| 2021-05-18 10:29:43 |
bugproxy |
bug |
|
|
added bug |
| 2021-05-18 10:29:45 |
bugproxy |
tags |
|
architecture-s39064 bugnameltc-192742 severity-high targetmilestone-inin2104 |
|
| 2021-05-18 10:29:47 |
bugproxy |
ubuntu: assignee |
|
Skipper Bug Screeners (skipper-screen-team) |
|
| 2021-05-18 10:29:53 |
bugproxy |
affects |
ubuntu |
opencryptoki (Ubuntu) |
|
| 2021-05-18 10:52:25 |
Frank Heimes |
bug task added |
|
ubuntu-z-systems |
|
| 2021-05-18 10:52:34 |
Frank Heimes |
ubuntu-z-systems: status |
New |
Triaged |
|
| 2021-05-18 10:52:38 |
Frank Heimes |
ubuntu-z-systems: importance |
Undecided |
High |
|
| 2021-05-18 10:53:24 |
Frank Heimes |
nominated for series |
|
Ubuntu Hirsute |
|
| 2021-05-18 10:53:24 |
Frank Heimes |
bug task added |
|
opencryptoki (Ubuntu Hirsute) |
|
| 2021-05-18 10:53:24 |
Frank Heimes |
nominated for series |
|
Ubuntu Impish |
|
| 2021-05-18 10:53:24 |
Frank Heimes |
bug task added |
|
opencryptoki (Ubuntu Impish) |
|
| 2021-05-18 10:53:55 |
Frank Heimes |
ubuntu-z-systems: assignee |
|
Skipper Bug Screeners (skipper-screen-team) |
|
| 2021-05-18 10:54:00 |
Frank Heimes |
opencryptoki (Ubuntu Impish): assignee |
Skipper Bug Screeners (skipper-screen-team) |
|
|
| 2021-05-18 18:39:52 |
Steve Langasek |
tags |
architecture-s39064 bugnameltc-192742 severity-high targetmilestone-inin2104 |
architecture-s39064 bugnameltc-192742 fr-1388 severity-high targetmilestone-inin2104 |
|
| 2021-07-28 11:58:01 |
Launchpad Janitor |
opencryptoki (Ubuntu Impish): status |
New |
Fix Released |
|
| 2021-07-28 12:23:05 |
Frank Heimes |
ubuntu-z-systems: status |
Triaged |
In Progress |
|
| 2021-07-29 08:51:50 |
Simon Chopin |
attachment added |
|
opencryptoki_hirsute.debdiff https://bugs.launchpad.net/ubuntu/+source/opencryptoki/+bug/1928780/+attachment/5514578/+files/opencryptoki_hirsute.debdiff |
|
| 2021-07-29 08:58:32 |
Simon Chopin |
description |
The Opencryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow one to perform Invalid Curve Attacks.
Fix:
https://github.com/opencryptoki/opencryptoki/commit/4e3b43c3d8844402c04a66b55c6c940f965109f0 (SOFT: Check the EC Key on C_CreateObject and C_DeriveKey)
This commit should apply smooth on top of OCK 3.16.0, but also on OCK 3.15.0 or 3.15.1.
EC support has been introduced in the Soft token with OCK 3.15.0. So all OCK versions >= 3.15.0 are affected. Earlier OCK releases are not affected.
This problem need only to be fixed with 21.04 wherer 3.15.1 is included. |
[Description]
The Opencryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow one to perform Invalid Curve Attacks.
Fix:
https://github.com/opencryptoki/opencryptoki/commit/4e3b43c3d8844402c04a66b55c6c940f965109f0 (SOFT: Check the EC Key on C_CreateObject and C_DeriveKey)
This commit should apply smooth on top of OCK 3.16.0, but also on OCK 3.15.0 or 3.15.1.
EC support has been introduced in the Soft token with OCK 3.15.0. So all OCK versions >= 3.15.0 are affected. Earlier OCK releases are not affected.
This problem need only to be fixed with 21.04 wherer 3.15.1 is included.
[Test Plan]
??
