release 0.6.2.8

Security

• Enforce the RFC 7518 section 3.3 minimum 2048-bit RSA modulus in cjose_jwk_create_RSA_random and cjose_jwk_create_RSA_spec; note that sub-2048-bit RSA keys are now rejected at creation/import time (#36, ported from cisco#136); thanks @kunqn
• Additional hardening and correctness fixes from a follow-up bug-hunt audit:
  • Free the RSA factor/CRT BIGNUMs and reject an incomplete private-key parameter set on JWK import (OpenSSL >= 1.1) instead of silently dropping and leaking them; adds a regression test
  • Take the JWS import copy-helper length as size_t so the (deliberately size_t) compact serialization dot-scan offsets are no longer truncated back through int
  • Parse the shared "unprotected" header in cjose_jwe_import_json (it was silently dropped), restoring symmetry with cjose_jwe_export_json
  • Decode/encode a top-level scalar JSON value in cjose_header_set_raw / cjose_header_get_raw (JSON_DECODE_ANY / JSON_ENCODE_ANY), so e.g. an RFC 7797 "b64":false header round-trips
  • Propagate _cjose_jws_build_cser failure out of cjose_jws_export (it returned true with a possibly-NULL *compact) and set err when the serialization components are missing
  • Clear err on a successful alg:"none" cjose_jws_import so it is not left holding the INVALID_ARG recorded while rejecting none as a signing algorithm
  • Free the RSA BIGNUMs if RSA_set0_key is refused, and free the RSA in _RSA_new when the JWK allocation fails, closing two out-of-memory leaks on the RSA key path (OpenSSL >= 1.1)
  • Free the temporary string in _cjose_json_stringn when json_string fails (jansson <= 2.6)
  • Guard the base64 encode size calculation against size_t overflow, matching the decode side
  • Reject an empty "crit" header list in _cjose_header_validate_crit (RFC 7515 section 4.1.11)
  • Skip the zeroing memset in _cjose_jwe_malloc for a zero-byte request (memset(NULL, 0, 0) is undefined behaviour if malloc(0) returned NULL)
  • Drop a duplicated enc_iv base64url conversion in _cjose_convert_to_base64 (no-op cleanup)
  • Size the AES-CBC plaintext buffer in size_t to avoid a signed-int overflow near INT_MAX
  • Drop a dead store of the end pointer after the final write in concatkdf otherinfo assembly
  • Run the base64 decode length sanity check before publishing the output pointer, so its (currently unreachable) failure path cannot leave *output dangling at freed memory
  • Lower-bound the kty argument in cjose_jwk_name_for_kty so a value below CJOSE_JWK_KTY_RSA cannot index the key-type name table out of bounds
  • Correct the documented contract of cjose_const_memcmp (equal/not-equal, not ordered) and note that _cjose_strndup copies exactly len bytes (it is not POSIX strndup)

Bugfixes

• Initialize the decoded buffer lengths up front in the JWK import error paths; reading them uninitialized broke the clang -Werror build since v0.6.2.6 (#32); thanks @kraj
• Use a portable thread-local storage specifier in error.c so the OpenSSL error buffer builds with MSVC.

The RPM packages below are signed with the following RSA PGP key:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBGh53lgBCADCyoOkfnE5h5rBLlf02oFpI/z2vUXK5W4T56xnNPu0/iIOxbBk
YX9rSypZFhfjv28lhGgelWEg28Ab/Yxs6l0obCgDEuFUDQ5Dv+N+YSMy67vtLwYW
9LM5p9fMN9bXOa62PwvtzRzh+xRyRBcIfMacGJC+SqUK6QhzC0lNwCsr1OaWjzon
mkaodwrloNMxEZVvFn63PvuQDZ3wwQty+0XpYiiChMssGBn6nmPDQJ7pDtQDkhfD
Z5FKY6K7AQJ4fneiVCLGngPBwTXBGcfWa+Y0HCS2ghQwDO6jYXd5GjowVDTjfMK3
QJ3e26Ox9X3V0Fl04R1i5EthEkAWGfy1lksvABEBAAG0HU9wZW5JREMgPHN1cHBv
cnRAb3BlbmlkYy5jb20+iQFRBBMBCgA7FiEEFdjWJA1IGDkAITSxnyZY1L0OSOMF
Amh53lgCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQnyZY1L0OSONG
Jgf+II0wG96R0g28Kp+R4AYzSdX0CEqr6OhwHHw4cFpLsHxZNhojo7I4OnLKEdfc
lFl37rE+hG3QpzD/b4S/fpPjd4hcLkguBQxtdxqZZVAIT8HWbveHRkI8MNnjOPwv
Hy6jBncMs1IT/URV2si/Q34+PLo8tvo/lXNa16svVl2DoYXO8MCszgCE1bx055EF
XPh4Teu5Y4OLHECSicMxrmN746dAD121zy4bLLx9mZ0erhLjvkj1vkFmlHFKyvwY
/pbSqXs9hW/wweW1oQ/xEIJWWS71PeoutUBjr0WC4sILnR5PBPZplgNh297Qex6g
qaW3io0tCH9KxU1tXYn/iL/hbQ==
=mlOy
-----END PGP PUBLIC KEY BLOCK-----