summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-core/glib-networking/glib-networking/CVE-2025-60019.patch137
-rw-r--r--meta/recipes-core/glib-networking/glib-networking_2.72.2.bb1
2 files changed, 138 insertions, 0 deletions
diff --git a/meta/recipes-core/glib-networking/glib-networking/CVE-2025-60019.patch b/meta/recipes-core/glib-networking/glib-networking/CVE-2025-60019.patch
new file mode 100644
index 0000000000..cc0a8f1edc
--- /dev/null
+++ b/meta/recipes-core/glib-networking/glib-networking/CVE-2025-60019.patch
@@ -0,0 +1,137 @@
1From 70df675dd4f5e4a593b2f95406c1aac031aa8bc7 Mon Sep 17 00:00:00 2001
2From: Michael Catanzaro <mcatanzaro@redhat.com>
3Date: Thu, 21 Aug 2025 17:21:01 -0500
4Subject: [PATCH] openssl: check return values of BIO_new()
5
6We probably need to check even more return values of even more OpenSSL
7functions, but these ones allocate memory and that's particularly
8important to get right.
9
10CVE: CVE-2025-60019
11
12Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib-networking/-/commit/70df675dd4f5e4a593b2f95406c1aac031aa8bc7]
13
14Signed-off-by: Rajeshkumar Ramasamy <rajeshkumar.ramasamy@windriver.com>
15---
16 tls/openssl/gtlscertificate-openssl.c | 39 ++++++++++++++++++++-------
17 1 file changed, 29 insertions(+), 10 deletions(-)
18
19diff --git a/tls/openssl/gtlscertificate-openssl.c b/tls/openssl/gtlscertificate-openssl.c
20index 8f828a7..f7fde51 100644
21--- a/tls/openssl/gtlscertificate-openssl.c
22+++ b/tls/openssl/gtlscertificate-openssl.c
23@@ -156,6 +156,9 @@ export_privkey_to_der (GTlsCertificateOpenssl *openssl,
24 goto err;
25
26 bio = BIO_new (BIO_s_mem ());
27+ if (!bio)
28+ goto err;
29+
30 if (i2d_PKCS8_PRIV_KEY_INFO_bio (bio, pkcs8) == 0)
31 goto err;
32
33@@ -189,6 +192,9 @@ export_privkey_to_pem (GTlsCertificateOpenssl *openssl)
34 return NULL;
35
36 bio = BIO_new (BIO_s_mem ());
37+ if (!bio)
38+ goto out;
39+
40 ret = PEM_write_bio_PKCS8PrivateKey (bio, openssl->key, NULL, NULL, 0, NULL, NULL);
41 if (ret == 0)
42 goto out;
43@@ -201,7 +207,7 @@ export_privkey_to_pem (GTlsCertificateOpenssl *openssl)
44 result = g_strdup (data);
45
46 out:
47- BIO_free_all (bio);
48+ g_clear_pointer (&bio, BIO_free_all);
49 return result;
50 }
51
52@@ -216,7 +222,7 @@ g_tls_certificate_openssl_get_property (GObject *object,
53 guint8 *data;
54 BIO *bio;
55 GByteArray *byte_array;
56- char *certificate_pem;
57+ const char *certificate_pem;
58 long size;
59
60 const ASN1_TIME *time_asn1;
61@@ -251,12 +257,12 @@ g_tls_certificate_openssl_get_property (GObject *object,
62 case PROP_CERTIFICATE_PEM:
63 bio = BIO_new (BIO_s_mem ());
64
65- if (PEM_write_bio_X509 (bio, openssl->cert) == 1 && BIO_write (bio, "\0", 1) == 1)
66+ if (bio && PEM_write_bio_X509 (bio, openssl->cert) == 1 && BIO_write (bio, "\0", 1) == 1)
67 {
68 BIO_get_mem_data (bio, &certificate_pem);
69 g_value_set_string (value, certificate_pem);
70 }
71- BIO_free_all (bio);