[Where problems could occur]
Even assuming the underlying code is perfectly correct, the update increases the API surface of the library slightly, which could provoke namespace clashes where none existed before.
If the EC checking code isn't correct, the soft token implementation might reject some valid keys that would have previously gone through. |
|
| 2021-07-30 16:09:25 |
Simon Chopin |
attachment added |
|
test.c https://bugs.launchpad.net/ubuntu/+source/opencryptoki/+bug/1928780/+attachment/5514907/+files/test.c |
|
| 2021-08-02 13:08:14 |
Simon Chopin |
description |
[Description]
The Opencryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow one to perform Invalid Curve Attacks.
Fix:
https://github.com/opencryptoki/opencryptoki/commit/4e3b43c3d8844402c04a66b55c6c940f965109f0 (SOFT: Check the EC Key on C_CreateObject and C_DeriveKey)
This commit should apply smooth on top of OCK 3.16.0, but also on OCK 3.15.0 or 3.15.1.
EC support has been introduced in the Soft token with OCK 3.15.0. So all OCK versions >= 3.15.0 are affected. Earlier OCK releases are not affected.
This problem need only to be fixed with 21.04 wherer 3.15.1 is included.
[Test Plan]
??
[Where problems could occur]
Even assuming the underlying code is perfectly correct, the update increases the API surface of the library slightly, which could provoke namespace clashes where none existed before.
If the EC checking code isn't correct, the soft token implementation might reject some valid keys that would have previously gone through. |
[Description]
The Opencryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow one to perform Invalid Curve Attacks.
Fix:
https://github.com/opencryptoki/opencryptoki/commit/4e3b43c3d8844402c04a66b55c6c940f965109f0 (SOFT: Check the EC Key on C_CreateObject and C_DeriveKey)
This commit should apply smooth on top of OCK 3.16.0, but also on OCK 3.15.0 or 3.15.1.
EC support has been introduced in the Soft token with OCK 3.15.0. So all OCK versions >= 3.15.0 are affected. Earlier OCK releases are not affected.
This problem need only to be fixed with 21.04 wherer 3.15.1 is included.
[Test Plan]
DO THIS IN A THROWAWAY VM!!! The cleanup routine in the test isn't itself
well tested :)
First step is to prepare the default software-based slot for the tests.
We'll setup the user password to be 1234 (hardcoded in the testfile).
We're assuming the opencryptoki configuration is the default one (i.e. software-based backend at slot 3), in which case the SO password is by default 87654321
$ sudo apt install opencryptoki
$ sudo pkcsconf -c 3 -u
When this is done, install the lib headers (libopencryptoki-dev), download the test file provided in the comments (named 'test.c' in the following command) and compile it
$ gcc test.c -o sru-test -lopencryptoki
Finally, run the binary as root. The return code will be 0 if the incorrect key is rejected, 56 if not.
$ sudo ./sru-test
[Where problems could occur]
Even assuming the underlying code is perfectly correct, the update increases the API surface of the library slightly, which could provoke namespace clashes where none existed before.
If the EC checking code isn't correct, the soft token implementation might reject some valid keys that would have previously gone through. |
|
| 2021-08-02 13:09:57 |
Simon Chopin |
attachment added |
|
test.c https://bugs.launchpad.net/ubuntu/+source/opencryptoki/+bug/1928780/+attachment/5515281/+files/test.c |
|
| 2021-08-02 13:10:16 |
Simon Chopin |
opencryptoki (Ubuntu Hirsute): status |
New |
In Progress |
|
| 2021-08-02 13:11:31 |
Simon Chopin |
description |
[Description]
The Opencryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow one to perform Invalid Curve Attacks.
Fix:
https://github.com/opencryptoki/opencryptoki/commit/4e3b43c3d8844402c04a66b55c6c940f965109f0 (SOFT: Check the EC Key on C_CreateObject and C_DeriveKey)
This commit should apply smooth on top of OCK 3.16.0, but also on OCK 3.15.0 or 3.15.1.
