Bug 985428 – p11-kit: potential interpretation conflict in PEM/DER decoding

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 985428 - p11-kit: potential interpretation conflict in PEM/DER decoding

Summary:	p11-kit: potential interpretation conflict in PEM/DER decoding

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	p11-kit (Show other bugs)
Sub Component:
Version:	7.1
Hardware:	Unspecified Unspecified

Priority	unspecified Severity unspecified
Target Milestone:	pre-dev-freeze
Target Release:	---
Assigned To:	Daiki Ueno
QA Contact:	Hubert Kario
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:	983512
	Show dependency tree / graph

Reported:	2013-07-17 09:13 EDT by Florian Weimer
Modified:	2017-08-01 12:52 EDT (History)
CC List:	4 users (show)

See Also:
Fixed In Version:	p11-kit-0.23.5-1.el7
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-08-01 12:52:09 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
FreeDesktop.org	92063	None	None	None	Never
Red Hat Product Errata	RHEA-2017:1981	normal	SHIPPED_LIVE	p11-kit bug fix update	2017-08-01 13:58:17 EDT

Groups: None (edit)

Description Florian Weimer 2013-07-17 09:13:38 EDT

It seems that the code first tries to parse a certificate as PEM, discarding everything before the "-----BEGIN" marker.  If it's possible to create a DER-encoded certificate that doesn't have a NUL character before the marker, then p11-kit might interpret that certificate differently from the rest of the world.  DER parsing seems more restrictive, so it might make sense to try it first.

Comment 2 Stef Walter 2013-07-17 12:51:39 EDT

Makes sense, although may lower the loading performance.

Still, this requires the administrator manually add contrived certificates. So moving this to future work, rather than making changes in the stable branch.

Hope that's okay.

Comment 5 Stef Walter 2014-08-07 03:33:45 EDT

This needs work in Fedora before updating it in RHEL, bumping to RHEL 7.2

Comment 6 Daiki Ueno 2016-09-27 05:51:14 EDT

A patch and test case are attached to the upstream bug.

Comment 7 Stef Walter 2016-10-03 09:20:30 EDT

Reviewed upstream.

Comment 11 errata-xmlrpc 2017-08-01 12:52:09 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2017:1981

Note You need to log in before you can comment on or make changes to this bug.