|
 |
5acb7f |
From 6f55656e288808437389f7d733e9a466fa5f0e2b Mon Sep 17 00:00:00 2001
|
|
|
5acb7f |
From: Michal Srb <msrb@redhat.com>
|
|
|
5acb7f |
Date: Tue, 12 Aug 2014 16:14:06 +0200
|
|
|
5acb7f |
Subject: [PATCH] Fix CVE-2014-3577
|
|
|
5acb7f |
|
|
|
5acb7f |
---
|
|
|
5acb7f |
.../protocol/SSLProtocolSocketFactory.java | 57 ++++++++++++++--------
|
|
|
5acb7f |
1 file changed, 37 insertions(+), 20 deletions(-)
|
|
|
5acb7f |
|
|
|
5acb7f |
diff --git a/src/java/org/apache/commons/httpclient/protocol/SSLProtocolSocketFactory.java b/src/java/org/apache/commons/httpclient/protocol/SSLProtocolSocketFactory.java
|
|
|
5acb7f |
index fa0acc7..e6ce513 100644
|
|
|
5acb7f |
--- a/src/java/org/apache/commons/httpclient/protocol/SSLProtocolSocketFactory.java
|
|
|
5acb7f |
+++ b/src/java/org/apache/commons/httpclient/protocol/SSLProtocolSocketFactory.java
|
|
|
5acb7f |
@@ -44,9 +44,15 @@ import java.util.Iterator;
|
|
|
5acb7f |
import java.util.LinkedList;
|
|
|
5acb7f |
import java.util.List;
|
|
|
5acb7f |
import java.util.Locale;
|
|
|
5acb7f |
-import java.util.StringTokenizer;
|
|
|
5acb7f |
+import java.util.NoSuchElementException;
|
|
|
5acb7f |
import java.util.regex.Pattern;
|
|
|
5acb7f |
|
|
|
5acb7f |
+import javax.naming.InvalidNameException;
|
|
|
5acb7f |
+import javax.naming.NamingException;
|
|
|
5acb7f |
+import javax.naming.directory.Attribute;
|
|
|
5acb7f |
+import javax.naming.directory.Attributes;
|
|
|
5acb7f |
+import javax.naming.ldap.LdapName;
|
|
|
5acb7f |
+import javax.naming.ldap.Rdn;
|
|
|
5acb7f |
import javax.net.ssl.SSLException;
|
|
|
5acb7f |
import javax.net.ssl.SSLSession;
|
|
|
5acb7f |
import javax.net.ssl.SSLSocket;
|
|
|
5acb7f |
@@ -424,28 +430,39 @@ public class SSLProtocolSocketFactory implements SecureProtocolSocketFactory {
|
|
|
5acb7f |
return dots;
|
|
|
5acb7f |
}
|
|
|
5acb7f |
|
|
|
5acb7f |
- private static String getCN(X509Certificate cert) {
|
|
|
5acb7f |
- // Note: toString() seems to do a better job than getName()
|
|
|
5acb7f |
- //
|
|
|
5acb7f |
- // For example, getName() gives me this:
|
|
|
5acb7f |
- // 1.2.840.113549.1.9.1=#16166a756c6975736461766965734063756362632e636f6d
|
|
|
5acb7f |
- //
|
|
|
5acb7f |
- // whereas toString() gives me this:
|
|
|
5acb7f |
- // EMAILADDRESS=juliusdavies@cucbc.com
|
|
|
5acb7f |
- String subjectPrincipal = cert.getSubjectX500Principal().toString();
|
|
|
5acb7f |
-
|
|
|
5acb7f |
- return getCN(subjectPrincipal);
|
|
|
5acb7f |
-
|
|
|
5acb7f |
+ private static String getCN(final X509Certificate cert) {
|
|
|
5acb7f |
+ final String subjectPrincipal = cert.getSubjectX500Principal().toString();
|
|
|
5acb7f |
+ try {
|
|
|
5acb7f |
+ return extractCN(subjectPrincipal);
|
|
|
5acb7f |
+ } catch (SSLException ex) {
|
|
|
5acb7f |
+ return null;
|
|
|
5acb7f |
+ }
|
|
|
5acb7f |
}
|
|
|
5acb7f |
- private static String getCN(String subjectPrincipal) {
|
|
|
5acb7f |
- StringTokenizer st = new StringTokenizer(subjectPrincipal, ",");
|
|
|
5acb7f |
- while(st.hasMoreTokens()) {
|
|
|
5acb7f |
- String tok = st.nextToken().trim();
|
|
|
5acb7f |
- if (tok.length() > 3) {
|
|
|
5acb7f |
- if (tok.substring(0, 3).equalsIgnoreCase("CN=")) {
|
|
|
5acb7f |
- return tok.substring(3);
|
|
|
5acb7f |
+
|
|
|
5acb7f |
+ private static String extractCN(final String subjectPrincipal) throws SSLException {
|
|
|
5acb7f |
+ if (subjectPrincipal == null) {
|
|
|
5acb7f |
+ return null;
|
|
|
5acb7f |
+ }
|
|
|
5acb7f |
+ try {
|
|
|
5acb7f |
+ final LdapName subjectDN = new LdapName(subjectPrincipal);
|
|
|
5acb7f |
+ final List<Rdn> rdns = subjectDN.getRdns();
|
|
|
5acb7f |
+ for (int i = rdns.size() - 1; i >= 0; i--) {
|
|
|
5acb7f |
+ final Rdn rds = rdns.get(i);
|
|
|
5acb7f |
+ final Attributes attributes = rds.toAttributes();
|
|
|
5acb7f |
+ final Attribute cn = attributes.get("cn");
|
|
|
5acb7f |
+ if (cn != null) {
|
|
|
5acb7f |
+ try {
|
|
|
5acb7f |
+ final Object value = cn.get();
|
|
|
5acb7f |
+ if (value != null) {
|
|
|
5acb7f |
+ return value.toString();
|
|
|
5acb7f |
+ }
|
|
|
5acb7f |
+ } catch (NoSuchElementException ignore) {
|
|
|
5acb7f |
+ } catch (NamingException ignore) {
|
|
|
5acb7f |
+ }
|
|
|
5acb7f |
}
|
|
|
5acb7f |
}
|
|
|
5acb7f |
+ } catch (InvalidNameException e) {
|
|
|
5acb7f |
+ throw new SSLException(subjectPrincipal + " is not a valid X500 distinguished name");
|
|
|
5acb7f |
}
|
|
|
5acb7f |
return null;
|
|
|
5acb7f |
}
|
|
|
5acb7f |
--
|
|
|
5acb7f |
1.9.3
|
|
|
5acb7f |
|