Bug 1153385 (CVE-2019-17359)

Summary:	VUL-0: CVE-2019-17359: bouncycastle: OutOfMemoryError via crafted ASN.1 data
Product:	[openSUSE] openSUSE Distribution	Reporter:	Alexander Bergmann <abergmann>
Component:	Basesystem	Assignee:	Security Team bot <security-team>
Status:	NEW ---	QA Contact:	Security Team bot <security-team>
Severity:	Minor
Priority:	P3 - Medium	CC:	abergmann, pmonrealgonzalez
Version:	Leap 15.1
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/244441/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Alexander Bergmann 2019-10-09 06:19:51 UTC

CVE-2019-17359

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large
attempted memory allocation, and resultant OutOfMemoryError error, via crafted
ASN.1 data. This is fixed in 1.64.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17359
http://www.cvedetails.com/cve/CVE-2019-17359/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17359
https://www.bouncycastle.org/releasenotes.html
https://www.bouncycastle.org/latest_releases.html

Comment 1 Alexander Bergmann 2019-10-09 06:27:36 UTC

openSUSE Leap is getting its updates from SUSE:SLE-15 and that version is still on 1.58.

Please prepare an update to version 1.64 including references to:

* bsc#1096291 - CVE-2018-1000180
* bsc#1100694 - CVE-2018-1000613

Comment 2 Pedro Monreal Gonzalez 2019-10-09 09:41:52 UTC

(In reply to Alexander Bergmann from comment #1)
> openSUSE Leap is getting its updates from SUSE:SLE-15 and that version is
> still on 1.58.
> 
> Please prepare an update to version 1.64 including references to:
> 
> * bsc#1096291 - CVE-2018-1000180
> * bsc#1100694 - CVE-2018-1000613

The vulnerable code was introduced in version 1.63 and fixed in version 1.64. I think these are the relevant commits for the fix:

   https://github.com/bcgit/bc-java/commit/33a8e4aa07b21a8bcf5a582446664485f5f081b2
   https://github.com/bcgit/bc-java/commit/b1bc75254f5fea633a49a751a1a7339056f97856

Comment 3 Pedro Monreal Gonzalez 2019-10-11 11:21:11 UTC

Factory submission:
   https://build.opensuse.org/request/show/737444

Comment 4 Pedro Monreal Gonzalez 2019-10-11 11:54:20 UTC

(In reply to Alexander Bergmann from comment #1)
> openSUSE Leap is getting its updates from SUSE:SLE-15 and that version is
> still on 1.58.

The vulnerable code was introduced in version 1.63 and fixed in version 1.64. I just updated to 1.64 in Factory. Non of the SLE packages are affected by this CVE and updating SLE-15 to 1.64 could introduce a couple of important changes in the functionality, see:

   https://www.bouncycastle.org/releasenotes.html

An update in SLE-15 would require an ECO. Do you mean to submit the update to SLE-15-SP2 so Leap could take the package from there?

Comment 5 Pedro Monreal Gonzalez 2020-04-29 14:25:23 UTC

Hi Alex, I just submitted an update in Leap 15.1 to version 1.60 for another bug, here:
   https://build.opensuse.org/request/show/798905

Is it OK if I update to 1.64 there, in Leap 15.1?

Comment 6 Pedro Monreal Gonzalez 2020-04-29 14:51:37 UTC

(In reply to Pedro Monreal Gonzalez from comment #5)
> Hi Alex, I just submitted an update in Leap 15.1 to version 1.60 for another
> bug, here:
>    https://build.opensuse.org/request/show/798905
> 
> Is it OK if I update to 1.64 there, in Leap 15.1?

Hmm, javamail is not available in Leap15.1...

Comment 7 Pedro Monreal Gonzalez 2020-07-28 18:36:49 UTC

The vulnerability was introduced in version 1.63 and fixed in 1.64. Since we do not ship version 1.63 in any codestream we are not affected by this bug.