untrusted comment: verify with openbsd-67-base.pub
RWRmkIA877Io3u4xquVACayb1uI1KLL/br6KM8ES3ZXMfWxjyjNOahBqFF5UJYbMZ0zYtOW37QAHXnpZ070YDRkdL69KclNK8g4=
OpenBSD 6.7 errata 015, July 27, 2020:
In rpki-client, incorrect use of EVP_PKEY_cmp allows an authentication bypass.
Apply by doing:
signify -Vep /etc/signify/openbsd-67-base.pub -x 015_rpki.patch.sig \
-m - | (cd /usr/src && patch -p0)
And then rebuild and install rpki-client:
cd /usr/src/usr.sbin/rpki-client
make obj
make
make install
Index: usr.sbin/rpki-client/cert.c
===================================================================
RCS file: /cvs/src/usr.sbin/rpki-client/cert.c,v
diff -u -p -u -r1.15 cert.c
--- usr.sbin/rpki-client/cert.c 2 Apr 2020 09:16:43 -0000 1.15
+++ usr.sbin/rpki-client/cert.c 23 Jul 2020 16:00:06 -0000
@@ -1128,7 +1128,7 @@ ta_parse(X509 **xp, const char *fn, cons
if ((opk = X509_get_pubkey(*xp)) == NULL)
cryptowarnx("%s: RFC 6487 (trust anchor): "
"missing pubkey", fn);
- else if (!EVP_PKEY_cmp(pk, opk))
+ else if (EVP_PKEY_cmp(pk, opk) != 1)
cryptowarnx("%s: RFC 6487 (trust anchor): "
"pubkey does not match TAL pubkey", fn);
else
@@ -1136,8 +1136,7 @@ ta_parse(X509 **xp, const char *fn, cons
EVP_PKEY_free(pk);
EVP_PKEY_free(opk);
- } else
- rc = 1;
+ }
if (rc == 0) {
cert_free(p);
