Date: Thu, 18 Jan 2024 17:35:25 +0000 From: Shawn Webb <shawn.webb@hardenedbsd.org> To: Jessica Clarke <jrtc27@freebsd.org> Cc: Cy Schubert <cy@freebsd.org>, "src-committers@freebsd.org" <src-committers@freebsd.org>, "dev-commits-src-all@freebsd.org" <dev-commits-src-all@freebsd.org>, "dev-commits-src-main@freebsd.org" <dev-commits-src-main@freebsd.org> Subject: Re: git: 0990136ed175 - main - kerberos5: Mitigate the possibility of using an old libcrypto Message-ID: <kicsvwuaptgfe2y5krflx35smstai6siea4rl7ycyrqdkawrxt@rqobtpgi257u> In-Reply-To: <D89E55DF-846D-44FA-9287-0FFED7B08C2C@freebsd.org> References: <202401181523.40IFNvXI077592@gitrepo.freebsd.org> <D89E55DF-846D-44FA-9287-0FFED7B08C2C@freebsd.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--t4jbi7nbtzycxckb Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jan 18, 2024 at 05:29:47PM +0000, Jessica Clarke wrote: > On 18 Jan 2024, at 15:23, Cy Schubert <cy@FreeBSD.org> wrote: > >=20 > > The branch main has been updated by cy: > >=20 > > URL: https://cgit.FreeBSD.org/src/commit/?id=3D0990136ed1753ac7837206f9= c5f4b83ccff6c405 > >=20 > > commit 0990136ed1753ac7837206f9c5f4b83ccff6c405 > > Author: Cy Schubert <cy@FreeBSD.org> > > AuthorDate: 2024-01-18 08:22:20 +0000 > > Commit: Cy Schubert <cy@FreeBSD.org> > > CommitDate: 2024-01-18 15:12:14 +0000 > >=20 > > kerberos5: Mitigate the possibility of using an old libcrypto > >=20 > > By using the full library name (libcrypto.so.30) we avoid the exposu= re > > of using an old, possibly vulnerable, library. > >=20 > > Reported by: jrtc27 > > MFC after: 3 days > > X-MFC with: 476d63e091c2 > > Fixes: 476d63e091c2 > > --- > > kerberos5/lib/libroken/fbsd_ossl_provider_load.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > >=20 > > diff --git a/kerberos5/lib/libroken/fbsd_ossl_provider_load.c b/kerbero= s5/lib/libroken/fbsd_ossl_provider_load.c > > index 497b32124f96..2328041bc166 100644 > > --- a/kerberos5/lib/libroken/fbsd_ossl_provider_load.c > > +++ b/kerberos5/lib/libroken/fbsd_ossl_provider_load.c > > @@ -5,6 +5,7 @@ > > #include <openssl/provider.h> > >=20 > > #if defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >=3D 3) > > +#define CRYPTO_LIBRARY "/lib/libcrypto.so.30" >=20 > This still assumes the native ABI is in use, i.e. doesn=E2=80=99t account= for > libcompat. Can we please just drop the directory, or if it=E2=80=99s real= ly > needed for some reason at least handle the libcompat case? Using relative paths might carry a potential security risk if the LD_LIBRARY_PATH environment variable is set to an attacker-controlled directory. Thanks, --=20 Shawn Webb Cofounder / Security Engineer HardenedBSD https://git.hardenedbsd.org/hardenedbsd/pubkeys/-/raw/master/Shawn_Webb/03A= 4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc --t4jbi7nbtzycxckb Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEA6TL67gupaZ9nzhT/y5nonf44foFAmWpYVAACgkQ/y5nonf4 4fqryA/9F2cLPzaDGGQ19AbZImSAFplCWJkidv9k+QWZLX9lriXdrdz3qqg+Yu6X bxbETNHo0PjtAZd2hJHp+NdHR497+R+1t0KqmGvRvq0PSuXR/ze68XUjrUS3RfUJ 8fMBOLbdkyXNEeFw5YkjDIGAmhAaCqBEk60dFa8DFfEygbfEZXaws1L4tPsW86B0 sfiPdH57OBEzaiSraK9i+2v9gOPmd5xEuYQ/FK1+xeQ9g2IykibjrO8CfM8J3//4 MoLkqQ+fnaUyaufBg0cEekO0yQhtgfqMrYuB6DjD1NpwWRpKuDnkynflbmrgO7hg SleqZc01cJ1Fa7fCqO+Ds+4l/xVKJ781M7PWbowUtkJQmeUnNVJ4boDPfdIY6v0x GRLgZin1AeWCDRIoV2vR0JqTLf+AVaeeD7iFQnZVR9riWRiHrBWZ0tLoqf1Wk3Sb 4MzEXp/EVhI+aKQ2Cshl1tmNwTncbJ8mR05tjIu5FRSnmJd9rMO/du0ADnGzPDAT 9jB5aw1ht8yIYVay4KWgOt/O4sAVtI6eq8gZOvA6ITP7Z/Htnh3RDC2EhvBdtM90 djUFwwqboMqLDPWw51yO2poicmr88E/kFdt0z4MPoHY1lBipyCGqJ2Gg3ZdTdeqo gnnfAUxaVwrHF3sk/rwpsQtjtI1hnV/S3/RqgVvU2eQOhg+/BK8= =oMkh -----END PGP SIGNATURE----- --t4jbi7nbtzycxckb--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?kicsvwuaptgfe2y5krflx35smstai6siea4rl7ycyrqdkawrxt>