summaryrefslogtreecommitdiffstats
path: root/meta-oe
diff options
context:
space:
mode:
authorGyorgy Sarvari <skandigraun@gmail.com>2026-04-06 20:32:55 +0200
committerAnuj Mittal <anuj.mittal@oss.qualcomm.com>2026-04-24 21:13:20 +0530
commitb35ad4114410c87708c7dcea39f7357639c184af (patch)
treef673e9d7c156b23009162af99dda9626798aa0cf /meta-oe
parent70a903c88847b79ba10fbc5bd40bd537261d77e2 (diff)
downloadmeta-openembedded-b35ad4114410c87708c7dcea39f7357639c184af.tar.gz
botan: patch CVE-2026-32884
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-32884 The backported patch was selected based on the security.rst[1] file of the project, that mentions the date of the fix. When looked through the commits from that date, picked the one that's description matches the CVE description. The included test passed successfully (along with the other tests). [1]: https://github.com/randombit/botan/blob/master/doc/security.rst Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Diffstat (limited to 'meta-oe')
-rw-r--r--meta-oe/recipes-crypto/botan/botan/CVE-2026-32884.patch171
-rw-r--r--meta-oe/recipes-crypto/botan/botan_3.10.0.bb1
2 files changed, 172 insertions, 0 deletions
diff --git a/meta-oe/recipes-crypto/botan/botan/CVE-2026-32884.patch b/meta-oe/recipes-crypto/botan/botan/CVE-2026-32884.patch
new file mode 100644
index 0000000000..f207ee2caa
--- /dev/null
+++ b/meta-oe/recipes-crypto/botan/botan/CVE-2026-32884.patch
@@ -0,0 +1,171 @@
1From cbc8b341ea4b38c388e89682b86da107a9fdc38c Mon Sep 17 00:00:00 2001
2From: Jack Lloyd <jack@randombit.net>
3Date: Sun, 15 Mar 2026 11:17:22 -0400
4Subject: [PATCH] Fix name constraint DNS check when falling back to CN
5
6When verifying name constraints which restrict the set of allowed DNS names, the
7logic would first check the Subject Alternative Name if available, but if the
8SAN is absent then it would check the CN field of the issued name since that is
9a common fallback for DNS names when the SAN is missing.
10
11However this check failed to properly canonicalize the potential DNS name in the
12CN, allowing a mis-issued cert with a mixed-case CN field and absent SAN to
13bypass any imposed excludedSubtrees rules.
14
15CVE: CVE-2026-32884
16Upstream-Status: Backport [https://github.com/randombit/botan/commit/db8baebd92bded036da6faf8bf3c324b67de9cf4]
17Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
18---
19 src/lib/x509/name_constraint.cpp | 16 +++++++---
20 .../Invalid_DNS_Excluded_Mixed_Case_CN.crt | 19 ++++++++++++
21 .../Root_DNS_Excluded_Mixed_Case_CN.crt | 19 ++++++++++++
22 src/tests/test_name_constraint.cpp | 29 +++++++++++++++++++
23 4 files changed, 79 insertions(+), 4 deletions(-)
24 create mode 100644 src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt
25 create mode 100644 src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt
26
27diff --git a/src/lib/x509/name_constraint.cpp b/src/lib/x509/name_constraint.cpp
28index e767624..8708b95 100644
29--- a/src/lib/x509/name_constraint.cpp
30+++ b/src/lib/x509/name_constraint.cpp
31@@ -19,6 +19,14 @@ namespace Botan {
32
33 class DER_Encoder;
34
35+namespace {
36+
37+std::string canonicalize_dns_name(std::string_view name) {
38+ return tolower_string(name);
39+}
40+
41+} // namespace
42+
43 std::string GeneralName::type() const {
44 switch(m_type) {
45 case NameType::Unknown:
46@@ -75,7 +83,7 @@ void GeneralName::decode_from(BER_Decoder& ber) {
47 m_type = NameType::DNS;
48 // Store it in case insensitive form so we don't have to do it
49 // again while matching
50- m_name.emplace<DNS_IDX>(tolower_string(ASN1::to_string(obj)));
51+ m_name.emplace<DNS_IDX>(canonicalize_dns_name(ASN1::to_string(obj)));
52 } else if(obj.is_a(6, ASN1_Class::ContextSpecific)) {
53 m_type = NameType::URI;
54 m_name.emplace<URI_IDX>(ASN1::to_string(obj));
55@@ -174,7 +182,7 @@ GeneralName::MatchResult GeneralName::matches(const X509_Certificate& cert) cons
56 // Check CN instead...
