Bug 1228604 (CVE-2015-1790)

Summary: CVE-2015-1790 OpenSSL: PKCS7 crash with missing EnvelopedContent
Product: [Other] Security Response Reporter: Huzaifa S. Sidhpurwala <huzaifas>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: cdewolf, csutherl, dandread, darran.lofthouse, dknox, jason.greene, jawilson, jclere, jdoyle, lgao, mbabacek, myarboro, pgier, pslavice, rsvoboda, security-response-team, tmraz, twalsh, vtunka, weli
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. An attacker able to make an application using OpenSSL verify, decrypt, or parse a specially crafted PKCS#7 input could cause that application to crash. TLS/SSL clients and servers using OpenSSL were not affected by this flaw.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:41:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1228618, 1228619, 1228620, 1228621, 1231051, 1234214    
Bug Blocks: 1227577    
Attachments:
Description Flags
Proposed patch for CVE-2015-1790 none

Description Huzaifa S. Sidhpurwala 2015-06-05 10:16:13 UTC 
The following was reported by OpenSSL upstream:

The PKCS#7 parsing code does not handle missing inner EncryptedContent correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing.

Applications that decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2b
OpenSSL 1.0.1 users should upgrade to 1.0.1n
OpenSSL 1.0.0 users should upgrade to 1.0.0s
OpenSSL 0.9.8 users should upgrade to 0.9.8zg

This issue was reported to OpenSSL on 18th April 2015 by  Michal Zalewski (Google). The fix was developed by Emilia Käsper of the OpenSSL development team.


Acknowledgements:

Red Hat would like to thank the OpenSSL project for reporting this issue.
Comment 1 Huzaifa S. Sidhpurwala 2015-06-05 10:29:20 UTC 
Created attachment 1035152 [details]
Proposed patch for CVE-2015-1790
Comment 4 Huzaifa S. Sidhpurwala 2015-06-12 04:15:53 UTC 
Public via:

https://www.openssl.org/news/secadv_20150611.txt

Upstream commits:

OpenSSL-1.0.1:
https://github.com/openssl/openssl/commit/5fbc59cac60db4d7c3172152b8bdafe0c675fabd

OpenSSL-0.9.8:
https://github.com/openssl/openssl/commit/582f1f41d49b5bf5ceaca241356d5f9c986f230f
Comment 5 Huzaifa S. Sidhpurwala 2015-06-12 05:55:59 UTC 
Created openssl tracking bugs for this issue:

Affects: fedora-all [bug 1231051]
Comment 6 errata-xmlrpc 2015-06-15 20:49:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2015:1115 https://rhn.redhat.com/errata/RHSA-2015-1115.html
Comment 7 Huzaifa S. Sidhpurwala 2015-06-16 01:35:49 UTC 
Statement:

(none)
Comment 8 Fedora Update System 2015-06-21 00:19:09 UTC 
openssl-1.0.1k-10.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2015-06-24 15:57:36 UTC 
openssl-1.0.1k-10.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 errata-xmlrpc 2015-06-30 04:43:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2015:1197 https://rhn.redhat.com/errata/RHSA-2015-1197.html