EC support has been introduced in the Soft token with OCK 3.15.0. So all OCK versions >= 3.15.0 are affected. Earlier OCK releases are not affected.
This problem need only to be fixed with 21.04 wherer 3.15.1 is included.
[Test Plan]
DO THIS IN A THROWAWAY VM!!! The cleanup routine in the test isn't itself
well tested :)
First step is to prepare the default software-based slot for the tests.
We'll setup the user password to be 1234 (hardcoded in the testfile).
We're assuming the opencryptoki configuration is the default one (i.e. software-based backend at slot 3), in which case the SO password is by default 87654321
$ sudo apt install opencryptoki
$ sudo pkcsconf -c 3 -u
When this is done, install the lib headers (libopencryptoki-dev), download the test file provided in the comments (named 'test.c' in the following command) and compile it
$ gcc test.c -o sru-test -lopencryptoki
Finally, run the binary as root. The return code will be 0 if the incorrect key is rejected, 56 if not.
$ sudo ./sru-test
[Where problems could occur]
Even assuming the underlying code is perfectly correct, the update increases the API surface of the library slightly, which could provoke namespace clashes where none existed before.
If the EC checking code isn't correct, the soft token implementation might reject some valid keys that would have previously gone through. |
[Description]
The Opencryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow one to perform Invalid Curve Attacks.
Fix:
https://github.com/opencryptoki/opencryptoki/commit/4e3b43c3d8844402c04a66b55c6c940f965109f0 (SOFT: Check the EC Key on C_CreateObject and C_DeriveKey)
This commit should apply smooth on top of OCK 3.16.0, but also on OCK 3.15.0 or 3.15.1.
EC support has been introduced in the Soft token with OCK 3.15.0. So all OCK versions >= 3.15.0 are affected. Earlier OCK releases are not affected.
This problem need only to be fixed with 21.04 wherer 3.15.1 is included.
[Test Plan]
DO THIS IN A THROWAWAY VM!!! The cleanup routine in the test isn't itself
well tested :)
First step is to prepare the default software-based slot for the tests.
We'll setup the user password to be 1234 (hardcoded in the testfile).
We're assuming the opencryptoki configuration is the default one (i.e. software-based backend at slot 3), in which case the SO password is by default 87654321
$ sudo apt install opencryptoki
$ sudo pkcsconf -c 3 -u
When this is done, install the lib headers (libopencryptoki-dev), download the test file provided in the comment #9 (named 'test.c' in the following command) and compile it
$ gcc test.c -o sru-test -lopencryptoki
Finally, run the binary as root. The return code will be 0 if the incorrect key is rejected, 56 if not.
$ sudo ./sru-test
[Where problems could occur]
Even assuming the underlying code is perfectly correct, the update increases the API surface of the library slightly, which could provoke namespace clashes where none existed before.
If the EC checking code isn't correct, the soft token implementation might reject some valid keys that would have previously gone through. |
|
| 2021-08-03 22:48:12 |
Brian Murray |
bug |
|
|
added subscriber Brian Murray |
| 2021-08-04 08:32:36 |
Robie Basak |
opencryptoki (Ubuntu Hirsute): status |
In Progress |
Incomplete |
|
| 2021-08-04 08:53:07 |
Frank Heimes |
information type |
Public |
Public Security |
|
| 2021-08-04 15:01:38 |
Simon Chopin |
bug |
|
|
added subscriber Ubuntu Security Team |
| 2021-08-04 15:13:30 |
bugproxy |
attachment added |
|
opencryptoki_hirsute.debdiff https://bugs.launchpad.net/bugs/1928780/+attachment/5515842/+files/opencryptoki_hirsute.debdiff |
|
| 2021-08-04 16:21:49 |
Launchpad Janitor |
opencryptoki (Ubuntu Hirsute): status |
Incomplete |
Fix Released |
|
| 2021-08-04 17:07:15 |
Frank Heimes |
ubuntu-z-systems: status |
In Progress |
Fix Released |
|
| 2021-09-13 09:19:32 |
Mauro Matteo Cascella |
cve linked |
|
2021-3798 |
|