57 for(const std::string& cn : dn.get_attribute("CN")) {
58 if(!string_to_ipv4(cn).has_value()) {
59- score.add(matches_dns(cn, constraint));
60+ score.add(matches_dns(canonicalize_dns_name(cn), constraint));
61 }
62 }
63 }
64@@ -421,7 +429,7 @@ bool NameConstraints::is_permitted(const X509_Certificate& cert, bool reject_unk
65 return false;
66 }
67 } else {
68- if(!is_permitted_dns_name(cn)) {
69+ if(!is_permitted_dns_name(canonicalize_dns_name(cn))) {
70 return false;
71 }
72 }
73@@ -540,7 +548,7 @@ bool NameConstraints::is_excluded(const X509_Certificate& cert, bool reject_unkn
74 return true;
75 }
76 } else {
77- if(is_excluded_dns_name(cn)) {
78+ if(is_excluded_dns_name(canonicalize_dns_name(cn))) {
79 return true;
80 }
81 }
82diff --git a/src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt b/src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt
83new file mode 100644
84index 0000000..fe2c773
85--- /dev/null
86+++ b/src/tests/data/x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt
87@@ -0,0 +1,19 @@
88+-----BEGIN CERTIFICATE-----
89+MIIDCTCCAfGgAwIBAgIUAbjRT6B+WHVf1Wo9JdFHlHegF1cwDQYJKoZIhvcNAQEL
90+BQAwFzEVMBMGA1UEAwwMVGVzdCBSb290IENBMB4XDTI2MDMxNTE0NTM1MloXDTI3
91+MDMxNTE0NTM1MlowFzEVMBMGA1UEAwwMU3ViLkVWSUwuQ09NMIIBIjANBgkqhkiG
92+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsn1rve+kuZJd2udT4QEnjdws+YRT+lJI+rG/
93+4OpljAcxQywCc6oHDY4ouaqOKdhT9+luvqRVSEnH3JfczT/D+wZD+gBOlgUqsmXp
94+QasD8HSyHWdjyaLrkZuBGICoUZTh9a7ZOPuIQ2sblxOvBm3klndpSpXJC6sJsWAk
95+tyU+5WdNz+ncTC82sFSY0YQLC2QvxckEP6Jxi4I+h9vANtWXCk6CRz/kT4dY3cD4
96+VBFtAy+vUVYUZnLi48fEYlMt4rP64OerY7hjw8gE+66rmUQPml4+DAek+xJtL4Sl
97+Q0SGytWE9tJb1zzICv4TNvj/+IKmbK4BCu7fVjOd2C64zNFTywIDAQABo00wSzAJ
98+BgNVHRMEAjAAMB0GA1UdDgQWBBS6hC1DrVlXAq/GWDYl/UQbP4TmLTAfBgNVHSME
99+GDAWgBQPZ2Gp3izLTRAUzQKCKRLbM5OA2DANBgkqhkiG9w0BAQsFAAOCAQEAcWBy
100+f9+tJDDj7T7z4QziZnxIfKP7x7uP9wAlYGRpKcbbW6SHAg6DA1V5GBWHendkg1hb
101+Nywy7pUFgJ0xlJ7KYr76Ylfa1BTUPT+gExJWvSmsg8WSQ4q3bOMVB1qRxWDv/8KY
102+ZOT03KEzLyGL6ia9r/UFw1jibxS26Ff6qCE9EhDLA/4z0D/+9QzdLATuzSn/SLSR
103+wtarLaWhCfOSpfRrekYhaSndG45BCKpUd99iWt1HA4LyjZe8/8cxsRkD8klaCalG
104+8pRp+PolijzmYsrEXuG22Bq2idgxHTRvw8l4rBQrSdMWuWqqTdIpFIUrXNft0a5f
105+d8RmhI6PZlPL43OCxw==
106+-----END CERTIFICATE-----
107diff --git a/src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt b/src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt
108new file mode 100644
109index 0000000..503206f
110--- /dev/null
111+++ b/src/tests/data/x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt
112@@ -0,0 +1,19 @@
113+-----BEGIN CERTIFICATE-----
114+MIIDGjCCAgKgAwIBAgIUJj5ZhECZYOzt5qWnoN8DMcZzlzgwDQYJKoZIhvcNAQEL
115+BQAwFzEVMBMGA1UEAwwMVGVzdCBSb290IENBMB4XDTI2MDMxNTE0NTM1MloXDTM2
116+MDMxMjE0NTM1MlowFzEVMBMGA1UEAwwMVGVzdCBSb290IENBMIIBIjANBgkqhkiG
117+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtEqBgRHixpRodBHeqXrcttdKD3tpGG+S67tM
118+WT1h+572k6EFIZ9RVfYokH32sNFNz8LNI5FwKKFTf/WaVhMdsqxaMrf/+06UzKdw
119+7dKz+Q5uLGrygv6opSVqhojkjLZH78zmEER0Gba4Ac4FGq5pjafA2jtoIMDyQ2SV
120+IpOy932WCajQL6IM20yHPQAsr0c0hoFP4RdbJPuiEVPfZv95VjEwwV0zMBFmiICk
121+gItEDfiexBHEIvXAGNBModMHaBhUDzHZp0X7gNW/MD2ieiQGoLTyG/t7sKv0J3zV
