + goto exit; } - const uint8_t *client_key = initiate_plaintext + crypto_box_ZEROBYTES; - uint8_t vouch_nonce [crypto_box_NONCEBYTES]; uint8_t vouch_plaintext [crypto_box_ZEROBYTES + 64]; uint8_t vouch_box [crypto_box_BOXZEROBYTES + 80]; @@ -371,7 +376,8 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_) session->get_socket ()->event_handshake_failed_protocol ( session->get_endpoint (), ZMQ_PROTOCOL_ERROR_ZMTP_CRYPTOGRAPHIC); errno = EPROTO; - return -1; + rc = -1; + goto exit; } // What we decrypted must be the client's short-term public key @@ -383,7 +389,8 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_) session->get_socket ()->event_handshake_failed_protocol ( session->get_endpoint (), ZMQ_PROTOCOL_ERROR_ZMTP_KEY_EXCHANGE); errno = EPROTO; - return -1; + rc = -1; + goto exit; } // Precompute connection secret from client key @@ -405,7 +412,7 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_) // is attempted) rc = receive_and_process_zap_reply (); if (rc == -1) - return -1; + goto exit; } else if (!options.zap_enforce_domain) { // This supports the Stonehouse pattern (encryption without // authentication) in legacy mode (domain set but no handler). @@ -413,15 +420,21 @@ int zmq::curve_server_t::process_initiate (msg_t *msg_) } else { session->get_socket ()->event_handshake_failed_no_detail ( session->get_endpoint (), EFAULT); - return -1; + rc = -1; + goto exit; } } else { // This supports the Stonehouse pattern (encryption without authentication). state = sending_ready; } - return parse_metadata (initiate_plaintext + crypto_box_ZEROBYTES + 128, - clen - crypto_box_ZEROBYTES - 128); + rc = parse_metadata (initiate_plaintext + crypto_box_ZEROBYTES + 128, + clen - crypto_box_ZEROBYTES - 128); + +exit: + free (initiate_plaintext); + free (initiate_box); + return rc; } int zmq::curve_server_t::produce_ready (msg_t *msg_) -- 2.20.1
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor