isaacpittman-hitachi / rpms / openssl

Forked from rpms/openssl 2 years ago
Clone
6e1574
From e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23 Mon Sep 17 00:00:00 2001
6e1574
From: Tomas Mraz <tomas@openssl.org>
6e1574
Date: Tue, 26 Apr 2022 12:40:24 +0200
6e1574
Subject: [PATCH] c_rehash: Do not use shell to invoke openssl
6e1574
6e1574
Except on VMS where it is safe.
6e1574
6e1574
This fixes CVE-2022-1292.
6e1574
6e1574
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
6e1574
Reviewed-by: Matt Caswell <matt@openssl.org>
6e1574
Upstream-Status: Backport [https://github.com/openssl/openssl/commit/e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23]
6e1574
---
6e1574
 tools/c_rehash.in | 29 +++++++++++++++++++++++++----
6e1574
 1 file changed, 25 insertions(+), 4 deletions(-)
6e1574
6e1574
diff --git a/tools/c_rehash.in b/tools/c_rehash.in
6e1574
index fa7c6c9fef91..83c1cc80e08a 100644
6e1574
--- a/tools/c_rehash.in
6e1574
+++ b/tools/c_rehash.in
6e1574
@@ -152,6 +152,23 @@ sub check_file {
6e1574
 	return ($is_cert, $is_crl);
6e1574
 }
6e1574
 
6e1574
+sub compute_hash {
6e1574
+    my $fh;
6e1574
+    if ( $^O eq "VMS" ) {
6e1574
+        # VMS uses the open through shell
6e1574
+        # The file names are safe there and list form is unsupported
6e1574
+        if (!open($fh, "-|", join(' ', @_))) {
6e1574
+            print STDERR "Cannot compute hash on '$fname'\n";
6e1574
+            return;
6e1574
+        }
6e1574
+    } else {
6e1574
+        if (!open($fh, "-|", @_)) {
6e1574
+            print STDERR "Cannot compute hash on '$fname'\n";
6e1574
+            return;
6e1574
+        }
6e1574
+    }
6e1574
+    return (<$fh>, <$fh>);
6e1574
+}
6e1574
 
6e1574
 # Link a certificate to its subject name hash value, each hash is of
6e1574
 # the form <hash>.<n> where n is an integer. If the hash value already exists
6e1574
@@ -161,10 +178,12 @@ sub check_file {
6e1574
 
6e1574
 sub link_hash_cert {
6e1574
 		my $fname = $_[0];
6e1574
-		$fname =~ s/\"/\\\"/g;
6e1574
-		my ($hash, $fprint) = `"$openssl" x509 $x509hash -fingerprint -noout -in "$fname"`;
6e1574
+		my ($hash, $fprint) = compute_hash($openssl, "x509", $x509hash,
6e1574
+						   "-fingerprint", "-noout",
6e1574
+						   "-in", $fname);
6e1574
 		chomp $hash;
6e1574
 		chomp $fprint;
6e1574
+		return if !$hash;
6e1574
 		$fprint =~ s/^.*=//;
6e1574
 		$fprint =~ tr/://d;
6e1574
 		my $suffix = 0;
6e1574
@@ -202,10 +221,12 @@ sub link_hash_cert {
6e1574
 
6e1574
 sub link_hash_crl {
6e1574
 		my $fname = $_[0];
6e1574
-		$fname =~ s/'/'\\''/g;
6e1574
-		my ($hash, $fprint) = `"$openssl" crl $crlhash -fingerprint -noout -in '$fname'`;
6e1574
+		my ($hash, $fprint) = compute_hash($openssl, "crl", $crlhash,
6e1574
+						   "-fingerprint", "-noout",
6e1574
+						   "-in", $fname);
6e1574
 		chomp $hash;
6e1574
 		chomp $fprint;
6e1574
+		return if !$hash;
6e1574
 		$fprint =~ s/^.*=//;
6e1574
 		$fprint =~ tr/://d;
6e1574
 		my $suffix = 0;