Fix CVE-2018-6003: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6003 https://lists.gnu.org/archive/html/help-libtasn1/2018-01/msg00000.html Patch copied from upstream source repository: https://gitlab.com/gnutls/libtasn1/commit/c593ae84cfcde8fea45787e53950e0ac71e9ca97 From c593ae84cfcde8fea45787e53950e0ac71e9ca97 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Thu, 4 Jan 2018 10:52:05 +0100 Subject: [PATCH] _asn1_decode_simple_ber: restrict the levels of recursion to 3 On indefinite string decoding, setting a maximum level of recursions protects the BER decoder from a stack exhaustion due to large amounts of recursion. Signed-off-by: Nikos Mavrogiannopoulos --- lib/decoding.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/lib/decoding.c b/lib/decoding.c index 2240b09..0ee35d3 100644 --- a/lib/decoding.c +++ b/lib/decoding.c @@ -45,6 +45,13 @@ #define DECODE_FLAG_HAVE_TAG 1 #define DECODE_FLAG_INDEFINITE (1<<1) +/* On indefinite string decoding, allow this maximum levels + * of recursion. Allowing infinite recursion, makes the BER + * decoder susceptible to stack exhaustion due to that recursion. + */ +#define DECODE_FLAG_LEVEL1 (1<<2) +#define DECODE_FLAG_LEVEL2 (1<<3) +#define DECODE_FLAG_LEVEL3 (1<<4) #define DECR_LEN(l, s) do { \ l -= s; \ @@ -2216,7 +2223,8 @@ _asn1_decode_simple_ber (unsigned int etype, const unsigned char *der, } /* indefinite constructed */ - if (((dflags & DECODE_FLAG_INDEFINITE) || class == ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype)) + if ((((dflags & DECODE_FLAG_INDEFINITE) || class == ASN1_CLASS_STRUCTURED) && ETYPE_IS_STRING(etype)) && + !(dflags & DECODE_FLAG_LEVEL3)) { len_len = 1; @@ -2236,8 +2244,17 @@ _asn1_decode_simple_ber (unsigned int etype, const unsigned char *der, do { unsigned tmp_len; + unsigned flags = DECODE_FLAG_HAVE_TAG; + + if (dflags & DECODE_FLAG_LEVEL1) + flags |= DECODE_FLAG_LEVEL2; + else if (dflags & DECODE_FLAG_LEVEL2) + flags |= DECODE_FLAG_LEVEL3; + else + flags |= DECODE_FLAG_LEVEL1; - result = asn1_decode_simple_ber(etype, p, der_len, &out, &out_len, &tmp_len); + result = _asn1_decode_simple_ber(etype, p, der_len, &out, &out_len, &tmp_len, + flags); if (result != ASN1_SUCCESS) { warn(); -- libgit2 0.26.0 >
AgeCommit message (Collapse)Author
2020-12-27services: Add radicale-service-type.Jonathan Brielmaier
* gnu/services/mail.scm (radicale-configuration) (radicale-configuration?): New procedures. (%default-radicale-config-file) (radicale-service-type): New variables. * doc/guix.texi: Document it.
2020-09-11Revert "services: dovecot: Use modules via symlink to system profile."Tobias Geerinckx-Rice
This reverts commit bcfe0f0c1e9a2b91049d7c6c591c7f0c6a002c14 for now. It breaks most current use(r)s of the Dovecot service and needs to be combined with an extra modules configuration field of some kind. See <https://issues.guix.gnu.org/43347>.
2020-09-11services: dovecot: Only serialize settings with non-empty values.Alexey Abramov
* gnu/services/mail.scm (serialize-space-separated-string-list): Protocols might have custom settings, which are not supported by other protocols. To prevent dovecot/services from crashing, serialize settings that hold non-empty values only. Signed-off-by: Tobias Geerinckx-Rice <me@tobias.gr>
2020-09-09services: dovecot: Serialize global settings first.Alexey Abramov
* gnu/services/mail.scm (dovecot-configuration): To avoid dovecot warning messages, move serialization of protocol settings below the global one. Signed-off-by: Tobias Geerinckx-Rice <me@tobias.gr>
2020-09-09services: dovecot: Use modules via symlink to system profile.Alexey Abramov
* gnu/services/mail.scm (%dovecot-activation): Link the location with multiple plugins (dovecot-pigeonhole, etc), to a place where dovecot can find them. * gnu/services/mail.scm (dovecot-configuration): Use the symlink. Signed-off-by: Tobias Geerinckx-Rice <me@tobias.gr>
2020-04-21services: dovecot: 'stop' method returns #f upon success.Ludovic Courtès
* gnu/services/mail.scm (dovecot-shepherd-service)[stop]: Use 'invoke' instead of 'make-forkexec-constructor'. Previously, the 'stop' method would return the PID of the "dovecot stop" process, which would be interpreted as a failure to stop the service.
2020-03-16tests: opensmtpd: Check /var/spool/mail instead of /var/mail.Ludovic Courtès
The test had been failing since the upgrade to 6.6.3p1 in commit 2dbfd8eec43b602d23cee3fdd2842cc333e36c24. * gnu/services/mail.scm (opensmtpd-activation): Create /var/spool/mail. * gnu/tests/mail.scm (run-opensmtpd-test): Check /var/spool/mail instead of /var/mail.