From a98071bfc5e156534b098b358004878b8266ed03 Mon Sep 17 00:00:00 2001 From: wangxinjian Date: Fri, 22 Dec 2023 14:09:40 +0800 Subject: [PATCH] fix CVE-2021-23841 --- CVE-2021-23841.patch | 44 +++++++++++++++++++++++++++++++++++++++ openresty-openssl111.spec | 7 ++++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 CVE-2021-23841.patch diff --git a/CVE-2021-23841.patch b/CVE-2021-23841.patch new file mode 100644 index 0000000..fbfd0c7 --- /dev/null +++ b/CVE-2021-23841.patch @@ -0,0 +1,44 @@ +From 122a19ab48091c657f7cb1fb3af9fc07bd557bbf Mon Sep 17 00:00:00 2001 +From: Matt Caswell +Date: Wed, 10 Feb 2021 16:10:36 +0000 +Subject: [PATCH] Fix Null pointer deref in X509_issuer_and_serial_hash() + +The OpenSSL public API function X509_issuer_and_serial_hash() attempts +to create a unique hash value based on the issuer and serial number data +contained within an X509 certificate. However it fails to correctly +handle any errors that may occur while parsing the issuer field (which +might occur if the issuer field is maliciously constructed). This may +subsequently result in a NULL pointer deref and a crash leading to a +potential denial of service attack. + +The function X509_issuer_and_serial_hash() is never directly called by +OpenSSL itself so applications are only vulnerable if they use this +function directly and they use it on certificates that may have been +obtained from untrusted sources. + +CVE-2021-23841 + +Reviewed-by: Richard Levitte +Reviewed-by: Paul Dale +(cherry picked from commit 8130d654d1de922ea224fa18ee3bc7262edc39c0) +Signed-off-by: guoxiaoqi +--- + crypto/x509/x509_cmp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/crypto/x509/x509_cmp.c b/crypto/x509/x509_cmp.c +index c9d8933..a964bbf 100644 +--- a/crypto/x509/x509_cmp.c ++++ b/crypto/x509/x509_cmp.c +@@ -39,6 +39,8 @@ unsigned long X509_issuer_and_serial_hash(X509 *a) + if (ctx == NULL) + goto err; + f = X509_NAME_oneline(a->cert_info.issuer, NULL, 0); ++ if (f == NULL) ++ goto err; + if (!EVP_DigestInit_ex(ctx, EVP_md5(), NULL)) + goto err; + if (!EVP_DigestUpdate(ctx, (unsigned char *)f, strlen(f))) +-- +1.8.3.1 + diff --git a/openresty-openssl111.spec b/openresty-openssl111.spec index be65604..260343d 100644 --- a/openresty-openssl111.spec +++ b/openresty-openssl111.spec @@ -1,6 +1,6 @@ Name: openresty-openssl111 Version: 1.1.1h -Release: 2 +Release: 3 Summary: OpenSSL library for OpenResty Group: Development/Libraries @@ -12,6 +12,7 @@ Source0: https://www.openssl.org/source/openssl-%{version}.tar.gz Patch0: openssl-1.1.1f-sess_set_get_cb_yield.patch Patch99: 0099-copy-dir.sh.patch +Patch100: CVE-2021-23841.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -115,6 +116,7 @@ Provides C header and static library for the debug version of OpenResty's OpenSS %patch0 -p1 %patch99 -p1 +%patch100 -p1 %build bash ./copy-dir.sh @@ -257,6 +259,9 @@ rm -rf %{buildroot} %attr(0755,root,root) %{openssl_prefix_debug}/lib/*.a %changelog +* Fri Dec 22 2023 wangxinjian - 1.1.1h-3 +- fix CVE-2021-23841 + * Thu Mar 24 2022 wulei - 1.1.1h-2 - Delete {?dist} -- Gitee