package/libtomcrypt: add security patch for CVE-2019-17362
authorThomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Mon, 23 Dec 2019 15:03:37 +0000 (16:03 +0100)
committerThomas Petazzoni <thomas.petazzoni@bootlin.com>
Mon, 23 Dec 2019 19:51:00 +0000 (20:51 +0100)
commit62b34ed33ba4f2ee17046aa4d38a13840597f636
treeb972f4daa6275317d4dc8545dd2d85f7d6aee4a0
parent71323def347fb75154c2ba3227cb15d54a24fecd
package/libtomcrypt: add security patch for CVE-2019-17362

CVE-2019-17362:
"The der_decode_utf8_string function (in der_decode_utf8_string.c) does not
properly detect certain invalid UTF-8 sequences.  This allows
context-dependent attackers to cause a denial of service (out-of-bounds read
and crash) or read information from other memory locations via carefully
crafted DER-encoded data."

Details:
https://github.com/libtom/libtomcrypt/issues/507
https://nvd.nist.gov/vuln/detail/CVE-2019-17362

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
package/libtomcrypt/0001-fix-CVE-2019-17362.patch [new file with mode: 0644]