From c7bda16b4de9b61049f1f6b332aa25c718835f19 Mon Sep 17 00:00:00 2001 From: Miroslav Rezanina Date: Thu, 7 Sep 2023 02:27:50 -0400 Subject: [PATCH] VGAuth: Allow only X509 certs to verify the SAML token signature. RH-Author: Miroslav Rezanina RH-Jira: RHEL-2413 RH-CVE: CVE-2023-20900 Signed-off-by: Miroslav Rezanina --- open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c b/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c index 2906d293..57db3b88 100644 --- a/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c +++ b/open-vm-tools/vgauth/serviceImpl/saml-xmlsec1.c @@ -1275,7 +1275,14 @@ VerifySignature(xmlDocPtr doc, */ bRet = RegisterID(xmlDocGetRootElement(doc), "ID"); if (bRet == FALSE) { - g_warning("failed to register ID\n"); + g_warning("Failed to register ID\n"); + goto done; + } + + /* Use only X509 certs to validate the signature */ + if (xmlSecPtrListAdd(&(dsigCtx->keyInfoReadCtx.enabledKeyData), + BAD_CAST xmlSecKeyDataX509Id) < 0) { + g_warning("Failed to limit allowed key data\n"); goto done; } -- 2.39.3