From nobody Fri Nov 24 08:06:28 2023 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Sc6xw5pYCz525Jc; Fri, 24 Nov 2023 08:06:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Sc6xw36sNz3Ljf; Fri, 24 Nov 2023 08:06:28 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1700813188; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LSQbLwkezqMKiiHPqp9pq2xlKgCCSGW40QNgsugw0Ig=; b=h4YWTsSdJp5HI2+44r9BJOHXGJ4iMoz8EJuD9COuwHTpdPi3BV3pozDibv7PMjHZI0lNg8 aGVNZqUEQPCBG+a8myiZTpMroVC8NT7U8gIv66aYtCxTm/k+McC3Y7JRW/zKv/BePyk2lU FaXO+7tJ2wBA6eJYx0Fspz4PsgzLGGEyzS/liuogL0WxkpVuEol0SgJJxGJgCVy10hWG7s 6XM0ODj8rw7njqOG7clbAVmIpbDaDhQfrw9Uj8FNx77d9cwXMJ/lQxc82wNaHy5tLXJeBg j+rpIuzC4m3ifw+irjjP7alRlHj0r3dSqpAjz/HJkKPBWvVYAVl7J7kDk40RvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1700813188; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LSQbLwkezqMKiiHPqp9pq2xlKgCCSGW40QNgsugw0Ig=; b=aL1Oln3esDlKe8Z1Y9/AZBScM4WpZzkmz/1PAj2wyu3bWX+Vh11bGrmq8fb7ERuzpvvnKI J6T2YBj1Izyr05T3yTIyZ5xxXPSiT6wHXIJWpgBKWH6LOKqb0kQtf/Tkoh4xj+8SWdPHru lFH4URGT/n4Z/HZyevBIGl3uitIsUtA2Bcf+icIliL+GWjT6f3hI/C8Y4SWRH54eHyN6Nu /oAw3MjfF7XwyOMQVQgb6vUMP3iTzne3w55zAuYX62PXpqaMQxb/x5NocqBsmuwV1ZEaml W10hY+2k6Vuzbg6kOoCUod/QdDYIe2CxKNTHaKZvyHdyMqa6JxQB2Vp3w/bINQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1700813188; a=rsa-sha256; cv=none; b=syyCEJdPFLngR2nrSfOHdBzg0nZdqGXWZL4BtpYdBfE3UYCpW+rnvu6CeeETtF7waZ5ucl CCE7xMxxsx9P2q2obGzhz3dBtBs+FxmShWy4FTb9I+ZiXYfEiW8o8RIS7WdTzMbnAJsjFT uVtEyXdkcDf+5BiChaBB/qalfZA1qSvCamOp8RISr+KwuxVaXGy0X8M2lDqqdi53eVS+U2 bbQxv0sd6BlyxwUv/eqYSnjWWyfMMKFQr2+4ReTnc092lXS5fEw1vGUqebe5mbUIb9pjC6 H6PxtLclmWOmve/TcZ7RfiUMH4OzDAhjqQwIf//53J04pEW6/jcCmjasujnp2g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Sc6xw29PdzdCG; Fri, 24 Nov 2023 08:06:28 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 3AO86SAt012874; Fri, 24 Nov 2023 08:06:28 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 3AO86SBL012871; Fri, 24 Nov 2023 08:06:28 GMT (envelope-from git) Date: Fri, 24 Nov 2023 08:06:28 GMT Message-Id: <202311240806.3AO86SBL012871@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Eugene Grosbein Subject: git: 4e2c0382dd6c - main - security/strongswan: fix CVE-2023-41913 List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: eugen X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 4e2c0382dd6c024d5349318f9a18762b3814ef9a Auto-Submitted: auto-generated The branch main has been updated by eugen: URL: https://cgit.FreeBSD.org/ports/commit/?id=4e2c0382dd6c024d5349318f9a18762b3814ef9a commit 4e2c0382dd6c024d5349318f9a18762b3814ef9a Author: Eugene Grosbein AuthorDate: 2023-11-24 08:03:00 +0000 Commit: Eugene Grosbein CommitDate: 2023-11-24 08:03:00 +0000 security/strongswan: fix CVE-2023-41913 This is urgent change adding official patch https://download.strongswan.org/security/CVE-2023-41913/strongswan-5.9.7-5.9.11_charon_tkm_dh_len.patch that is identical to the change made for strongswan-5.9.12: https://github.com/strongswan/strongswan/commit/96d793718955820dfe5e6d8aa6127a34795ae39e It is upto port maintainer to review and maybe upgrade the port to 5.9.12 Obtained from: strongSwan Security: CVE-2023-41913 --- security/strongswan/Makefile | 2 +- ...swanctl_charon-tkm_src_tkm_tkm_diffie_hellman.c | 42 ++++++++++++++++++++++ 2 files changed, 43 insertions(+), 1 deletion(-) diff --git a/security/strongswan/Makefile b/security/strongswan/Makefile index f6fe9d669352..c7972b9ca9b6 100644 --- a/security/strongswan/Makefile +++ b/security/strongswan/Makefile @@ -1,6 +1,6 @@ PORTNAME= strongswan DISTVERSION= 5.9.11 -PORTREVISION= 2 +PORTREVISION= 3 CATEGORIES= security net-vpn MASTER_SITES= https://download.strongswan.org/ \ https://download2.strongswan.org/ diff --git a/security/strongswan/files/patch-src_swanctl_charon-tkm_src_tkm_tkm_diffie_hellman.c b/security/strongswan/files/patch-src_swanctl_charon-tkm_src_tkm_tkm_diffie_hellman.c new file mode 100644 index 000000000000..f70c02446427 --- /dev/null +++ b/security/strongswan/files/patch-src_swanctl_charon-tkm_src_tkm_tkm_diffie_hellman.c @@ -0,0 +1,42 @@ +From 027421cbd2e6e628f5f959c74d722afadc477485 Mon Sep 17 00:00:00 2001 +From: Tobias Brunner +Date: Tue, 11 Jul 2023 12:12:25 +0200 +Subject: [PATCH] charon-tkm: Validate DH public key to fix potential buffer + overflow + +Seems this was forgotten in the referenced commit and actually could lead +to a buffer overflow. Since charon-tkm is untrusted this isn't that +much of an issue but could at least be easily exploited for a DoS attack +as DH public values are set when handling IKE_SA_INIT requests. + +Fixes: 0356089d0f94 ("diffie-hellman: Verify public DH values in backends") +Fixes: CVE-2023-41913 +--- + src/charon-tkm/src/tkm/tkm_diffie_hellman.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c +index 2b2d103d03e9..6999ad360d7e 100644 +--- src/charon-tkm/src/tkm/tkm_diffie_hellman.c ++++ src/charon-tkm/src/tkm/tkm_diffie_hellman.c +@@ -70,11 +70,16 @@ METHOD(key_exchange_t, get_shared_secret, bool, + return TRUE; + } + +- + METHOD(key_exchange_t, set_public_key, bool, + private_tkm_diffie_hellman_t *this, chunk_t value) + { + dh_pubvalue_type othervalue; ++ ++ if (!key_exchange_verify_pubkey(this->group, value) || ++ value.len > sizeof(othervalue.data)) ++ { ++ return FALSE; ++ } + othervalue.size = value.len; + memcpy(&othervalue.data, value.ptr, value.len); + +-- +2.34.1 +