Hi Nicolas,
On Tue, Sep 07, 2021 at 10:05:08AM -0400, Nicolas Mora wrote:
> Package: glewlwyd
> Version: 2.5.2-2
> Severity: important
> Tags: patch security
> X-Debbugs-Cc: Debian Security Team <t...@security.debian.org>
>
>
>
>
> -- System Information:
> Debian Release: 11.0
> APT prefers stable-security
> APT policy: (500, 'stable-security'), (500, 'proposed-updates'), (500,
> 'stable')
> Architecture: amd64 (x86_64)
>
> Kernel: Linux 5.10.0-8-amd64 (SMP w/4 CPU threads)
> Locale: LANG=fr_CA.UTF-8, LC_CTYPE=fr_CA.UTF-8 (charmap=UTF-8), LANGUAGE not
> set
> Shell: /bin/sh linked to /usr/bin/dash
> Init: systemd (via /run/systemd/system)
> LSM: AppArmor: enabled
>
> Versions of packages glewlwyd depends on:
> ii dbconfig-pgsql 2.0.19
> ii debconf [debconf-2.0] 1.5.77
> pn glewlwyd-common <none>
> ii init-system-helpers 1.60
> ii libc6 2.31-13
> ii libcbor0 0.5.0+dfsg-2
> ii libconfig9 1.5-0.4
> ii libcrypt1 1:4.4.18-4
> ii libgnutls30 3.7.1-5
> pn libhoel1.4 <none>
> pn libiddawc0.9 <none>
> ii libjansson4 2.13.1-1.1
> ii libldap-2.4-2 2.4.57+dfsg-3
> ii libnettle8 3.7.3-1
> ii liboath0 2.6.6-3
> pn liborcania2.1 <none>
> pn librhonabwy0.9 <none>
> pn libulfius2.7 <none>
> pn libyder2.0 <none>
> ii lsb-base 11.1.0
> ii sqlite3 3.34.1-3
> ii ucf 3.0043
> ii zlib1g 1:1.2.11.dfsg-2
>
> glewlwyd recommends no packages.
>
> Versions of packages glewlwyd suggests:
> --- a/src/scheme/webauthn.c
> +++ b/src/scheme/webauthn.c
> @@ -1530,7 +1530,7 @@
> gnutls_pubkey_t pubkey = NULL;
> gnutls_x509_crt_t cert = NULL;
> gnutls_datum_t cert_dat, data, signature, cert_issued_by;
> - unsigned char data_signed[200], client_data_hash[32], cert_export[32],
> cert_export_b64[64];
> + unsigned char * data_signed = NULL, client_data_hash[32], cert_export[32],
> cert_export_b64[64];
> size_t data_signed_offset = 0, client_data_hash_len = 32, cert_export_len
> = 32, cert_export_b64_len = 0;
>
> if (j_error != NULL) {
> @@ -1619,6 +1619,12 @@
> break;
> }
>
> + if ((data_signed =
> o_malloc(rpid_hash_len+client_data_hash_len+credential_id_len+cert_x_len+cert_y_len+2))
> == NULL) {
> + y_log_message(Y_LOG_LEVEL_DEBUG, "check_attestation_fido_u2f - Error
> allocating data_signed");
> + json_array_append_new(j_error, json_string("Internal error"));
> + break;
> + }
> +
> // Build bytestring to verify signature
> data_signed[0] = 0x0;
> data_signed_offset = 1;
> @@ -1653,6 +1659,7 @@
> }
>
> } while (0);
> + o_free(data_signed);
>
> if (json_array_size(j_error)) {
> j_return = json_pack("{sisO}", "result", G_ERROR_PARAM, "error",
> j_error);
Can you report the issue upstream?
Regards,
Salvatore
