mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-15 04:17:29 +00:00
Code Issues Projects Releases Wiki Activity

strongswan: patch CVE-2026-78124

Browse Source 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78124

[1]https://download.strongswan.org/security/CVE-2026-78124/strongswan-5.0.2-6.0.7_openssl_pkcs7_certs_leak.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78124).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit dd0ba33ed2)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
This commit is contained in:
Ankur Tyagi committed 2026-10-13 21:32:54 +13:00
1 parent 8ccc60a8be
commit a6397902ba
2 files changed
+35
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch
+34
View File
@@ -0,0 +1,34 @@
From 36ce778a76b4b912699a52cf1109394fce109c83 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Mon, 15 Jun 2026 16:02:01 +0200
Subject: [PATCH] openssl: Fix memory leaks after enumerating certificates in
PKCS#7 container
This can be triggered via IKEv1.
Fixes: 04884be3b5f7 ("Implement openssl PKCS#7 certficiate enumeration")
Fixes: CVE-2026-78124
CVE: CVE-2026-78124
Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/49bf0725fa61198d1e29d5b4c2651c9190b2c10c]
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
index b15c8d7..cefe1ae 100644
--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
+++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
@@ -132,6 +132,10 @@ typedef struct {
METHOD(enumerator_t, cert_destroy, void,
cert_enumerator_t *this)
{
+ if (this->certs)
+ {
+ sk_X509_pop_free(this->certs, X509_free);
+ }
DESTROY_IF(this->cert);
free(this);
}
meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+1
View File
@@ -10,6 +10,7 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss',
SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78123.patch \
file://CVE-2026-78124.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"