mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-07-16 04:17:25 +00:00
Code Issues Projects Releases Wiki Activity

strongswan: Fix CVE-2026-35328

Browse Source 
Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/56c7f0d13dffcfebf4255470e375234144d28134]

Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Nitin Wankhade
2026-06-09 14:54:02 +05:30
committed by Anuj Mittal
parent b0c2c648a1
commit 25d2ef6ebb
2 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-networking/recipes-support/strongswan/strongswan/tls-server-Prevent-infinite-loop-if-supported-versio.patch
+42
View File
@@ -0,0 +1,42 @@
From: Tobias Brunner <tobias@strongswan.org>
Date: Wed, 25 Mar 2026 10:17:46 +0100
Subject: tls-server: Prevent infinite loop if supported versions are too
short
If the extension doesn't contain a multiple of two bytes, the previous
code would get stuck in an infinite loop as `remaining()` continued to
return TRUE while `read_uint16()` failed to parse a value. Initiating
several connections with such an extension allows a DoS attack as no
threads would eventually be available to handle packets/events.
Fixes: 7fbe2e27ecf6 ("tls-server: TLS 1.3 support for TLS server implementation")
Fixes: CVE-2026-35328
CVE: CVE-2026-35328
Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/56c7f0d13dffcfebf4255470e375234144d28134]
Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
===
diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c
index 3ad9fd2..7b2238e 100644
--- a/src/libtls/tls_server.c
+++ b/src/libtls/tls_server.c
@@ -471,15 +471,12 @@ static status_t process_client_hello(private_tls_server_t *this,
bio_reader_t *client_versions;
client_versions = bio_reader_create(versions);
- while (client_versions->remaining(client_versions))
+ while (client_versions->read_uint16(client_versions, &version))
{
- if (client_versions->read_uint16(client_versions, &version))
+ if (this->tls->set_version(this->tls, version, version))
{
- if (this->tls->set_version(this->tls, version, version))
- {
- this->client_version = version;
- break;
- }
+ this->client_version = version;
+ break;
}
}
client_versions->destroy(client_versions);
meta-networking/recipes-support/strongswan/strongswan_5.9.14.bb
+1
View File
@@ -12,6 +12,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2025-62291.patch \
file://CVE-2026-25075.patch \
file://CVE-2026-35334.patch \
file://tls-server-Prevent-infinite-loop-if-supported-versio.patch \
"
SRC_URI[sha256sum] = "728027ddda4cb34c67c4cec97d3ddb8c274edfbabdaeecf7e74693b54fc33678"