72+ g_clear_pointer (&bio, BIO_free_all);
73 break;
74
75 case PROP_PRIVATE_KEY:
76@@ -296,6 +302,8 @@ g_tls_certificate_openssl_get_property (GObject *object,
77
78 case PROP_SUBJECT_NAME:
79 bio = BIO_new (BIO_s_mem ());
80+ if (!bio)
81+ break;
82 name = X509_get_subject_name (openssl->cert);
83 if (X509_NAME_print_ex (bio, name, 0, XN_FLAG_SEP_COMMA_PLUS) < 0 ||
84 BIO_write (bio, "\0", 1) != 1)
85@@ -310,6 +318,8 @@ g_tls_certificate_openssl_get_property (GObject *object,
86
87 case PROP_ISSUER_NAME:
88 bio = BIO_new (BIO_s_mem ());
89+ if (!bio)
90+ break;
91 name = X509_get_issuer_name (openssl->cert);
92 if (X509_NAME_print_ex (bio, name, 0, XN_FLAG_SEP_COMMA_PLUS) < 0 ||
93 BIO_write (bio, "\0", 1) != 1)
94@@ -377,8 +387,11 @@ g_tls_certificate_openssl_set_property (GObject *object,
95 break;
96 g_return_if_fail (openssl->have_cert == FALSE);
97 bio = BIO_new_mem_buf ((gpointer)string, -1);
98- openssl->cert = PEM_read_bio_X509 (bio, NULL, NULL, NULL);
99- BIO_free (bio);
100+ if (bio)
101+ {
102+ openssl->cert = PEM_read_bio_X509 (bio, NULL, NULL, NULL);
103+ BIO_free (bio);
104+ }
105 if (openssl->cert)
106 openssl->have_cert = TRUE;
107 else if (!openssl->construct_error)
108@@ -397,8 +410,11 @@ g_tls_certificate_openssl_set_property (GObject *object,
109 break;
110 g_return_if_fail (openssl->have_key == FALSE);
111 bio = BIO_new_mem_buf (bytes->data, bytes->len);
112- openssl->key = d2i_PrivateKey_bio (bio, NULL);
113- BIO_free (bio);
114+ if (bio)
115+ {
116+ openssl->key = d2i_PrivateKey_bio (bio, NULL);
117+ BIO_free (bio);
118+ }
119 if (openssl->key)
120 openssl->have_key = TRUE;
121 else if (!openssl->construct_error)
122@@ -417,8 +433,11 @@ g_tls_certificate_openssl_set_property (GObject *object,
123 break;
124 g_return_if_fail (openssl->have_key == FALSE);
125 bio = BIO_new_mem_buf ((gpointer)string, -1);
126- openssl->key = PEM_read_bio_PrivateKey (bio, NULL, NULL, NULL);
127- BIO_free (bio);
128+ if (bio)
129+ {
130+ openssl->key = PEM_read_bio_PrivateKey (bio, NULL, NULL, NULL);
131+ BIO_free (bio);
132+ }
133 if (openssl->key)
134 openssl->have_key = TRUE;
135 else if (!openssl->construct_error)
136--
1372.48.1
diff --git a/meta/recipes-core/glib-networking/glib-networking_2.72.2.bb b/meta/recipes-core/glib-networking/glib-networking_2.72.2.bb
index 32d50135bb..65a4a3a22f 100644
--- a/meta/recipes-core/glib-networking/glib-networking_2.72.2.bb
+++ b/meta/recipes-core/glib-networking/glib-networking_2.72.2.bb
@@ -25,6 +25,7 @@ inherit gnomebase gettext upstream-version-is-even gio-module-cache ptest-gnome
25 25
26SRC_URI += "file://run-ptest" 26SRC_URI += "file://run-ptest"
27SRC_URI += "file://CVE-2025-60018.patch" 27SRC_URI += "file://CVE-2025-60018.patch"
28SRC_URI += "file://CVE-2025-60019.patch"
28 29
29FILES:${PN} += "\ 30FILES:${PN} += "\
30 ${libdir}/gio/modules/libgio*.so \ 31 ${libdir}/gio/modules/libgio*.so \
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-20 01:56:26 +0000