Bug 1228604 (CVE-2015-1790) - CVE-2015-1790 OpenSSL: PKCS7 crash with missing EnvelopedContent
Summary: CVE-2015-1790 OpenSSL: PKCS7 crash with missing EnvelopedContent
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-1790
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20150611,repor...
Depends On: 1228618 1228619 1228620 1228621 1231051 1234214
Blocks: 1227577
TreeView+ depends on / blocked
 
Reported: 2015-06-05 10:16 UTC by Huzaifa S. Sidhpurwala
Modified: 2019-07-11 09:19 UTC (History)
20 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. An attacker able to make an application using OpenSSL verify, decrypt, or parse a specially crafted PKCS#7 input could cause that application to crash. TLS/SSL clients and servers using OpenSSL were not affected by this flaw.
Clone Of:
Environment:
Last Closed: 2019-06-08 02:41:39 UTC


Attachments (Terms of Use)
Proposed patch for CVE-2015-1790 (2.46 KB, patch)
2015-06-05 10:29 UTC, Huzaifa S. Sidhpurwala
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1115 normal SHIPPED_LIVE Moderate: openssl security update 2015-06-16 00:48:46 UTC
Red Hat Product Errata RHSA-2015:1197 normal SHIPPED_LIVE Moderate: openssl security update 2015-06-30 08:42:32 UTC

Description Huzaifa S. Sidhpurwala 2015-06-05 10:16:13 UTC
The following was reported by OpenSSL upstream:

The PKCS#7 parsing code does not handle missing inner EncryptedContent correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with missing content and trigger a NULL pointer dereference on parsing.

Applications that decrypt PKCS#7 data or otherwise parse PKCS#7 structures from untrusted sources are affected. OpenSSL clients and servers are not affected.

This issue affects all current OpenSSL versions: 1.0.2, 1.0.1, 1.0.0 and 0.9.8.

OpenSSL 1.0.2 users should upgrade to 1.0.2b
OpenSSL 1.0.1 users should upgrade to 1.0.1n
OpenSSL 1.0.0 users should upgrade to 1.0.0s
OpenSSL 0.9.8 users should upgrade to 0.9.8zg

This issue was reported to OpenSSL on 18th April 2015 by  Michal Zalewski (Google). The fix was developed by Emilia Käsper of the OpenSSL development team.


Acknowledgements:

Red Hat would like to thank the OpenSSL project for reporting this issue.

Comment 1 Huzaifa S. Sidhpurwala 2015-06-05 10:29:20 UTC
Created attachment 1035152 [details]
Proposed patch for CVE-2015-1790

Comment 5 Huzaifa S. Sidhpurwala 2015-06-12 05:55:59 UTC
Created openssl tracking bugs for this issue:

Affects: fedora-all [bug 1231051]

Comment 6 errata-xmlrpc 2015-06-15 20:49:17 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2015:1115 https://rhn.redhat.com/errata/RHSA-2015-1115.html

Comment 7 Huzaifa S. Sidhpurwala 2015-06-16 01:35:49 UTC
Statement:

(none)

Comment 8 Fedora Update System 2015-06-21 00:19:09 UTC
openssl-1.0.1k-10.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2015-06-24 15:57:36 UTC
openssl-1.0.1k-10.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 errata-xmlrpc 2015-06-30 04:43:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2015:1197 https://rhn.redhat.com/errata/RHSA-2015-1197.html


Note You need to log in before you can comment on or make changes to this bug.