Blame SOURCES/00317-CVE-2019-5010.patch

900f19
From c660debb97f4f422255a82fef2d77804552c043a Mon Sep 17 00:00:00 2001
900f19
From: Christian Heimes <christian@python.org>
900f19
Date: Tue, 15 Jan 2019 18:16:30 +0100
900f19
Subject: [PATCH] bpo-35746: Fix segfault in ssl's cert parser
900f19
900f19
CVE-2019-5010, Fix a NULL pointer deref in ssl module. The cert parser did
900f19
not handle CRL distribution points with empty DP or URI correctly. A
900f19
malicious or buggy certificate can result into segfault.
900f19
900f19
Signed-off-by: Christian Heimes <christian@python.org>
900f19
---
900f19
 Lib/test/talos-2019-0758.pem                  | 22 +++++++++++++++++++
900f19
 Lib/test/test_ssl.py                          | 22 +++++++++++++++++++
900f19
 .../2019-01-15-18-16-05.bpo-35746.nMSd0j.rst  |  3 +++
900f19
 Modules/_ssl.c                                |  4 ++++
900f19
 4 files changed, 51 insertions(+)
900f19
 create mode 100644 Lib/test/talos-2019-0758.pem
900f19
 create mode 100644 Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst
900f19
900f19
diff --git a/Lib/test/talos-2019-0758.pem b/Lib/test/talos-2019-0758.pem
900f19
new file mode 100644
900f19
index 000000000000..13b95a77fd8a
900f19
--- /dev/null
900f19
+++ b/Lib/test/talos-2019-0758.pem
900f19
@@ -0,0 +1,22 @@
900f19
+-----BEGIN CERTIFICATE-----
900f19
+MIIDqDCCApKgAwIBAgIBAjALBgkqhkiG9w0BAQswHzELMAkGA1UEBhMCVUsxEDAO
900f19
+BgNVBAMTB2NvZHktY2EwHhcNMTgwNjE4MTgwMDU4WhcNMjgwNjE0MTgwMDU4WjA7
900f19
+MQswCQYDVQQGEwJVSzEsMCoGA1UEAxMjY29kZW5vbWljb24tdm0tMi50ZXN0Lmxh
900f19
+bC5jaXNjby5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC63fGB
900f19
+J80A9Av1GB0bptslKRIUtJm8EeEu34HkDWbL6AJY0P8WfDtlXjlPaLqFa6sqH6ES
900f19
+V48prSm1ZUbDSVL8R6BYVYpOlK8/48xk4pGTgRzv69gf5SGtQLwHy8UPBKgjSZoD
900f19
+5a5k5wJXGswhKFFNqyyxqCvWmMnJWxXTt2XDCiWc4g4YAWi4O4+6SeeHVAV9rV7C
900f19
+1wxqjzKovVe2uZOHjKEzJbbIU6JBPb6TRfMdRdYOw98n1VXDcKVgdX2DuuqjCzHP
900f19
+WhU4Tw050M9NaK3eXp4Mh69VuiKoBGOLSOcS8reqHIU46Reg0hqeL8LIL6OhFHIF
900f19
+j7HR6V1X6F+BfRS/AgMBAAGjgdYwgdMwCQYDVR0TBAIwADAdBgNVHQ4EFgQUOktp
900f19
+HQjxDXXUg8prleY9jeLKeQ4wTwYDVR0jBEgwRoAUx6zgPygZ0ZErF9sPC4+5e2Io
900f19
+UU+hI6QhMB8xCzAJBgNVBAYTAlVLMRAwDgYDVQQDEwdjb2R5LWNhggkA1QEAuwb7
900f19
+2s0wCQYDVR0SBAIwADAuBgNVHREEJzAlgiNjb2Rlbm9taWNvbi12bS0yLnRlc3Qu
900f19
+bGFsLmNpc2NvLmNvbTAOBgNVHQ8BAf8EBAMCBaAwCwYDVR0fBAQwAjAAMAsGCSqG
900f19
+SIb3DQEBCwOCAQEAvqantx2yBlM11RoFiCfi+AfSblXPdrIrHvccepV4pYc/yO6p
900f19
+t1f2dxHQb8rWH3i6cWag/EgIZx+HJQvo0rgPY1BFJsX1WnYf1/znZpkUBGbVmlJr
900f19
+t/dW1gSkNS6sPsM0Q+7HPgEv8CPDNK5eo7vU2seE0iWOkxSyVUuiCEY9ZVGaLVit
900f19
+p0C78nZ35Pdv4I+1cosmHl28+es1WI22rrnmdBpH8J1eY6WvUw2xuZHLeNVN0TzV
900f19
+Q3qq53AaCWuLOD1AjESWuUCxMZTK9DPS4JKXTK8RLyDeqOvJGjsSWp3kL0y3GaQ+
900f19
+10T1rfkKJub2+m9A9duin1fn6tHc2wSvB7m3DA==
900f19
+-----END CERTIFICATE-----
900f19
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
900f19
index 7f6b93148f45..1fc657f4d867 100644
900f19
--- a/Lib/test/test_ssl.py
900f19
+++ b/Lib/test/test_ssl.py
900f19
@@ -115,6 +115,7 @@ def data_file(*name):
900f19
 BADKEY = data_file("badkey.pem")
900f19
 NOKIACERT = data_file("nokia.pem")
900f19
 NULLBYTECERT = data_file("nullbytecert.pem")
900f19
+TALOS_INVALID_CRLDP = data_file("talos-2019-0758.pem")
900f19
 
900f19
 DHFILE = data_file("ffdh3072.pem")
900f19
 BYTES_DHFILE = os.fsencode(DHFILE)
900f19
@@ -348,6 +349,27 @@ def test_parse_cert(self):
900f19
         self.assertEqual(p['crlDistributionPoints'],
900f19
                          ('http://SVRIntl-G3-crl.verisign.com/SVRIntlG3.crl',))
900f19
 
900f19
+    def test_parse_cert_CVE_2019_5010(self):
900f19
+        p = ssl._ssl._test_decode_cert(TALOS_INVALID_CRLDP)
900f19
+        if support.verbose:
900f19
+            sys.stdout.write("\n" + pprint.pformat(p) + "\n")
900f19
+        self.assertEqual(
900f19
+            p,
900f19
+            {
900f19
+                'issuer': (
900f19
+                    (('countryName', 'UK'),), (('commonName', 'cody-ca'),)),
900f19
+                'notAfter': 'Jun 14 18:00:58 2028 GMT',
900f19
+                'notBefore': 'Jun 18 18:00:58 2018 GMT',
900f19
+                'serialNumber': '02',
900f19
+                'subject': ((('countryName', 'UK'),),
900f19
+                            (('commonName',
900f19
+                              'codenomicon-vm-2.test.lal.cisco.com'),)),
900f19
+                'subjectAltName': (
900f19
+                    ('DNS', 'codenomicon-vm-2.test.lal.cisco.com'),),
900f19
+                'version': 3
900f19
+            }
900f19
+        )
900f19
+
900f19
     def test_parse_cert_CVE_2013_4238(self):
900f19
         p = ssl._ssl._test_decode_cert(NULLBYTECERT)
900f19
         if support.verbose:
900f19
diff --git a/Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst b/Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst
900f19
new file mode 100644
900f19
index 000000000000..dffe347eec84
900f19
--- /dev/null
900f19
+++ b/Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst
900f19
@@ -0,0 +1,3 @@
900f19
+[CVE-2019-5010] Fix a NULL pointer deref in ssl module. The cert parser did
900f19
+not handle CRL distribution points with empty DP or URI correctly. A
900f19
+malicious or buggy certificate can result into segfault.
900f19
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
900f19
index 4e3352d9e661..0e720e268d93 100644
900f19
--- a/Modules/_ssl.c
900f19
+++ b/Modules/_ssl.c
900f19
@@ -1515,6 +1515,10 @@ _get_crl_dp(X509 *certificate) {
900f19
         STACK_OF(GENERAL_NAME) *gns;
900f19
 
900f19
         dp = sk_DIST_POINT_value(dps, i);
900f19
+        if (dp->distpoint == NULL) {
900f19
+            /* Ignore empty DP value, CVE-2019-5010 */
900f19
+            continue;
900f19
+        }
900f19
         gns = dp->distpoint->name.fullname;
900f19
 
900f19
         for (j=0; j < sk_GENERAL_NAME_num(gns); j++) {