python-crypto: CVE-2013-7459
This commit is contained in:
parent
3be1ee45c4
commit
48e4143e03
2 changed files with 86 additions and 2 deletions
84
srcpkgs/python-crypto/patches/CVE-2013-7459.patch
Normal file
84
srcpkgs/python-crypto/patches/CVE-2013-7459.patch
Normal file
|
@ -0,0 +1,84 @@
|
|||
From 8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4 Mon Sep 17 00:00:00 2001
|
||||
From: Legrandin <helderijs@gmail.com>
|
||||
Date: Sun, 22 Dec 2013 22:24:46 +0100
|
||||
Subject: [PATCH] Throw exception when IV is used with ECB or CTR
|
||||
|
||||
The IV parameter is currently ignored when initializing
|
||||
a cipher in ECB or CTR mode.
|
||||
|
||||
For CTR mode, it is confusing: it takes some time to see
|
||||
that a different parameter is needed (the counter).
|
||||
|
||||
For ECB mode, it is outright dangerous.
|
||||
|
||||
This patch forces an exception to be raised.
|
||||
---
|
||||
lib/Crypto/SelfTest/Cipher/common.py | 31 +++++++++++++++++++++++--------
|
||||
src/block_template.c | 11 +++++++++++
|
||||
2 files changed, 34 insertions(+), 8 deletions(-)
|
||||
|
||||
--- lib/Crypto/SelfTest/Cipher/common.py.orig
|
||||
+++ lib/Crypto/SelfTest/Cipher/common.py
|
||||
@@ -239,19 +239,34 @@ class RoundtripTest(unittest.TestCase):
|
||||
return """%s .decrypt() output of .encrypt() should not be garbled""" % (self.module_name,)
|
||||
|
||||
def runTest(self):
|
||||
- for mode in (self.module.MODE_ECB, self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB, self.module.MODE_OPENPGP):
|
||||
+
|
||||
+ ## ECB mode
|
||||
+ mode = self.module.MODE_ECB
|
||||
+ encryption_cipher = self.module.new(a2b_hex(self.key), mode)
|
||||
+ ciphertext = encryption_cipher.encrypt(self.plaintext)
|
||||
+ decryption_cipher = self.module.new(a2b_hex(self.key), mode)
|
||||
+ decrypted_plaintext = decryption_cipher.decrypt(ciphertext)
|
||||
+ self.assertEqual(self.plaintext, decrypted_plaintext)
|
||||
+
|
||||
+ ## OPENPGP mode
|
||||
+ mode = self.module.MODE_OPENPGP
|
||||
+ encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)
|
||||
+ eiv_ciphertext = encryption_cipher.encrypt(self.plaintext)
|
||||
+ eiv = eiv_ciphertext[:self.module.block_size+2]
|
||||
+ ciphertext = eiv_ciphertext[self.module.block_size+2:]
|
||||
+ decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv)
|
||||
+ decrypted_plaintext = decryption_cipher.decrypt(ciphertext)
|
||||
+ self.assertEqual(self.plaintext, decrypted_plaintext)
|
||||
+
|
||||
+ ## All other non-AEAD modes (but CTR)
|
||||
+ for mode in (self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB):
|
||||
encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)
|
||||
ciphertext = encryption_cipher.encrypt(self.plaintext)
|
||||
-
|
||||
- if mode != self.module.MODE_OPENPGP:
|
||||
- decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)
|
||||
- else:
|
||||
- eiv = ciphertext[:self.module.block_size+2]
|
||||
- ciphertext = ciphertext[self.module.block_size+2:]
|
||||
- decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv)
|
||||
+ decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv)
|
||||
decrypted_plaintext = decryption_cipher.decrypt(ciphertext)
|
||||
self.assertEqual(self.plaintext, decrypted_plaintext)
|
||||
|
||||
+
|
||||
class PGPTest(unittest.TestCase):
|
||||
def __init__(self, module, params):
|
||||
unittest.TestCase.__init__(self)
|
||||
--- src/block_template.c.orig
|
||||
+++ src/block_template.c
|
||||
@@ -170,6 +170,17 @@ ALGnew(PyObject *self, PyObject *args, P
|
||||
"Key cannot be the null string");
|
||||
return NULL;
|
||||
}
|
||||
+ if (IVlen != 0 && mode == MODE_ECB)
|
||||
+ {
|
||||
+ PyErr_Format(PyExc_ValueError, "ECB mode does not use IV");
|
||||
+ return NULL;
|
||||
+ }
|
||||
+ if (IVlen != 0 && mode == MODE_CTR)
|
||||
+ {
|
||||
+ PyErr_Format(PyExc_ValueError,
|
||||
+ "CTR mode needs counter parameter, not IV");
|
||||
+ return NULL;
|
||||
+ }
|
||||
if (IVlen != BLOCK_SIZE && mode != MODE_ECB && mode != MODE_CTR)
|
||||
{
|
||||
PyErr_Format(PyExc_ValueError,
|
|
@ -1,7 +1,7 @@
|
|||
# Template file for 'python-crypto'
|
||||
pkgname=python-crypto
|
||||
version=2.6.1
|
||||
revision=7
|
||||
revision=8
|
||||
wrksrc="pycrypto-${version}"
|
||||
build_style=python-module
|
||||
hostmakedepends="python-devel python3-devel"
|
||||
|
@ -12,7 +12,7 @@ short_desc="The Python Cryptography Toolkit (Python2)"
|
|||
maintainer="Juan RP <xtraeme@voidlinux.eu>"
|
||||
homepage="https://www.dlitz.net/software/pycrypto/"
|
||||
license="PSF, Public domain"
|
||||
distfiles="http://ftp.dlitz.net/pub/dlitz/crypto/pycrypto/pycrypto-$version.tar.gz"
|
||||
distfiles="https://ftp.dlitz.net/pub/dlitz/crypto/pycrypto/pycrypto-$version.tar.gz"
|
||||
checksum=f2ce1e989b272cfcb677616763e0a2e7ec659effa67a88aa92b3a65528f60a3c
|
||||
|
||||
pre_build() {
|
||||
|
|
Loading…
Reference in a new issue