Please sign in to comment.
[libfko] fix double free bug in SPA parser
This commit fixes a double free condition discovered through the new python SPA payload fuzzer. This bug could be triggered in fwknopd with a malicious SPA payload but only when GnuPG is used. When Rijndael is used for SPA packet encryption, this bug cannot be triggered due to an length/format check towards the end of _rijndael_decrypt(). It should be noted that only a person in possession of the correct encryption and authentication GnuPG keys could trigger this bug.
- Loading branch information...