Skip to content

/ cpython

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bpo-35746: Fix segfault in ssl's cert parser #11569

Merged
merged 1 commit into from Jan 15, 2019
Merged

bpo-35746: Fix segfault in ssl's cert parser #11569

merged 1 commit into from Jan 15, 2019

Conversation

@tiran
Copy link
Member

tiran commented Jan 15, 2019 •
edited by bedevere-bot

Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes christian@python.org

https://bugs.python.org/issue35746
@tiran tiran requested a review from alex Jan 15, 2019
@vstinner
vstinner reviewed Jan 15, 2019
View changes
Lib/test/test_ssl.py Outdated Show resolved Hide resolved
Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst Outdated Show resolved Hide resolved
@alex
alex reviewed Jan 15, 2019
View changes
Lib/test/test_ssl.py Outdated Show resolved Hide resolved
Misc/NEWS.d/next/Security/2019-01-15-18-16-05.bpo-35746.nMSd0j.rst Outdated Show resolved Hide resolved
Lib/test/test_ssl.py Outdated Show resolved Hide resolved
Modules/_ssl.c Outdated Show resolved Hide resolved
Modules/_ssl.c Outdated Show resolved Hide resolved
Modules/_ssl.c Outdated Show resolved Hide resolved
@tiran tiran force-pushed the tiran:bpo-35746-crldp-segfault branch 2 times, most recently from 70326d8 to 9b00d25 Jan 15, 2019
@tiran
bpo-35746: Fix segfault in ssl's cert parser
Loading status checks…
c660deb 
CVE-2019-5010, Fix a NULL pointer deref in ssl module. The cert parser did
not handle CRL distribution points with empty DP or URI correctly. A
malicious or buggy certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>
@tiran tiran force-pushed the tiran:bpo-35746-crldp-segfault branch from 9b00d25 to c660deb Jan 15, 2019
@vstinner
vstinner approved these changes Jan 15, 2019
View changes
Copy link
Member

vstinner left a comment

LGTM but I would prefer to get double check from @alex.
@alex
alex approved these changes Jan 15, 2019
View changes
@ned-deily
ned-deily approved these changes Jan 15, 2019
View changes
Copy link
Member

ned-deily left a comment

Verified that the new test causes segfaults on 3.7 and 3.6 and that the fix to _ssl.c when cherry-picked to 3.7 and 3.6 prevents those segfaults.
@miss-islington miss-islington merged commit a37f524 into python:master Jan 15, 2019
5 checks passed
5 checks passed
Azure Pipelines PR #20190115.30 succeeded
Details
bedevere/issue-number Issue number 35746 found
Details
bedevere/news News entry found in Misc/NEWS.d
continuous-integration/appveyor/pr AppVeyor build succeeded
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@miss-islington

This comment has been minimized.

Sign in to view
Copy link

miss-islington commented Jan 15, 2019

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.6, 3.7.
🐍🍒⛏🤖
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Jan 15, 2019

GH-11572 is a backport of this pull request to the 3.7 branch.
miss-islington added a commit to miss-islington/cpython that referenced this pull request Jan 15, 2019
@tiran @miss-islington
bpo-35746: Fix segfault in ssl's cert parser (pythonGH-11569)
bc947d7 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f524)

Co-authored-by: Christian Heimes <christian@python.org>
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Jan 15, 2019

GH-11573 is a backport of this pull request to the 3.6 branch.
miss-islington added a commit to miss-islington/cpython that referenced this pull request Jan 15, 2019
@tiran @miss-islington
bpo-35746: Fix segfault in ssl's cert parser (pythonGH-11569)
e1f8e92 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f524)

Co-authored-by: Christian Heimes <christian@python.org>
@bedevere-bot

This comment has been minimized.

Sign in to view
Copy link

bedevere-bot commented Jan 15, 2019

GH-11574 is a backport of this pull request to the 2.7 branch.
miss-islington added a commit to miss-islington/cpython that referenced this pull request Jan 15, 2019
@tiran @miss-islington
bpo-35746: Fix segfault in ssl's cert parser (pythonGH-11569)
2809178 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f524)

Co-authored-by: Christian Heimes <christian@python.org>
miss-islington added a commit that referenced this pull request Jan 15, 2019
@miss-islington @tiran
bpo-35746: Fix segfault in ssl's cert parser (GH-11569)
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
be5de95 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f524)

Co-authored-by: Christian Heimes <christian@python.org>
miss-islington added a commit that referenced this pull request Jan 15, 2019
@miss-islington @tiran
bpo-35746: Fix segfault in ssl's cert parser (GH-11569)
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
06b1542 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f524)

Co-authored-by: Christian Heimes <christian@python.org>
ned-deily added a commit that referenced this pull request Jan 16, 2019
@miss-islington @tiran @ned-deily
bpo-35746: Fix segfault in ssl's cert parser (GH-11569) (GH-11573)
Loading status checks…
216a4d8 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>

https://bugs.python.org/issue35746
(cherry picked from commit a37f524)

Co-authored-by: Christian Heimes <christian@python.org>
vstinner added a commit to vstinner/cpython that referenced this pull request Feb 15, 2019
@tiran @vstinner
bpo-35746: Fix segfault in ssl's cert parser (pythonGH-11569)
7d94c34 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>



https://bugs.python.org/issue35746
(cherry picked from commit a37f524)
vstinner added a commit to vstinner/cpython that referenced this pull request Feb 15, 2019
@tiran @vstinner
bpo-35746: Fix segfault in ssl's cert parser (pythonGH-11569)
f567e5a 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas
Edet of Cisco.

Signed-off-by: Christian Heimes <christian@python.org>

(cherry picked from commit a37f524)
vstinner added a commit to vstinner/cpython that referenced this pull request Feb 15, 2019
@tiran @vstinner
bpo-35746: Fix segfault in ssl's cert parser (pythonGH-11569)
e0e6ec2 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas
Edet of Cisco.

Signed-off-by: Christian Heimes <christian@python.org>

(cherry picked from commit a37f524)
larryhastings added a commit that referenced this pull request Feb 25, 2019
@vstinner @larryhastings
bpo-35746: Fix segfault in ssl's cert parser (GH-11569) (#11868)
Loading status checks…
6c655ce 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas
Edet of Cisco.

Signed-off-by: Christian Heimes <christian@python.org>

(cherry picked from commit a37f524)
larryhastings added a commit that referenced this pull request Feb 26, 2019
@vstinner @larryhastings
bpo-35746: Fix segfault in ssl's cert parser (GH-11569) (#11867)
Loading status checks…
efec763 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Vulnerability (TALOS-2018-0758) reported by Colin Read and Nicolas
Edet of Cisco.

Signed-off-by: Christian Heimes <christian@python.org>

(cherry picked from commit a37f524)
arnolddumas added a commit to arnolddumas/cpython that referenced this pull request May 3, 2019
@tiran @arnolddumas
bpo-35746: Fix segfault in ssl's cert parser (pythonGH-11569)
58b1382 
Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL
distribution points with empty DP or URI correctly. A malicious or buggy
certificate can result into segfault.

Signed-off-by: Christian Heimes <christian@python.org>



https://bugs.python.org/issue35746
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@alex alex

@vstinner vstinner

@ned-deily ned-deily

Assignees
No one assigned
Labels
🤖 automerge CLA signed type-security
Projects
None yet
Milestone
No milestone
Linked issues

Successfully merging this pull request may close these issues.

None yet

7 participants
@tiran @miss-islington @bedevere-bot @alex @vstinner @ned-deily @the-knights-who-say-ni
You can’t perform that action at this time.