[AutoPR- Security] Patch gnutls for CVE-2026-3832, CVE-2026-33846, CVE-2026-42010 [MEDIUM]#17101
Open
azurelinux-security wants to merge 3 commits into
Open
Conversation
microsoft-github-policy-service
Bot
added
Packaging
3.0-dev
Contributor
Contributor
Author
🔒 CVE Patch Review: CVE-2026-33846, CVE-2026-3832PR #17101 — [AutoPR- Security] Patch gnutls for CVE-2026-3832, CVE-2026-33846 [MEDIUM] Spec File Validation
Build Verification
🤖 AI Build Log Analysis
🧪 Test Log Analysis
🤖 AI Test Log Analysis
Patch Analysis
Detailed analysis
Raw diff (upstream vs PR)--- upstream
+++ pr
@@ -1,61 +1,69 @@
-From 65ab33fa54e34fba69d793735b7df3d383d1ff78 Mon Sep 17 00:00:00 2001
-From: Alexander Sosedkin <asosedkin@redhat.com>
-Date: Fri, 17 Apr 2026 18:21:36 +0200
-Subject: [PATCH] buffers: add more checks to DTLS reassembly
-
-Previously, gnutls didn't check that DTLS fragments claimed
-a consistent message_length value.
-Additionally, a crucial array size check was missing,
-enabling an attacker to cause a heap overwrite.
-The updated version rejects fragments with mismatching length
-and adds a missing boundary check.
-
-Reported-by: Haruto Kimura (Stella)
-Reported-by: Oscar Reparaz
-Reported-by: Zou Dikai
-Fixes: #1816
-Fixes: #1838
-Fixes: #1839
-Fixes: CVE-2026-33846
-Fixes: GNUTLS-SA-2026-04-29-1
-CVSS: 7.4 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
-CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
-Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
----
- lib/buffers.c | 20 ++++++++++++++++++++
- 1 file changed, 20 insertions(+)
-
-diff --git a/lib/buffers.c b/lib/buffers.c
-index d54c770228..5d4d162768 100644
---- a/lib/buffers.c
-+++ b/lib/buffers.c
-@@ -1010,6 +1010,26 @@ static int merge_handshake_packet(gnutls_session_t session,
- _gnutls_handshake_buffer_move(&recv_buf[pos], hsk);
-
- } else {
-+ if (hsk->length != recv_buf[pos].length) {
-+ /* inconsistent across fragments */
-+ _gnutls_handshake_buffer_clear(hsk);
-+ return gnutls_assert_val(
-+ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
-+ }
-+ /* start_offset + data.length <= hsk->length <= max_length */
-+ if (hsk->length < hsk->start_offset + hsk->data.length) {
-+ /* impossible claims, overflow requested */
-+ _gnutls_handshake_buffer_clear(hsk);
-+ return gnutls_assert_val(
-+ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
-+ }
-+ if (hsk->length > recv_buf[pos].data.max_length) {
-+ /* we don't have this much allocated, overflow guard */
-+ _gnutls_handshake_buffer_clear(hsk);
-+ return gnutls_assert_val(
-+ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
-+ }
+diff --git a/SPECS/gnutls/CVE-2026-33846.patch b/SPECS/gnutls/CVE-2026-33846.patch
+new file mode 100644
+index 00000000000..b06a6a88f2d
+--- /dev/null
++++ b/SPECS/gnutls/CVE-2026-33846.patch
+@@ -0,0 +1,63 @@
++From 65ab33fa54e34fba69d793735b7df3d383d1ff78 Mon Sep 17 00:00:00 2001
++From: Alexander Sosedkin <asosedkin@redhat.com>
++Date: Fri, 17 Apr 2026 18:21:36 +0200
++Subject: [PATCH] buffers: add more checks to DTLS reassembly
+
- if (hsk->start_offset < recv_buf[pos].start_offset &&
- hsk->end_offset + 1 >= recv_buf[pos].start_offset) {
- memcpy(&recv_buf[pos].data.data[hsk->start_offset],
---
-GitLab
-
++Previously, gnutls didn't check that DTLS fragments claimed
++a consistent message_length value.
