|
 |
24cd51 |
From a9102a384893fd084011e8451867071452031ece Mon Sep 17 00:00:00 2001
|
|
|
24cd51 |
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
|
|
|
24cd51 |
Date: Mon, 8 Feb 2021 17:05:28 +0000
|
|
|
24cd51 |
Subject: [PATCH 2/6] CVE-2021-25635
|
|
|
24cd51 |
|
|
|
24cd51 |
default to CertificateValidity::INVALID
|
|
|
24cd51 |
|
|
|
24cd51 |
so if CertGetCertificateChain fails we don't want validity to be
|
|
|
24cd51 |
css::security::CertificateValidity::VALID which is what the old default
|
|
|
24cd51 |
of 0 equates to
|
|
|
24cd51 |
|
|
|
24cd51 |
notably
|
|
|
24cd51 |
|
|
|
24cd51 |
commit 1e0bc66d16aee28ce8bd9582ea32178c63841902
|
|
|
24cd51 |
Date: Thu Nov 5 16:55:26 2009 +0100
|
|
|
24cd51 |
|
|
|
24cd51 |
jl137: #103420# better logging
|
|
|
24cd51 |
|
|
|
24cd51 |
turned the nss equivalent of SecurityEnvironment_NssImpl::verifyCertificate
|
|
|
24cd51 |
from 0 to CertificateValidity::INVALID like this change does
|
|
|
24cd51 |
|
|
|
24cd51 |
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/110561
|
|
|
24cd51 |
Tested-by: Jenkins
|
|
|
24cd51 |
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
|
|
|
24cd51 |
(cherry picked from commit edeb164c1d8ab64116afee4e2140403a362a1358)
|
|
|
24cd51 |
|
|
|
24cd51 |
Change-Id: I5350dbc22d1b9b378da2976d3b0abd728f1f4c27
|
|
|
24cd51 |
---
|
|
|
24cd51 |
.../source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx | 4 ++--
|
|
|
24cd51 |
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
24cd51 |
|
|
|
24cd51 |
diff --git a/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx b/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
|
|
|
24cd51 |
index d9b657891b96..4031df289f44 100644
|
|
|
24cd51 |
--- a/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
|
|
|
24cd51 |
+++ b/xmlsecurity/source/xmlsec/mscrypt/securityenvironment_mscryptimpl.cxx
|
|
|
24cd51 |
@@ -755,7 +755,7 @@ sal_Int32 SecurityEnvironment_MSCryptImpl::verifyCertificate(
|
|
|
24cd51 |
const uno::Reference< css::security::XCertificate >& aCert,
|
|
|
24cd51 |
const uno::Sequence< uno::Reference< css::security::XCertificate > >& seqCerts)
|
|
|
24cd51 |
{
|
|
|
24cd51 |
- sal_Int32 validity = 0;
|
|
|
24cd51 |
+ sal_Int32 validity = css::security::CertificateValidity::INVALID;
|
|
|
24cd51 |
PCCERT_CHAIN_CONTEXT pChainContext = nullptr;
|
|
|
24cd51 |
PCCERT_CONTEXT pCertContext = nullptr;
|
|
|
24cd51 |
|
|
|
24cd51 |
@@ -899,7 +899,7 @@ sal_Int32 SecurityEnvironment_MSCryptImpl::verifyCertificate(
|
|
|
24cd51 |
}
|
|
|
24cd51 |
else
|
|
|
24cd51 |
{
|
|
|
24cd51 |
- SAL_INFO("xmlsecurity.xmlsec", "CertGetCertificateChaine failed.");
|
|
|
24cd51 |
+ SAL_INFO("xmlsecurity.xmlsec", "CertGetCertificateChain failed.");
|
|
|
24cd51 |
}
|
|
|
24cd51 |
}
|
|
|
24cd51 |
|
|
|
24cd51 |
--
|
|
|
24cd51 |
2.32.0
|
|
|
24cd51 |
|