Version in base suite: 0.0~git20170911.b7efc62-1 Base version: golang-github-russellhaering-goxmldsig_0.0~git20170911.b7efc62-1 Target version: golang-github-russellhaering-goxmldsig_0.0~git20170911.b7efc62-1+deb10u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/golang-github-russellhaering-goxmldsig/golang-github-russellhaering-goxmldsig_0.0~git20170911.b7efc62-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/g/golang-github-russellhaering-goxmldsig/golang-github-russellhaering-goxmldsig_0.0~git20170911.b7efc62-1+deb10u1.dsc changelog | 9 + patches/CVE-2020-15216.patch | 283 +++++++++++++++++++++++++++++++++++++++++++ patches/CVE-2020-7711.patch | 23 +++ patches/series | 2 4 files changed, 317 insertions(+) diff -Nru golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/changelog golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/changelog --- golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/changelog 2017-10-22 19:06:15.000000000 +0000 +++ golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/changelog 2022-03-27 16:32:49.000000000 +0000 @@ -1,3 +1,12 @@ +golang-github-russellhaering-goxmldsig (0.0~git20170911.b7efc62-1+deb10u1) buster; urgency=medium + + * CVE-2020-7711 + null pointer dereference caused by crafted XML signatures + (Closes: #968928 + * according to ratt, nothing else has to be built + + -- Thorsten Alteholz Sun, 27 Mar 2022 18:32:49 +0200 + golang-github-russellhaering-goxmldsig (0.0~git20170911.b7efc62-1) unstable; urgency=medium * Initial release (Closes: #879550) diff -Nru golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/CVE-2020-15216.patch golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/CVE-2020-15216.patch --- golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/CVE-2020-15216.patch 1970-01-01 00:00:00.000000000 +0000 +++ golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/CVE-2020-15216.patch 2022-03-27 16:32:49.000000000 +0000 @@ -0,0 +1,283 @@ +commit f6188febf0c29d7ffe26a0436212b19cb9615e64 +Author: Russell Haering +Date: Tue Sep 8 10:51:49 2020 -0700 + + Validate the shape of a signature object prior to unmarshalling the Signature + +Index: golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/validate.go +=================================================================== +--- golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62.orig/validate.go 2022-03-27 19:21:59.081424120 +0200 ++++ golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/validate.go 2022-03-27 19:35:49.925815346 +0200 +@@ -21,6 +21,7 @@ + // ErrMissingSignature indicates that no enveloped signature was found referencing + // the top level element passed for signature verification. + ErrMissingSignature = errors.New("Missing signature referencing the top-level element") ++ ErrInvalidSignature = errors.New( "Invalid Signature") + ) + + type ValidationContext struct { +@@ -256,9 +257,28 @@ + return false + } + ++// In most places, we use etree Elements, but while deserializing the Signature, we use ++// encoding/xml unmarshal directly to convert to a convenient go struct. This presents a problem in some cases because ++// when an xml element repeats under the parent, the last element will win and/or be appended. We need to assert that ++// the Signature object matches the expected shape of a Signature object. ++func validateShape(signatureEl *etree.Element) error { ++ children := signatureEl.ChildElements() ++ ++ childCounts := map[string]int{} ++ for _, child := range children { ++ childCounts[child.Tag]++ ++ } ++ ++ validateCount := childCounts[SignedInfoTag] == 1 && childCounts[KeyInfoTag] <= 1 && childCounts[SignatureValueTag] == 1 ++ if !validateCount { ++ return ErrInvalidSignature ++ } ++ return nil ++} ++ + // findSignature searches for a Signature element referencing the passed root element. +-func (ctx *ValidationContext) findSignature(el *etree.Element) (*types.Signature, error) { +- idAttr := el.SelectAttr(ctx.IdAttribute) ++func (ctx *ValidationContext) findSignature(root *etree.Element) (*types.Signature, error) { ++ idAttr := root.SelectAttr(ctx.IdAttribute) + if idAttr == nil || idAttr.Value == "" { + return nil, errors.New("Missing ID attribute") + } +@@ -266,13 +286,16 @@ + var sig *types.Signature + + // Traverse the tree looking for a Signature element +- err := etreeutils.NSFindIterate(el, Namespace, SignatureTag, func(ctx etreeutils.NSContext, el *etree.Element) error { +- ++ err := etreeutils.NSFindIterate(root, Namespace, SignatureTag, func(ctx etreeutils.NSContext, signatureEl *etree.Element) error { ++ err := validateShape(signatureEl) ++ if err != nil { ++ return err ++ } + found := false +- err := etreeutils.NSFindIterateCtx(ctx, el, Namespace, SignedInfoTag, ++ err = etreeutils.NSFindIterateCtx(ctx, signatureEl, Namespace, SignedInfoTag, + func(ctx etreeutils.NSContext, signedInfo *etree.Element) error { + // Ignore any SignedInfo that isn't an immediate descendent of Signature. +- if signedInfo.Parent() != el { ++ if signedInfo.Parent() != signatureEl { + return nil + } + +@@ -310,8 +333,8 @@ + return fmt.Errorf("invalid CanonicalizationMethod on Signature: %s", c14NAlgorithm) + } + +- el.RemoveChild(signedInfo) +- el.AddChild(canonicalSignedInfo) ++ signatureEl.RemoveChild(signedInfo) ++ signatureEl.AddChild(canonicalSignedInfo) + + found = true + +@@ -327,7 +350,7 @@ + + // Unmarshal the signature into a structured Signature type + _sig := &types.Signature{} +- err = etreeutils.NSUnmarshalElement(ctx, el, _sig) ++ err = etreeutils.NSUnmarshalElement(ctx, signatureEl, _sig) + if err != nil { + return err + } +Index: golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/validate_test.go +=================================================================== +--- golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62.orig/validate_test.go 2022-03-27 19:21:59.081424120 +0200 ++++ golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/validate_test.go 2022-03-27 19:21:59.065424112 +0200 +@@ -203,3 +203,188 @@ + require.NoError(t, err) + require.NotEmpty(t, el) + } ++ ++const ( ++ validateCert = ` ++-----BEGIN CERTIFICATE----- ++MIIDnjCCAoagAwIBAgIGAXHxS90vMA0GCSqGSIb3DQEBCwUAMIGPMQswCQYDVQQG ++EwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNj ++bzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMM ++B2FzYS1kZXYxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMjAwNTA3 ++MjIzOTEzWhcNMzAwNTA3MjI0MDEzWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgM ++CkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9r ++dGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdhc2EtZGV2MRwwGgYJ ++KoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A ++MIIBCgKCAQEAqlQF++AiiKrOb5MVwN8YEgFCbOdLSO44hcJq2BYZYRd1oq1XVnz7 ++fVC49YgPXRafpXJx4v8jWyRQug2Sv4nEMvsbVzrV9N09/RHQ1MVa4QlTUEAhR0nS ++zs897k2e6zObf/zx5ugE+GLx03+chYFVv1ICup0e0pRNS6OWHYFzZnLTlCEgAbay ++HkbA82EViqgWD53BNQLvsS06WztF4pGISyxZ2NpycV5ejmI3ZSr6+bKXcgNAWr7i ++nNBUaOwJG52/NlBAKaMq56Bljsni6YmZ/9V2DbQgTHSn4mu+++4FdDtFxBe1ZPID ++JpjguXf9X183H7ZIkNOxkr+YlW02uzOpBQIDAQABMA0GCSqGSIb3DQEBCwUAA4IB ++AQBRX6NORxMS4cDWkG/PqlYcCjgwZA/8rd6dBkI+wJEzqrXmO1SSIQW6F48ahDVq ++T0nicDYSnTkplIbKmooKjm2kkuCIjLwDiLldpZZ/Hpdj9rGDLC2jS6m3dr6OQvoT ++DYPOXfrgMykc5VM+h9yx+iYbrilmmrhOwIPxxZDVUiRSB6Op716xk+9d0jlyrtFF ++77B3YlKgMThQG6rguXViSwmViywWx+UQD6F1OzES8hoL54hfriOnlIpzZeamtJCo ++/jcdeqYHi3ru+uHOBe91GFPtoDGCVuk7YvzlXKMdgyDx82+kRSnLWYMxaI2zleFY ++nXHhoQk3K5iSdQT/gFgKJk89 ++-----END CERTIFICATE-----` ++) ++ ++func TestValidateWithValid(t *testing.T) { ++ doc := etree.NewDocument() ++ err := doc.ReadFromBytes([]byte(validExample)) ++ require.NoError(t, err) ++ ++ block, _ := pem.Decode([]byte(validateCert)) ++ cert, err := x509.ParseCertificate(block.Bytes) ++ require.NoError(t, err, "couldn't parse okta cert pem block") ++ ++ certStore := MemoryX509CertificateStore{ ++ Roots: []*x509.Certificate{cert}, ++ } ++ vc := NewDefaultValidationContext(&certStore) ++ ++ el, err := vc.Validate(doc.Root()) ++ require.NoError(t, err) ++ require.NotEmpty(t, el) ++} ++ ++ ++func TestValidateWithModified(t *testing.T) { ++ doc := etree.NewDocument() ++ err := doc.ReadFromBytes([]byte(modifiedToBeTodd)) ++ require.NoError(t, err) ++ ++ block, _ := pem.Decode([]byte(validateCert)) ++ cert, err := x509.ParseCertificate(block.Bytes) ++ require.NoError(t, err, "couldn't parse okta cert pem block") ++ ++ certStore := MemoryX509CertificateStore{ ++ Roots: []*x509.Certificate{cert}, ++ } ++ vc := NewDefaultValidationContext(&certStore) ++ ++ _, err = vc.Validate(doc.Root()) ++ require.Error(t, err) ++} ++ ++ ++func TestValidateWithModifiedAndSignatureEdited(t *testing.T) { ++ doc := etree.NewDocument() ++ err := doc.ReadFromBytes([]byte(spoofedAsTodd)) ++ require.NoError(t, err) ++ ++ block, _ := pem.Decode([]byte(validateCert)) ++ cert, err := x509.ParseCertificate(block.Bytes) ++ require.NoError(t, err, "couldn't parse okta cert pem block") ++ ++ certStore := MemoryX509CertificateStore{ ++ Roots: []*x509.Certificate{cert}, ++ } ++ vc := NewDefaultValidationContext(&certStore) ++ ++ _, err = vc.Validate(doc.Root()) ++ require.Error(t, err) ++} ++ ++const ( ++ validExample = `http://www.okta.com/exkrfkzzb7NyB3UeP0h7LwRDkrPmsTcUa++BIS5VJIANUlZN7zzdtjLfxfLAWds=UyjNRj9ZFbhApPhWEuVG26yACVqd25uyRKalSpp6XCdjrqKjI8Fmx7Q/IFkk5M755cxyFCQGttxThR6IPBk4Kp5OG2qGKXNHt7OQ8mumSLqWZpBJbmzNIKyG3nWlFoLVCoWPtBTd2gZM0aHOQp1JKa1birFBp2NofkEXbLeghZQ2YfCc4m8qgpZW5k/Itc0P/TVIkvPInjdSMyjm/ql4FUDO8cMkExJNR/i+GElW8cfnniWGcDPSiOqfIjLEDvZouXC7F1v5Wa0SmIxg7NJUTB+g6yrDN15VDq3KbHHTMlZXOZTXON2mBZOj5cwyyd4uX3aGSmYQiy/CGqBdqxrW2A==MIIDnjCCAoagAwIBAgIGAXHxS90vMA0GCSqGSIb3DQEBCwUAMIGPMQswCQYDVQQGEwJVUzETMBEG ++A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU ++MBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2FzYS1kZXYxHDAaBgkqhkiG9w0BCQEWDWlu ++Zm9Ab2t0YS5jb20wHhcNMjAwNTA3MjIzOTEzWhcNMzAwNTA3MjI0MDEzWjCBjzELMAkGA1UEBhMC ++VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM ++BE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdhc2EtZGV2MRwwGgYJKoZIhvcN ++AQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqlQF++Ai ++iKrOb5MVwN8YEgFCbOdLSO44hcJq2BYZYRd1oq1XVnz7fVC49YgPXRafpXJx4v8jWyRQug2Sv4nE ++MvsbVzrV9N09/RHQ1MVa4QlTUEAhR0nSzs897k2e6zObf/zx5ugE+GLx03+chYFVv1ICup0e0pRN ++S6OWHYFzZnLTlCEgAbayHkbA82EViqgWD53BNQLvsS06WztF4pGISyxZ2NpycV5ejmI3ZSr6+bKX ++cgNAWr7inNBUaOwJG52/NlBAKaMq56Bljsni6YmZ/9V2DbQgTHSn4mu+++4FdDtFxBe1ZPIDJpjg ++uXf9X183H7ZIkNOxkr+YlW02uzOpBQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBRX6NORxMS4cDW ++kG/PqlYcCjgwZA/8rd6dBkI+wJEzqrXmO1SSIQW6F48ahDVqT0nicDYSnTkplIbKmooKjm2kkuCI ++jLwDiLldpZZ/Hpdj9rGDLC2jS6m3dr6OQvoTDYPOXfrgMykc5VM+h9yx+iYbrilmmrhOwIPxxZDV ++UiRSB6Op716xk+9d0jlyrtFF77B3YlKgMThQG6rguXViSwmViywWx+UQD6F1OzES8hoL54hfriOn ++lIpzZeamtJCo/jcdeqYHi3ru+uHOBe91GFPtoDGCVuk7YvzlXKMdgyDx82+kRSnLWYMxaI2zleFY ++nXHhoQk3K5iSdQT/gFgKJk89http://www.okta.com/exkrfkzzb7NyB3UeP0h7nrIzAXSDsFwgvCm+ulbqfqZylzPxCBof6FYDcCEPdCQ=en3gX+6oIzNnkUWPbIAZp3rX8kHelobV3qqNSQ/JXQAZX7Up42D1pU6dWNc68xLe7RCDr3xV6zFG2bpi+NyZlsmqyKIXot5W6cM0BKkmRxQDcR1ThwP/VrFQ2HRxKTDUNeNCkTGBDfbwyD+w9RuCZO5JP2DX7DBHFBaTQQ+/9EhPSEx6yvJ05CwJ8eoNd/0ib+FCF1VDn9haP0viA8cOg3ApMkpwJsPXvMpb6U/q1tGgtzcyvqYDfAkWYGG0YPk3BsTUhSa7dN/ZI6O+7ZDGtWQohhYCAXBShrM7OWwJBDA5J+AXo7wFWKMt36u+MqGu2hBC58t7NpkZXehBRhvmmg==MIIDnjCCAoagAwIBAgIGAXHxS90vMA0GCSqGSIb3DQEBCwUAMIGPMQswCQYDVQQGEwJVUzETMBEG ++A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU ++MBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2FzYS1kZXYxHDAaBgkqhkiG9w0BCQEWDWlu ++Zm9Ab2t0YS5jb20wHhcNMjAwNTA3MjIzOTEzWhcNMzAwNTA3MjI0MDEzWjCBjzELMAkGA1UEBhMC ++VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM ++BE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdhc2EtZGV2MRwwGgYJKoZIhvcN ++AQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqlQF++Ai ++iKrOb5MVwN8YEgFCbOdLSO44hcJq2BYZYRd1oq1XVnz7fVC49YgPXRafpXJx4v8jWyRQug2Sv4nE ++MvsbVzrV9N09/RHQ1MVa4QlTUEAhR0nSzs897k2e6zObf/zx5ugE+GLx03+chYFVv1ICup0e0pRN ++S6OWHYFzZnLTlCEgAbayHkbA82EViqgWD53BNQLvsS06WztF4pGISyxZ2NpycV5ejmI3ZSr6+bKX ++cgNAWr7inNBUaOwJG52/NlBAKaMq56Bljsni6YmZ/9V2DbQgTHSn4mu+++4FdDtFxBe1ZPIDJpjg ++uXf9X183H7ZIkNOxkr+YlW02uzOpBQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBRX6NORxMS4cDW ++kG/PqlYcCjgwZA/8rd6dBkI+wJEzqrXmO1SSIQW6F48ahDVqT0nicDYSnTkplIbKmooKjm2kkuCI ++jLwDiLldpZZ/Hpdj9rGDLC2jS6m3dr6OQvoTDYPOXfrgMykc5VM+h9yx+iYbrilmmrhOwIPxxZDV ++UiRSB6Op716xk+9d0jlyrtFF77B3YlKgMThQG6rguXViSwmViywWx+UQD6F1OzES8hoL54hfriOn ++lIpzZeamtJCo/jcdeqYHi3ru+uHOBe91GFPtoDGCVuk7YvzlXKMdgyDx82+kRSnLWYMxaI2zleFY ++nXHhoQk3K5iSdQT/gFgKJk89phoebe.yu@okta.comhttps://dev.sudo.wtf:8443/v1/teams/asaurn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransportPhoebeYuphoebe.yu@okta.comphoebe.yu@okta.com` ++ modifiedToBeTodd = `http://www.okta.com/exkrfkzzb7NyB3UeP0h7LwRDkrPmsTcUa++BIS5VJIANUlZN7zzdtjLfxfLAWds=UyjNRj9ZFbhApPhWEuVG26yACVqd25uyRKalSpp6XCdjrqKjI8Fmx7Q/IFkk5M755cxyFCQGttxThR6IPBk4Kp5OG2qGKXNHt7OQ8mumSLqWZpBJbmzNIKyG3nWlFoLVCoWPtBTd2gZM0aHOQp1JKa1birFBp2NofkEXbLeghZQ2YfCc4m8qgpZW5k/Itc0P/TVIkvPInjdSMyjm/ql4FUDO8cMkExJNR/i+GElW8cfnniWGcDPSiOqfIjLEDvZouXC7F1v5Wa0SmIxg7NJUTB+g6yrDN15VDq3KbHHTMlZXOZTXON2mBZOj5cwyyd4uX3aGSmYQiy/CGqBdqxrW2A==MIIDnjCCAoagAwIBAgIGAXHxS90vMA0GCSqGSIb3DQEBCwUAMIGPMQswCQYDVQQGEwJVUzETMBEG ++A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU ++MBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2FzYS1kZXYxHDAaBgkqhkiG9w0BCQEWDWlu ++Zm9Ab2t0YS5jb20wHhcNMjAwNTA3MjIzOTEzWhcNMzAwNTA3MjI0MDEzWjCBjzELMAkGA1UEBhMC ++VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM ++BE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdhc2EtZGV2MRwwGgYJKoZIhvcN ++AQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqlQF++Ai ++iKrOb5MVwN8YEgFCbOdLSO44hcJq2BYZYRd1oq1XVnz7fVC49YgPXRafpXJx4v8jWyRQug2Sv4nE ++MvsbVzrV9N09/RHQ1MVa4QlTUEAhR0nSzs897k2e6zObf/zx5ugE+GLx03+chYFVv1ICup0e0pRN ++S6OWHYFzZnLTlCEgAbayHkbA82EViqgWD53BNQLvsS06WztF4pGISyxZ2NpycV5ejmI3ZSr6+bKX ++cgNAWr7inNBUaOwJG52/NlBAKaMq56Bljsni6YmZ/9V2DbQgTHSn4mu+++4FdDtFxBe1ZPIDJpjg ++uXf9X183H7ZIkNOxkr+YlW02uzOpBQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBRX6NORxMS4cDW ++kG/PqlYcCjgwZA/8rd6dBkI+wJEzqrXmO1SSIQW6F48ahDVqT0nicDYSnTkplIbKmooKjm2kkuCI ++jLwDiLldpZZ/Hpdj9rGDLC2jS6m3dr6OQvoTDYPOXfrgMykc5VM+h9yx+iYbrilmmrhOwIPxxZDV ++UiRSB6Op716xk+9d0jlyrtFF77B3YlKgMThQG6rguXViSwmViywWx+UQD6F1OzES8hoL54hfriOn ++lIpzZeamtJCo/jcdeqYHi3ru+uHOBe91GFPtoDGCVuk7YvzlXKMdgyDx82+kRSnLWYMxaI2zleFY ++nXHhoQk3K5iSdQT/gFgKJk89http://www.okta.com/exkrfkzzb7NyB3UeP0h7nrIzAXSDsFwgvCm+ulbqfqZylzPxCBof6FYDcCEPdCQ=en3gX+6oIzNnkUWPbIAZp3rX8kHelobV3qqNSQ/JXQAZX7Up42D1pU6dWNc68xLe7RCDr3xV6zFG2bpi+NyZlsmqyKIXot5W6cM0BKkmRxQDcR1ThwP/VrFQ2HRxKTDUNeNCkTGBDfbwyD+w9RuCZO5JP2DX7DBHFBaTQQ+/9EhPSEx6yvJ05CwJ8eoNd/0ib+FCF1VDn9haP0viA8cOg3ApMkpwJsPXvMpb6U/q1tGgtzcyvqYDfAkWYGG0YPk3BsTUhSa7dN/ZI6O+7ZDGtWQohhYCAXBShrM7OWwJBDA5J+AXo7wFWKMt36u+MqGu2hBC58t7NpkZXehBRhvmmg==MIIDnjCCAoagAwIBAgIGAXHxS90vMA0GCSqGSIb3DQEBCwUAMIGPMQswCQYDVQQGEwJVUzETMBEG ++A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU ++MBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2FzYS1kZXYxHDAaBgkqhkiG9w0BCQEWDWlu ++Zm9Ab2t0YS5jb20wHhcNMjAwNTA3MjIzOTEzWhcNMzAwNTA3MjI0MDEzWjCBjzELMAkGA1UEBhMC ++VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM ++BE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdhc2EtZGV2MRwwGgYJKoZIhvcN ++AQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqlQF++Ai ++iKrOb5MVwN8YEgFCbOdLSO44hcJq2BYZYRd1oq1XVnz7fVC49YgPXRafpXJx4v8jWyRQug2Sv4nE ++MvsbVzrV9N09/RHQ1MVa4QlTUEAhR0nSzs897k2e6zObf/zx5ugE+GLx03+chYFVv1ICup0e0pRN ++S6OWHYFzZnLTlCEgAbayHkbA82EViqgWD53BNQLvsS06WztF4pGISyxZ2NpycV5ejmI3ZSr6+bKX ++cgNAWr7inNBUaOwJG52/NlBAKaMq56Bljsni6YmZ/9V2DbQgTHSn4mu+++4FdDtFxBe1ZPIDJpjg ++uXf9X183H7ZIkNOxkr+YlW02uzOpBQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBRX6NORxMS4cDW ++kG/PqlYcCjgwZA/8rd6dBkI+wJEzqrXmO1SSIQW6F48ahDVqT0nicDYSnTkplIbKmooKjm2kkuCI ++jLwDiLldpZZ/Hpdj9rGDLC2jS6m3dr6OQvoTDYPOXfrgMykc5VM+h9yx+iYbrilmmrhOwIPxxZDV ++UiRSB6Op716xk+9d0jlyrtFF77B3YlKgMThQG6rguXViSwmViywWx+UQD6F1OzES8hoL54hfriOn ++lIpzZeamtJCo/jcdeqYHi3ru+uHOBe91GFPtoDGCVuk7YvzlXKMdgyDx82+kRSnLWYMxaI2zleFY ++nXHhoQk3K5iSdQT/gFgKJk89todd@okta.comhttps://dev.sudo.wtf:8443/v1/teams/asaurn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransportPhoebeYuphoebe.yu@okta.comphoebe.yu@okta.com` ++ spoofedAsTodd = `http://www.okta.com/exkrfkzzb7NyB3UeP0h7UyjNRj9ZFbhApPhWEuVG26yACVqd25uyRKalSpp6XCdjrqKjI8Fmx7Q/IFkk5M755cxyFCQGttxThR6IPBk4Kp5OG2qGKXNHt7OQ8mumSLqWZpBJbmzNIKyG3nWlFoLVCoWPtBTd2gZM0aHOQp1JKa1birFBp2NofkEXbLeghZQ2YfCc4m8qgpZW5k/Itc0P/TVIkvPInjdSMyjm/ql4FUDO8cMkExJNR/i+GElW8cfnniWGcDPSiOqfIjLEDvZouXC7F1v5Wa0SmIxg7NJUTB+g6yrDN15VDq3KbHHTMlZXOZTXON2mBZOj5cwyyd4uX3aGSmYQiy/CGqBdqxrW2A==MIIDnjCCAoagAwIBAgIGAXHxS90vMA0GCSqGSIb3DQEBCwUAMIGPMQswCQYDVQQGEwJVUzETMBEG ++A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU ++MBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2FzYS1kZXYxHDAaBgkqhkiG9w0BCQEWDWlu ++Zm9Ab2t0YS5jb20wHhcNMjAwNTA3MjIzOTEzWhcNMzAwNTA3MjI0MDEzWjCBjzELMAkGA1UEBhMC ++VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM ++BE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdhc2EtZGV2MRwwGgYJKoZIhvcN ++AQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqlQF++Ai ++iKrOb5MVwN8YEgFCbOdLSO44hcJq2BYZYRd1oq1XVnz7fVC49YgPXRafpXJx4v8jWyRQug2Sv4nE ++MvsbVzrV9N09/RHQ1MVa4QlTUEAhR0nSzs897k2e6zObf/zx5ugE+GLx03+chYFVv1ICup0e0pRN ++S6OWHYFzZnLTlCEgAbayHkbA82EViqgWD53BNQLvsS06WztF4pGISyxZ2NpycV5ejmI3ZSr6+bKX ++cgNAWr7inNBUaOwJG52/NlBAKaMq56Bljsni6YmZ/9V2DbQgTHSn4mu+++4FdDtFxBe1ZPIDJpjg ++uXf9X183H7ZIkNOxkr+YlW02uzOpBQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBRX6NORxMS4cDW ++kG/PqlYcCjgwZA/8rd6dBkI+wJEzqrXmO1SSIQW6F48ahDVqT0nicDYSnTkplIbKmooKjm2kkuCI ++jLwDiLldpZZ/Hpdj9rGDLC2jS6m3dr6OQvoTDYPOXfrgMykc5VM+h9yx+iYbrilmmrhOwIPxxZDV ++UiRSB6Op716xk+9d0jlyrtFF77B3YlKgMThQG6rguXViSwmViywWx+UQD6F1OzES8hoL54hfriOn ++lIpzZeamtJCo/jcdeqYHi3ru+uHOBe91GFPtoDGCVuk7YvzlXKMdgyDx82+kRSnLWYMxaI2zleFY ++nXHhoQk3K5iSdQT/gFgKJk89cFNZV8Uh+WR8yPmPqAfktrxO0DtlNv7WIVf/iQbuwR0=LwRDkrPmsTcUa++BIS5VJIANUlZN7zzdtjLfxfLAWds=http://www.okta.com/exkrfkzzb7NyB3UeP0h7en3gX+6oIzNnkUWPbIAZp3rX8kHelobV3qqNSQ/JXQAZX7Up42D1pU6dWNc68xLe7RCDr3xV6zFG2bpi+NyZlsmqyKIXot5W6cM0BKkmRxQDcR1ThwP/VrFQ2HRxKTDUNeNCkTGBDfbwyD+w9RuCZO5JP2DX7DBHFBaTQQ+/9EhPSEx6yvJ05CwJ8eoNd/0ib+FCF1VDn9haP0viA8cOg3ApMkpwJsPXvMpb6U/q1tGgtzcyvqYDfAkWYGG0YPk3BsTUhSa7dN/ZI6O+7ZDGtWQohhYCAXBShrM7OWwJBDA5J+AXo7wFWKMt36u+MqGu2hBC58t7NpkZXehBRhvmmg==MIIDnjCCAoagAwIBAgIGAXHxS90vMA0GCSqGSIb3DQEBCwUAMIGPMQswCQYDVQQGEwJVUzETMBEG ++A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU ++MBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2FzYS1kZXYxHDAaBgkqhkiG9w0BCQEWDWlu ++Zm9Ab2t0YS5jb20wHhcNMjAwNTA3MjIzOTEzWhcNMzAwNTA3MjI0MDEzWjCBjzELMAkGA1UEBhMC ++VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoM ++BE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdhc2EtZGV2MRwwGgYJKoZIhvcN ++AQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqlQF++Ai ++iKrOb5MVwN8YEgFCbOdLSO44hcJq2BYZYRd1oq1XVnz7fVC49YgPXRafpXJx4v8jWyRQug2Sv4nE ++MvsbVzrV9N09/RHQ1MVa4QlTUEAhR0nSzs897k2e6zObf/zx5ugE+GLx03+chYFVv1ICup0e0pRN ++S6OWHYFzZnLTlCEgAbayHkbA82EViqgWD53BNQLvsS06WztF4pGISyxZ2NpycV5ejmI3ZSr6+bKX ++cgNAWr7inNBUaOwJG52/NlBAKaMq56Bljsni6YmZ/9V2DbQgTHSn4mu+++4FdDtFxBe1ZPIDJpjg ++uXf9X183H7ZIkNOxkr+YlW02uzOpBQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBRX6NORxMS4cDW ++kG/PqlYcCjgwZA/8rd6dBkI+wJEzqrXmO1SSIQW6F48ahDVqT0nicDYSnTkplIbKmooKjm2kkuCI ++jLwDiLldpZZ/Hpdj9rGDLC2jS6m3dr6OQvoTDYPOXfrgMykc5VM+h9yx+iYbrilmmrhOwIPxxZDV ++UiRSB6Op716xk+9d0jlyrtFF77B3YlKgMThQG6rguXViSwmViywWx+UQD6F1OzES8hoL54hfriOn ++lIpzZeamtJCo/jcdeqYHi3ru+uHOBe91GFPtoDGCVuk7YvzlXKMdgyDx82+kRSnLWYMxaI2zleFY ++nXHhoQk3K5iSdQT/gFgKJk89JaSnCMsKnmGg4Ew3yXuUdRPCmlzJngSWW1RZYH15Exk=nrIzAXSDsFwgvCm+ulbqfqZylzPxCBof6FYDcCEPdCQ=todd@okta.comhttps://dev.sudo.wtf:8443/v1/teams/asaurn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransportPhoebeYuphoebe.yu@okta.comphoebe.yu@okta.com` ++) diff -Nru golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/CVE-2020-7711.patch golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/CVE-2020-7711.patch --- golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/CVE-2020-7711.patch 1970-01-01 00:00:00.000000000 +0000 +++ golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/CVE-2020-7711.patch 2022-03-27 16:32:49.000000000 +0000 @@ -0,0 +1,23 @@ +commit fb23e0af61c023e3a6dae8ad30dbd0f04d8a4d8f +Merge: 3541f5e ca2b448 +Author: Russell Haering +Date: Fri Aug 27 20:19:01 2021 -0700 + + Merge pull request #71 from aporcupine/patch-1 + + Explicitly check for case where SignatureValue is nil + +Index: golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/validate.go +=================================================================== +--- golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62.orig/validate.go 2022-03-24 02:42:51.769521402 +0100 ++++ golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/validate.go 2022-03-24 02:42:51.765521402 +0100 +@@ -227,6 +227,9 @@ + if !bytes.Equal(digest, decodedDigestValue) { + return nil, errors.New("Signature could not be verified") + } ++ if sig.SignatureValue == nil { ++ return nil, errors.New("Signature could not be verified") ++ } + + // Decode the 'SignatureValue' so we can compare against it + decodedSignature, err := base64.StdEncoding.DecodeString(sig.SignatureValue.Data) diff -Nru golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/series golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/series --- golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ golang-github-russellhaering-goxmldsig-0.0~git20170911.b7efc62/debian/patches/series 2022-03-27 16:32:49.000000000 +0000 @@ -0,0 +1,2 @@ +CVE-2020-7711.patch +CVE-2020-15216.patch