Version in base suite: 0.3.2+git20151018-2 Base version: ecdsautils_0.3.2+git20151018-2 Target version: ecdsautils_0.3.2+git20151018-2+deb10u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/e/ecdsautils/ecdsautils_0.3.2+git20151018-2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/e/ecdsautils/ecdsautils_0.3.2+git20151018-2+deb10u1.dsc changelog | 8 + patches/0001-verify-fix-signature-verification-CVE-2022-24884.patch | 46 ++++++++++ patches/series | 1 3 files changed, 55 insertions(+) gpgv: Signature made Sat Oct 24 12:06:59 2015 UTC gpgv: using RSA key 2FD8BEDAC020EED1 gpgv: Can't check signature: No public key dpkg-source: warning: failed to verify signature on /srv/release.debian.org/tmp/tmp5294749c/ecdsautils_0.3.2+git20151018-2.dsc diff -Nru ecdsautils-0.3.2+git20151018/debian/changelog ecdsautils-0.3.2+git20151018/debian/changelog --- ecdsautils-0.3.2+git20151018/debian/changelog 2015-10-24 12:06:02.000000000 +0000 +++ ecdsautils-0.3.2+git20151018/debian/changelog 2022-05-05 17:13:10.000000000 +0000 @@ -1,3 +1,11 @@ +ecdsautils (0.3.2+git20151018-2+deb10u1) buster-security; urgency=medium + + * debian/patches: + - Add 0001-verify-fix-signature-verification-CVE-2022-24884.patch, + Fix CVE-2022-24884: Improper Verification of ECDSA Signatures + + -- Sven Eckelmann Thu, 05 May 2022 19:13:10 +0200 + ecdsautils (0.3.2+git20151018-2) unstable; urgency=low * Fixed build depends (Closes: #802798). diff -Nru ecdsautils-0.3.2+git20151018/debian/patches/0001-verify-fix-signature-verification-CVE-2022-24884.patch ecdsautils-0.3.2+git20151018/debian/patches/0001-verify-fix-signature-verification-CVE-2022-24884.patch --- ecdsautils-0.3.2+git20151018/debian/patches/0001-verify-fix-signature-verification-CVE-2022-24884.patch 1970-01-01 00:00:00.000000000 +0000 +++ ecdsautils-0.3.2+git20151018/debian/patches/0001-verify-fix-signature-verification-CVE-2022-24884.patch 2022-05-05 17:13:10.000000000 +0000 @@ -0,0 +1,46 @@ +From: Matthias Schiffer +Date: Wed, 20 Apr 2022 22:04:07 +0200 +Subject: verify: fix signature verification (CVE-2022-24884) + +Verify that r and s are non-zero. Without these checks, an all-zero +signature is always considered valid. + +While it would be nicer to error out in ecdsa_verify_prepare_legacy() +already, that would require users of libecdsautil to check a return value +of the prepare step. To be safe, implement the fix in an API/ABI-compatible +way that doesn't need changes to the users. + +Origin: backport, https://github.com/freifunk-gluon/ecdsautils/commit/1d4b091abdf15ad7b2312535b5b95ad70f6dbd08 +--- + src/ecdsa.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/src/ecdsa.c b/src/ecdsa.c +index 8e97400..1a3a0d3 100644 +--- a/src/ecdsa.c ++++ b/src/ecdsa.c +@@ -65,6 +65,13 @@ void ecdsa_verify_prepare(ecdsa_verify_context *ctx, const ecc_int256_t *hash, c + ecc_int256_t tmp, w, u1; + + ecdsa_split_signature(&ctx->r, &tmp, signature); ++ ++ if (ecc_25519_gf_is_zero(&tmp) || ecc_25519_gf_is_zero(&ctx->r)) { ++ // Signature is invalid, mark by setting ctx->r to an invalid value ++ memset(&ctx->r, 0, sizeof(ctx->r)); ++ return; ++ } ++ + ecc_25519_gf_recip(&w, &tmp); + + ecc_25519_gf_reduce(&tmp, hash); +@@ -78,6 +85,10 @@ void ecdsa_verify_prepare(ecdsa_verify_context *ctx, const ecc_int256_t *hash, c + int ecdsa_verify_with_pubkey(const ecdsa_verify_context *ctx, const ecc_25519_work_t *pubkey) { + ecc_25519_work_t s2, work; + ecc_int256_t w, tmp; ++ ++ // Signature was detected as invalid in prepare step ++ if (ecc_25519_gf_is_zero(&ctx->r)) ++ return 0; + + ecc_25519_scalarmult(&s2, &ctx->u2, pubkey); + ecc_25519_add(&work, &ctx->s1, &s2); diff -Nru ecdsautils-0.3.2+git20151018/debian/patches/series ecdsautils-0.3.2+git20151018/debian/patches/series --- ecdsautils-0.3.2+git20151018/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ ecdsautils-0.3.2+git20151018/debian/patches/series 2022-05-05 17:13:10.000000000 +0000 @@ -0,0 +1 @@ +0001-verify-fix-signature-verification-CVE-2022-24884.patch