search

mpeylo / cmpossl

An OpenSSL-based implementation of the Certificate Management Protocol (CMP), defined in IETF RFCs 4210, 4211, and 6712. It is being extended according to the emerging RFCs 'CMP Updates' (CMPv3), 'CMP Algorithms', and 'Lightweight CMP Profile'.
https://github.com/mpeylo/cmpossl/wiki
Other
35 stars 13 forks source link

popo Segfault if pkey set with OSSL_CMP_CTX_set0_newPkey() contains only pubkey #187

Closed mpeylo closed 4 years ago

mpeylo commented 5 years ago

Populating the CTX with a newpkey only containing a public key (no private key) triggers a Segfault if it is attempted to calculate popo.

It should be checked whether the newPkey contains a private key before it is attempted to calculate popo with it.

While that might not be possible to happen with the CLI, it is possible that this happens if the API is used directly.

mpeylo commented 4 years ago

@DDvO @Akretsch was it so that this is nowadays fixed?

DDvO commented 4 years ago

I just came across this issue - I must have overlooked it earlier (sorry for that) and apparently @Akretsch did not respond either. This bug has long been solved at least in our cmp-dev branch, and also the OpenSSL master contains in cmp_msg.c:

        if (ctx->popoMethod == OSSL_CRMF_POPO_SIGNATURE && privkey == NULL) {
            CMPerr(0, CMP_R_MISSING_PRIVATE_KEY);
            goto err;
        }