Skip to content

Commit 89086ae

Browse files
azurelinux-securityjykanase
azurelinux-security
and
jykanase
authored
[AutoPR- Security] Patch gnutls for CVE-2026-3832, CVE-2026-33846, CVE-2026-42010 [MEDIUM] (#17101)
Co-authored-by: jykanase <v-jykanase@microsoft.com>
1 parent 5444e77 commit 89086ae

4 files changed

Lines changed: 179 additions & 1 deletion

File tree

‎SPECS/gnutls/CVE-2026-33846.patch‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
From 65ab33fa54e34fba69d793735b7df3d383d1ff78 Mon Sep 17 00:00:00 2001
2+
From: Alexander Sosedkin <asosedkin@redhat.com>
3+
Date: Fri, 17 Apr 2026 18:21:36 +0200
4+
Subject: [PATCH] buffers: add more checks to DTLS reassembly
5+
6+
Previously, gnutls didn't check that DTLS fragments claimed
7+
a consistent message_length value.
8+
Additionally, a crucial array size check was missing,
9+
enabling an attacker to cause a heap overwrite.
10+
The updated version rejects fragments with mismatching length
11+
and adds a missing boundary check.
12+
13+
Reported-by: Haruto Kimura (Stella)
14+
Reported-by: Oscar Reparaz
15+
Reported-by: Zou Dikai
16+
Fixes: #1816
17+
Fixes: #1838
18+
Fixes: #1839
19+
Fixes: CVE-2026-33846
20+
Fixes: GNUTLS-SA-2026-04-29-1
21+
CVSS: 7.4 High CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
22+
CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
23+
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
24+
25+
Upstream Patch Reference: https://gitlab.com/gnutls/gnutls/-/commit/65ab33fa54e34fba69d793735b7df3d383d1ff78.patch
26+
---
27+
lib/buffers.c | 20 ++++++++++++++++++++
28+
1 file changed, 20 insertions(+)
29+
30+
diff --git a/lib/buffers.c b/lib/buffers.c
31+
index 672380b..0f6ae1c 100644
32+
--- a/lib/buffers.c
33+
+++ b/lib/buffers.c
34+
@@ -1009,6 +1009,26 @@ static int merge_handshake_packet(gnutls_session_t session,
35+
&session->internals.handshake_recv_buffer[pos], hsk);
36+
37+
} else {
38+
+ if (hsk->length != session->internals.handshake_recv_buffer[pos].length) {
39+
+ /* inconsistent across fragments */
40+
+ _gnutls_handshake_buffer_clear(hsk);
41+
+ return gnutls_assert_val(
42+
+ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
43+
+ }
44+
+ /* start_offset + data.length <= hsk->length <= max_length */
45+
+ if (hsk->length < hsk->start_offset + hsk->data.length) {
46+
+ /* impossible claims, overflow requested */
47+
+ _gnutls_handshake_buffer_clear(hsk);
48+
+ return gnutls_assert_val(
49+
+ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
50+
+ }
51+
+ if (hsk->length > session->internals.handshake_recv_buffer[pos].data.max_length) {
52+
+ /* we don't have this much allocated, overflow guard */
53+
+ _gnutls_handshake_buffer_clear(hsk);
54+
+ return gnutls_assert_val(
55+
+ GNUTLS_E_UNEXPECTED_PACKET_LENGTH);
56+
+ }
57+
+
58+
if (hsk->start_offset <
59+
session->internals.handshake_recv_buffer[pos]
60+
.start_offset &&
61+
--
62+
2.45.4
63+

