ECDSA XML signature generation segmentation fault

[Alejandro Claro]

We found a bug in Apache Santuario C, related to ECDSA signature generation, few years ego. We provide the fix to the Apache team, and Scott Cantor kindly accepted the fix in the project. How ever the fix was introduced in series 2.x of the the library.

The fix we provide was for the version 1.7.x (xml-security-c17) found in Ubuntu 14.04 and looks like Ubuntu 18.04 is still including a version from series 1.7.x. Our products goes trough certification processes where using source code without patches is something very well seen.

We are interesting in exploring the possibility to start a communication with Ubuntu maintainers team, in order to request including some patches or version upgrades in libraries we are contributing and we are using in products based in Ubuntu minimal 14.04 and 18.04.

The commit with the fix for the bug can be found here:

http://svn.apache.org/viewvc/santuario/xml-security-cpp/trunk/xsec/utils/XSECSafeBuffer.cpp?r1=1806212&r2=1807280&diff_format=h

[Alejandro Claro (aclaro)]

Here is the debdiff in case it could help the maintainers to solve the bug.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "1.7.2-2ubuntu1.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Eduardo Barretto (ebarretto)]

Hey Alejandro,

Thanks for providing the patch.

Could you please test the versions that I've built?

https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages?field.name_filter=xml-security-c&field.status_filter=published&field.series_filter=

Thanks

[Alejandro Claro (aclaro)]

Hi Eduardo,

We have tested and it seems to be working correctly.

Thanks

[Simon Quigley (tsimonq2)]

Unsubscribing the Ubuntu Security Sponsors Team as there is nothing left to sponsor.