++Additionally, a crucial array size check was missing,
++enabling an attacker to cause a heap overwrite.
++The updated version rejects fragments with mismatching length
++and adds a missing boundary check.
++
++Reported-by: Haruto Kimura (Stella)
++Reported-by: Oscar Reparaz
++Reported-by: Zou Dikai
++Fixes: #1816
++Fixes: #1838
++Fixes: #1839
++Fixes: CVE-2026-33846
++Fixes: GNUTLS-SA-2026-04-29-1
++CVSS: 7.4 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
++CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
++Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
++
++Upstream Patch Reference: https://gitlab.com/gnutls/gnutls/-/commit/65ab33fa54e34fba69d793735b7df3d383d1ff78.patch
++---
++ lib/buffers.c | 20 ++++++++++++++++++++
++ 1 file changed, 20 insertions(+)
++
++diff --git a/lib/buffers.c b/lib/buffers.c
++index 672380b..0f6ae1c 100644
++--- a/lib/buffers.c
+++++ b/lib/buffers.c
++@@ -1009,6 +1009,26 @@ static int merge_handshake_packet(gnutls_session_t session,
++ &session->internals.handshake_recv_buffer[pos], hsk);
++
++ } else {
+++ if (hsk->length != session->internals.handshake_recv_buffer[pos].length) {
+++ /* inconsistent across fragments */
+++ _gnutls_handshake_buffer_clear(hsk);
+++ return gnutls_assert_val(
+++ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
+++ }
+++ /* start_offset + data.length <= hsk->length <= max_length */
+++ if (hsk->length < hsk->start_offset + hsk->data.length) {
+++ /* impossible claims, overflow requested */
+++ _gnutls_handshake_buffer_clear(hsk);
+++ return gnutls_assert_val(
+++ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
+++ }
+++ if (hsk->length > session->internals.handshake_recv_buffer[pos].data.max_length) {
+++ /* we don't have this much allocated, overflow guard */
+++ _gnutls_handshake_buffer_clear(hsk);
+++ return gnutls_assert_val(
+++ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
+++ }
+++
++ if (hsk->start_offset <
++ session->internals.handshake_recv_buffer[pos]
++ .start_offset &&
++--
++2.45.4
++
--- upstream
+++ pr
@@ -1,46 +1,76 @@
-From 731861b9de8dccaf7d3b0c1446833051e48670c2 Mon Sep 17 00:00:00 2001
-From: Alexander Sosedkin <asosedkin@redhat.com>
-Date: Thu, 12 Mar 2026 09:48:57 +0100
-Subject: [PATCH] cert-session: fix multi-entry OCSP revocation bypass
-
-In check_ocsp_response(), the code first searched
-for the SingleResponse that matches the certificate being validated.
-But later, the status was retrieved from entry 0 unconditionally,
-rather than from the matched resp_indx.
-As a result, if entry 0 corresponded to a different certificate and was good,
-while the matched entry for the peer certificate is revoked,
-the revocation check could've mistakenly accept the certificate.