122+LnUpXVIrmHSIkGVfuc5EFOlq6OXZ/J29VjPEnVVeZARDhgyGRQIDAQABo14wXDAP
123+BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQPZ2Gp3izLTRAUzQKCKRLbM5OA2DAO
124+BgNVHQ8BAf8EBAMCAQYwGgYDVR0eAQH/BBAwDqEMMAqCCGV2aWwuY29tMA0GCSqG
125+SIb3DQEBCwUAA4IBAQA5RLYaZWVxFIKpZRM5ZBk4fDDlAvRl7NVhMeQO3DMyyIzw
126+Bp7IIEgH0I6PlL4/02SzSaqUuVVXYyO1LhbgBlFnE1h818zz+jN06i0lUemuXGAo
127+wnHBwLW+V/r0JBm4BbnbneCYHUFS07sfR9IjQqV9Futp2WILwieZ7Ib96xGuX96L
128+f6pxYEd82rYSXa/K14HvMKXkzC3qe72V+/E1GOPZqzlbZFriYfRUHUOY6P7LjcWl
129+3Z+aUQcG8vEHbJjTd+ZZzP2PICjLKgaX1acpBOUR6pelHgcUmuR3z86V/DD8TWsH
130+BHDLLBxTje/8fL0PR4qo4r4F+2Cj+hXnY/TFVQ+W
131+-----END CERTIFICATE-----
132diff --git a/src/tests/test_name_constraint.cpp b/src/tests/test_name_constraint.cpp
133index 61aff53..5daa343 100644
134--- a/src/tests/test_name_constraint.cpp
135+++ b/src/tests/test_name_constraint.cpp
136@@ -69,6 +69,35 @@ class Name_Constraint_Tests final : public Test {
137
138 BOTAN_REGISTER_TEST("x509", "x509_path_name_constraint", Name_Constraint_Tests);
139
140+// Verify that DNS constraints are case-insensitive also when falling back to the CN
141+class Name_Constraint_Excluded_CN_Case_Test final : public Test {
142+ public:
143+ std::vector<Test::Result> run() override {
144+ Test::Result result("X509v3 Name Constraints: excluded DNS with mixed-case CN and no SAN");
145+
146+ const Botan::X509_Certificate root(
147+ Test::data_file("x509/name_constraint/Root_DNS_Excluded_Mixed_Case_CN.crt"));
148+ const Botan::X509_Certificate leaf(
149+ Test::data_file("x509/name_constraint/Invalid_DNS_Excluded_Mixed_Case_CN.crt"));
150+
151+ Botan::Certificate_Store_In_Memory trusted;
152+ trusted.add_certificate(root);
153+
154+ const Botan::Path_Validation_Restrictions restrictions(false, 80);
155+ const auto validation_time = Botan::calendar_point(2026, 6, 1, 0, 0, 0).to_std_timepoint();
156+
157+ const auto path_result = Botan::x509_path_validate(
158+ leaf, restrictions, trusted, "" /* hostname */, Botan::Usage_Type::UNSPECIFIED, validation_time);
159+
160+ result.test_eq(
161+ "validation result", path_result.result_string(), "Certificate does not pass name constraint");
162+
163+ return {result};
164+ }
165+};
166+
167+BOTAN_REGISTER_TEST("x509", "x509_name_constraint_excluded_cn_case", Name_Constraint_Excluded_CN_Case_Test);
168+
169 #endif
170
171 } // namespace
diff --git a/meta-oe/recipes-crypto/botan/botan_3.10.0.bb b/meta-oe/recipes-crypto/botan/botan_3.10.0.bb
index b613dd2a04..0986a76557 100644
--- a/meta-oe/recipes-crypto/botan/botan_3.10.0.bb
+++ b/meta-oe/recipes-crypto/botan/botan_3.10.0.bb
@@ -7,6 +7,7 @@ SECTION = "libs"
7SRC_URI = "https://botan.randombit.net/releases/Botan-${PV}.tar.xz \ 7SRC_URI = "https://botan.randombit.net/releases/Botan-${PV}.tar.xz \
8 file://CVE-2026-32877.patch \ 8 file://CVE-2026-32877.patch \
9 file://CVE-2026-32883.patch \ 9 file://CVE-2026-32883.patch \
10 file://CVE-2026-32884.patch \
10 " 11 "
11SRC_URI[sha256sum] = "fde194236f6d5434f136ea0a0627f6cc9d26af8b96e9f1e1c7d8c82cd90f4f24" 12SRC_URI[sha256sum] = "fde194236f6d5434f136ea0a0627f6cc9d26af8b96e9f1e1c7d8c82cd90f4f24"
12 13
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-20 12:57:30 +0000