Skip to content

release 0.6.2.7

Choose a tag to compare

View all tags
@zandbelt zandbelt released this 26 Jun 14:28
· 30 commits to version-0.6.2.x since this release
v0.6.2.7
10af891

Security

  • Additional hardening from a security audit of concatkdf.c / jwk.c / jws.c / jwe.c:
    • Avoid a NULL dereference of the optional cjose_err in ECDH-ES ConcatKDF otherinfo creation; adds a regression test
    • Check the per-block hash allocation in cjose_concatkdf_derive
    • NUL-terminate the JWK kid without over-reading the source buffer
    • Cleanse the JWS HMAC digest buffer before reallocation
    • Make the JWE content-cipher (enc) dispatch mutually exclusive
    • Cleanse the per-iteration digest buffer (derived key material) in cjose_concatkdf_derive
    • Cleanse the base64url-encoded private key material on the EC and oct JWK export paths
    • Cleanse the decrypted JWE plaintext buffer on release and reuse (incl. unauthenticated plaintext left behind by a failed AES-GCM tag check)
    • Validate the caller-supplied IV length on the JWE encrypt path (12 bytes for AES-GCM, 16 for AES-CBC-HMAC), mirroring the decrypt-side checks; adds a regression test
    • Require the RSA-decrypted CEK length to match the enc keysize and the encrypted key segment to be exactly the modulus size; adds a regression test
    • Use size_t for the dot-scan offsets in cjose_jws_import (truncated for >2GiB input)
    • Check the result of json_object_set_new in cjose_header_set / cjose_header_set_raw
    • Bounds-check the error-message table in cjose_err_message and render OpenSSL error strings into a thread-local buffer instead of the shared static one
    • Validate the JWS ECDSA signature length against the key's curve before splitting it into R || S, rejecting non-canonical (e.g. trailing-byte-padded) signatures that the sig_len / 2 split would otherwise accept (RFC 7518 section 3.4); adds a regression test
    • Avoid an unsigned underflow of the remaining-bytes counter on the final block of cjose_concatkdf_derive
    • Make the JWE CEK key-size (enc) selection mutually exclusive and reject an unrecognized enc instead of deriving a zero-length CEK

The RPM packages below are signed with the following RSA PGP key:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBGh53lgBCADCyoOkfnE5h5rBLlf02oFpI/z2vUXK5W4T56xnNPu0/iIOxbBk
YX9rSypZFhfjv28lhGgelWEg28Ab/Yxs6l0obCgDEuFUDQ5Dv+N+YSMy67vtLwYW
9LM5p9fMN9bXOa62PwvtzRzh+xRyRBcIfMacGJC+SqUK6QhzC0lNwCsr1OaWjzon
mkaodwrloNMxEZVvFn63PvuQDZ3wwQty+0XpYiiChMssGBn6nmPDQJ7pDtQDkhfD
Z5FKY6K7AQJ4fneiVCLGngPBwTXBGcfWa+Y0HCS2ghQwDO6jYXd5GjowVDTjfMK3
QJ3e26Ox9X3V0Fl04R1i5EthEkAWGfy1lksvABEBAAG0HU9wZW5JREMgPHN1cHBv
cnRAb3BlbmlkYy5jb20+iQFRBBMBCgA7FiEEFdjWJA1IGDkAITSxnyZY1L0OSOMF
Amh53lgCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQnyZY1L0OSONG
Jgf+II0wG96R0g28Kp+R4AYzSdX0CEqr6OhwHHw4cFpLsHxZNhojo7I4OnLKEdfc
lFl37rE+hG3QpzD/b4S/fpPjd4hcLkguBQxtdxqZZVAIT8HWbveHRkI8MNnjOPwv
Hy6jBncMs1IT/URV2si/Q34+PLo8tvo/lXNa16svVl2DoYXO8MCszgCE1bx055EF
XPh4Teu5Y4OLHECSicMxrmN746dAD121zy4bLLx9mZ0erhLjvkj1vkFmlHFKyvwY
/pbSqXs9hW/wweW1oQ/xEIJWWS71PeoutUBjr0WC4sILnR5PBPZplgNh297Qex6g
qaW3io0tCH9KxU1tXYn/iL/hbQ==
=mlOy
-----END PGP PUBLIC KEY BLOCK-----
Assets 23
Loading