1
0
mirror of https://xff.cz/git/u-boot/ synced 2026-02-01 07:07:55 +01:00
Files
u-boot-megous/tools
Young Xiao 2251512345 kwbimage: fixing the issue with proper return code checking
EVP_VerifyFinal would return one of three values:
1 if the data is verified to be correct;
0 if it is incorrect;
-1 if there is any failure in the verification process.

The varification in unpatched version is wrong, since it ignored
the return value of -1.

The bug allows a malformed signature to be treated as a good
signature rather than as an error. This issue affects the
signature checks on DSA ans ECDSA keys used with SSL/TLS.

This issue is similar to CVE-2008-5077, CVE-2009-0021,
CVE-2009-0025, CVE-2009-0046 ~ CVE-2009-0049.

Signed-off-by: Young Xiao <92siuyang@gmail.com>
Signed-off-by: Stefan Roese <sr@denx.de>
2019-05-03 08:14:39 +02:00
..
2019-02-09 12:50:22 -07:00
2019-04-26 18:58:21 -04:00
2018-05-31 08:53:11 -04:00
2018-10-08 07:34:34 -06:00
2019-02-01 14:13:46 -05:00
2019-01-01 14:12:18 +01:00
2009-04-28 01:16:46 +02:00