openssl: fix CVE-2014-3470
http://www.openssl.org/news/secadv_20140605.txt Anonymous ECDH denial of service (CVE-2014-3470) OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack. (Patch borrowed from Fedora.) (From OE-Core rev: fe4e278f1794dda2e1aded56360556fe933614ca) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
parent
0ea0a14bd9
commit
8ac53f3c2d
|
@ -0,0 +1,31 @@
|
|||
commit 4ad43d511f6cf064c66eb4bfd0fb0919b5dd8a86
|
||||
Author: Dr. Stephen Henson <steve@openssl.org>
|
||||
Date: Thu May 29 15:00:05 2014 +0100
|
||||
|
||||
Fix CVE-2014-3470
|
||||
|
||||
Check session_cert is not NULL before dereferencing it.
|
||||
|
||||
Patch borrowed from Fedora
|
||||
Upstream-Status: Backport
|
||||
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
|
||||
|
||||
|
||||
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
|
||||
index d35376d..4324f8d 100644
|
||||
--- a/ssl/s3_clnt.c
|
||||
+++ b/ssl/s3_clnt.c
|
||||
@@ -2511,6 +2511,13 @@ int ssl3_send_client_key_exchange(SSL *s)
|
||||
int ecdh_clnt_cert = 0;
|
||||
int field_size = 0;
|
||||
|
||||
+ if (s->session->sess_cert == NULL)
|
||||
+ {
|
||||
+ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
|
||||
+ SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
|
||||
+ goto err;
|
||||
+ }
|
||||
+
|
||||
/* Did we send out the client's
|
||||
* ECDH share for use in premaster
|
||||
* computation as part of client certificate?
|
|
@ -42,6 +42,7 @@ SRC_URI += "file://configure-targets.patch \
|
|||
file://openssl-1.0.1e-cve-2014-0198.patch \
|
||||
file://openssl-1.0.1e-cve-2014-0221.patch \
|
||||
file://openssl-1.0.1e-cve-2014-0224.patch \
|
||||
file://openssl-1.0.1e-cve-2014-3470.patch \
|
||||
"
|
||||
|
||||
SRC_URI[md5sum] = "66bf6f10f060d561929de96f9dfe5b8c"
|
||||
|
|
Loading…
Reference in New Issue