Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #946555

Bug#922984: xml-security-c: ECDSA XML signature generation segmentation fault

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: xml-security-c
Version: 1.7.2-2
Severity: important
Tags: patch
User: ubuntu-devel@lists.ubuntu.com
Usertags: origin-ubuntu disco ubuntu-patch

Dear Maintainer,

We found a bug in Apache Santuario C, related to ECDSA signature
generation, few years ego. We provide the fix to the Apache team, and
Scott Cantor kindly accepted the fix in the project. How ever the fix
was introduced in series 2.x of the the library.

The fix we provide was for the version 1.7.x (xml-security-c17) found in
Ubuntu 14.04 and looks like Ubuntu 18.04 is still including a version
from series 1.7.x. The commit with the fix for the bug can be found here:

http://svn.apache.org/viewvc/santuario/xml-security-cpp/trunk/xsec/utils/XSECSafeBuffer.cpp?r1=1806212&r2=1807280&diff_format=h

In Ubuntu, the attached patch was applied to achieve the following:

  * debian/patches/99-xsecsafebuffer.patch: Fix undefined behavior in
    XSECSafeBuffer that affect ECDSA signature generation. This fix was
    introduced in serie 2.x, but it was not backported to serie 1.7.x.

Thanks for considering the patch.

-- System Information:
Debian Release: jessie/sid
  APT prefers trusty-updates
  APT policy: (500, 'trusty-updates'), (500, 'trusty-security'), (500, 'trusty'), (100, 'trusty-backports')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.4.0-130-generic (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#922984: xml-security-c: ECDSA XML signature generation segmentation fault Alejandro Claro <alejandro.claro@smartmatic.com> - 2019-02-22 16:50 +0100
  Bug#922984: xml-security-c: ECDSA XML signature generation segmentation fault wferi@niif.hu - 2019-02-24 14:30 +0100

csiph-web