‎SPECS/gnutls/CVE-2026-3832.patch‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
From 731861b9de8dccaf7d3b0c1446833051e48670c2 Mon Sep 17 00:00:00 2001
2+
From: Alexander Sosedkin <asosedkin@redhat.com>
3+
Date: Thu, 12 Mar 2026 09:48:57 +0100
4+
Subject: [PATCH] cert-session: fix multi-entry OCSP revocation bypass
5+
6+
In check_ocsp_response(), the code first searched
7+
for the SingleResponse that matches the certificate being validated.
8+
But later, the status was retrieved from entry 0 unconditionally,
9+
rather than from the matched resp_indx.
10+
As a result, if entry 0 corresponded to a different certificate and was good,
11+
while the matched entry for the peer certificate is revoked,
12+
the revocation check could've mistakenly accept the certificate.
13+
14+
Reported-by: Oleh Konko (1seal) <security@1seal.org>
15+
Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
16+
Fixes: #1801
17+
Fixes: #1812
18+
Fixes: CVE-2026-3832
19+
Fixes: GNUTLS-SA-2026-04-29-12
20+
CVSS: 3.7 Low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
21+
Introduced-in: ae404fe8488dee424876b5963c00d7e041672415 3.8.9
22+
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
23+
24+
Upstream Patch Reference: https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2.patch
25+
---
26+
lib/cert-session.c | 14 +++++++++-----
27+
1 file changed, 9 insertions(+), 5 deletions(-)
28+
29+
diff --git a/lib/cert-session.c b/lib/cert-session.c
30+
index 5a4b997..53de6f1 100644
31+
--- a/lib/cert-session.c
32+
+++ b/lib/cert-session.c
33+
@@ -236,7 +236,7 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,
34+
{
35+
gnutls_ocsp_resp_t resp;
36+
int ret;
37+
- unsigned int status, cert_status;
38+
+ unsigned int status, cert_status, resp_indx;
39+
time_t rtime, vtime, ntime, now;
40+
int check_failed = 0;
41+
42+
@@ -277,7 +277,11 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,
43+
goto cleanup;
44+
}
45+
46+
- ret = gnutls_ocsp_resp_check_crt(resp, 0, cert);
47+
+ for (resp_indx = 0;; resp_indx++) {
48+
+ ret = gnutls_ocsp_resp_check_crt(resp, resp_indx, cert);
49+
+ if (ret == 0 || ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
50+
+ break;
51+
+ }
52+
if (ret < 0) {
53+
ret = gnutls_assert_val(0);
54+
_gnutls_audit_log(
55+
@@ -339,9 +343,9 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,
56+
goto cleanup;
57+
}
58+
59+
- ret = gnutls_ocsp_resp_get_single(resp, 0, NULL, NULL, NULL, NULL,
60+
- &cert_status, &vtime, &ntime, &rtime,
61+
- NULL);
62+
+ ret = gnutls_ocsp_resp_get_single(resp, resp_indx, NULL, NULL, NULL,
63+
+ NULL, &cert_status, &vtime, &ntime,
64+
+ &rtime, NULL);
65+
if (ret < 0) {
66+
_gnutls_audit_log(
67+
session,
68+
--
69+
2.45.4
70+

‎SPECS/gnutls/CVE-2026-42010.patch‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
From 11bb6396dd2cf7a0ac84b5a5d7a6f4ddeda4c54a Mon Sep 17 00:00:00 2001
2+
From: Alexander Sosedkin <asosedkin@redhat.com>
3+
Date: Tue, 21 Apr 2026 19:26:10 +0200
4+
Subject: [PATCH] lib/auth/rsa_psk: fix binary PSK identity lookup
5+
6+
A server looking up PSK username with a NUL-character in it
7+
was wrongfully matching username truncated at a NUL-character.
8+
Fix the check to compare up to the full username length.
9+
10+
Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
11+
Fixes: #1850
12+
Fixes: CVE-2026-42010
13+
Fixes: GNUTLS-SA-2026-04-29-4
14+
CVSS: 7.1 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
15+
Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
16+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
17+
Upstream-reference: https://gitlab.com/gnutls/gnutls/-/commit/cb1833afd9b6309563211b1c0a7c291f52ca98d5.patch
18+
---
19+
lib/auth/rsa_psk.c | 3 +--
20+
1 file changed, 1 insertion(+), 2 deletions(-)
21+
22+
diff --git a/lib/auth/rsa_psk.c b/lib/auth/rsa_psk.c
23+
index 399fb4d..a14de46 100644
24+
--- a/lib/auth/rsa_psk.c
25+
+++ b/lib/auth/rsa_psk.c
26+
@@ -321,8 +321,7 @@ static int _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session,
27+
* filled in if the key is not found.
28+
*/
29+
ret = _gnutls_psk_pwd_find_entry(session, info->username,
30+
- strlen(info->username), &pwd_psk,
31+
- NULL);
32+
+ info->username_len, &pwd_psk, NULL);
33+
if (ret < 0)
34+
return gnutls_assert_val(ret);
35+
36+
--
37+
2.45.4
38+

‎SPECS/gnutls/gnutls.spec‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: The GnuTLS Transport Layer Security Library
22
Name: gnutls
33
Version: 3.8.3
4-
Release: 9%{?dist}
4+
Release: 10%{?dist}
55
License: GPLv3+ AND LGPLv2.1+
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -21,6 +21,10 @@ Patch8: CVE-2025-6395.patch
2121
Patch9: CVE-2025-13151.patch
2222
Patch10: CVE-2025-9820.patch
2323
Patch11: CVE-2026-33845.patch
24+
Patch12: CVE-2026-33846.patch
25+
Patch13: CVE-2026-3832.patch
26+
Patch14: CVE-2026-42010.patch
27+
2428
BuildRequires: autogen-libopts-devel
2529
BuildRequires: gc-devel
2630
BuildRequires: libtasn1-devel
@@ -102,6 +106,9 @@ sed -i 's/TESTS += test-ciphers-openssl.sh//' tests/slow/Makefile.am
102106
%{_mandir}/man3/*
103107

104108
%changelog
109+
* Fri May 08 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.8.3-10
110+
- Patch for CVE-2026-3832, CVE-2026-33846, CVE-2026-42010
111+
105112
* Thu May 07 2026 Akarsh Chaudhary <v-akarshc@microsoft.com>- 3.8.3-9
106113
- Patch for CVE-2026-33845
107114

0 commit comments

Comments
 (0)