-
-Reported-by: Oleh Konko (1seal) <security@1seal.org>
-Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
-Fixes: #1801
-Fixes: #1812
-Fixes: CVE-2026-3832
-Fixes: GNUTLS-SA-2026-04-29-12
-CVSS: 3.7 Low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
-Introduced-in: ae404fe8488dee424876b5963c00d7e041672415 3.8.9
-Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
----
- lib/cert-session.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/lib/cert-session.c b/lib/cert-session.c
-index 34a15b19eb..b8a70ad00e 100644
---- a/lib/cert-session.c
-+++ b/lib/cert-session.c
-@@ -343,9 +343,9 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,
- goto cleanup;
- }
-
-- ret = gnutls_ocsp_resp_get_single(resp, 0, NULL, NULL, NULL, NULL,
-- &cert_status, &vtime, &ntime, &rtime,
-- NULL);
-+ ret = gnutls_ocsp_resp_get_single(resp, resp_indx, NULL, NULL, NULL,
-+ NULL, &cert_status, &vtime, &ntime,
-+ &rtime, NULL);
- if (ret < 0) {
- _gnutls_audit_log(
- session,
---
-GitLab
-
+diff --git a/SPECS/gnutls/CVE-2026-3832.patch b/SPECS/gnutls/CVE-2026-3832.patch
+new file mode 100644
+index 00000000000..f04a937cbd1
+--- /dev/null
++++ b/SPECS/gnutls/CVE-2026-3832.patch
+@@ -0,0 +1,70 @@
++From 731861b9de8dccaf7d3b0c1446833051e48670c2 Mon Sep 17 00:00:00 2001
++From: Alexander Sosedkin <asosedkin@redhat.com>
++Date: Thu, 12 Mar 2026 09:48:57 +0100
++Subject: [PATCH] cert-session: fix multi-entry OCSP revocation bypass
++
++In check_ocsp_response(), the code first searched
++for the SingleResponse that matches the certificate being validated.
++But later, the status was retrieved from entry 0 unconditionally,
++rather than from the matched resp_indx.
++As a result, if entry 0 corresponded to a different certificate and was good,
++while the matched entry for the peer certificate is revoked,
++the revocation check could've mistakenly accept the certificate.
++
++Reported-by: Oleh Konko (1seal) <security@1seal.org>
++Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
++Fixes: #1801
++Fixes: #1812
++Fixes: CVE-2026-3832
++Fixes: GNUTLS-SA-2026-04-29-12
++CVSS: 3.7 Low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
++Introduced-in: ae404fe8488dee424876b5963c00d7e041672415 3.8.9
++Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
++
++Upstream Patch Reference: https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2.patch
++---
++ lib/cert-session.c | 14 +++++++++-----
++ 1 file changed, 9 insertions(+), 5 deletions(-)
++
++diff --git a/lib/cert-session.c b/lib/cert-session.c
++index 5a4b997..53de6f1 100644
++--- a/lib/cert-session.c
+++++ b/lib/cert-session.c
++@@ -236,7 +236,7 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,
++ {
++ gnutls_ocsp_resp_t resp;
++ int ret;
++- unsigned int status, cert_status;
+++ unsigned int status, cert_status, resp_indx;
++ time_t rtime, vtime, ntime, now;
++ int check_failed = 0;
++
++@@ -277,7 +277,11 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,
++ goto cleanup;
++ }
++
++- ret = gnutls_ocsp_resp_check_crt(resp, 0, cert);
+++ for (resp_indx = 0;; resp_indx++) {
+++ ret = gnutls_ocsp_resp_check_crt(resp, resp_indx, cert);
+++ if (ret == 0 || ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+++ break;
+++ }
++ if (ret < 0) {
++ ret = gnutls_assert_val(0);
++ _gnutls_audit_log(
++@@ -339,9 +343,9 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,
++ goto cleanup;
++ }
++
++- ret = gnutls_ocsp_resp_get_single(resp, 0, NULL, NULL, NULL, NULL,
++- &cert_status, &vtime, &ntime, &rtime,
++- NULL);
+++ ret = gnutls_ocsp_resp_get_single(resp, resp_indx, NULL, NULL, NULL,
+++ NULL, &cert_status, &vtime, &ntime,
+++ &rtime, NULL);
++ if (ret < 0) {
++ _gnutls_audit_log(
++ session,
++--
++2.45.4
++
Verdict❌ CHANGES REQUESTED — Please address the issues flagged above. |
azurelinux-security
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto Patch gnutls for CVE-2026-3832, CVE-2026-33846, CVE-2026-42010.
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1113114&view=results
Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1118668&view=results
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
What does the PR accomplish, why was it needed?
Change Log
Does this affect the toolchain?
YES/NO
Associated issues
Links to CVEs
Test Methodology