Bug 1204357 - (CVE-2022-3515) VUL-0: CVE-2022-3515: libksba: Integer overflow
(CVE-2022-3515)
VUL-0: CVE-2022-3515: libksba: Integer overflow
Status: RESOLVED FIXED
Classification: openSUSE
Product: openSUSE Distribution
Classification: openSUSE
Component: Security
Leap 15.4
Other Other
: P3 - Medium : Critical (vote)
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/345320/
CVSSv3.1:SUSE:CVE-2022-3515:9.8:(AV:N...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-10-17 07:55 UTC by Andreas Stieger
Modified: 2022-12-12 16:19 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2022-10-17 07:55:35 UTC
A severe bug has been found in [Libksba] , the library used by GnuPG
for parsing the ASN.1 structures as used by S/MIME.  The bug affects
all versions of [Libksba] before 1.6.2 and may be used for remote code
execution.

The major user of Libksba is /gpgsm/, the S/MIME cousin of /gpg/.
There it is used to parse all kind of input data, in particular signed
or encrypted data in files or in mails.  Feeding a user with malicious
data can thus be easily achieved.

A second user of Libksba is /dirmngr/, which is responsible for
loading and parsing Certificate Revocation Lists (CRLs) and for
verifying certificates used by TLS (i.e. https connections).  Mounting
an attack is a bit more complex but can anyway be easily done using a
rogue web server to serve a Web Key Directory, certificates, or CRLs.

Fixed in 1.6.2

References:
https://lists.gnupg.org/pipermail/gnupg-announce/2022q4/000475.html
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git;a=commit;h=4b7d9cd4a018898d7714ce06f3faf2626c14582b
Comment 1 Pedro Monreal Gonzalez 2022-10-17 13:06:12 UTC
Factory submission, update to 1.6.2:
   * https://build.opensuse.org/request/show/1012106
Comment 2 Thomas Leroy 2022-10-17 13:42:10 UTC
Thank you very much for the report Andreas.

Every SUSE codestream is affected:
- SUSE:SLE-11:Update
- SUSE:SLE-12:Update
- SUSE:SLE-15:Update
Comment 5 Swamp Workflow Management 2022-10-21 13:24:18 UTC
SUSE-SU-2022:3681-1: An update that fixes one vulnerability is now available.

Category: security (critical)
Bug References: 1204357
CVE References: CVE-2022-3515
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    libksba-1.3.0-24.3.1
SUSE OpenStack Cloud 9 (src):    libksba-1.3.0-24.3.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    libksba-1.3.0-24.3.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    libksba-1.3.0-24.3.1
SUSE Linux Enterprise Server 12-SP5 (src):    libksba-1.3.0-24.3.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    libksba-1.3.0-24.3.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    libksba-1.3.0-24.3.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    libksba-1.3.0-24.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2022-10-21 13:29:13 UTC
SUSE-SU-2022:3683-1: An update that fixes one vulnerability is now available.

Category: security (critical)
Bug References: 1204357
CVE References: CVE-2022-3515
JIRA References: 
Sources used:
openSUSE Leap Micro 5.2 (src):    libksba-1.3.5-150000.4.3.1
openSUSE Leap 15.4 (src):    libksba-1.3.5-150000.4.3.1
openSUSE Leap 15.3 (src):    libksba-1.3.5-150000.4.3.1
SUSE Manager Server 4.1 (src):    libksba-1.3.5-150000.4.3.1
SUSE Manager Retail Branch Server 4.1 (src):    libksba-1.3.5-150000.4.3.1
SUSE Manager Proxy 4.1 (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Server for SAP 15 (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Server 15-LTSS (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Micro 5.3 (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Micro 5.2 (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise Micro 5.1 (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    libksba-1.3.5-150000.4.3.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    libksba-1.3.5-150000.4.3.1
SUSE Enterprise Storage 7 (src):    libksba-1.3.5-150000.4.3.1
SUSE Enterprise Storage 6 (src):    libksba-1.3.5-150000.4.3.1
SUSE CaaS Platform 4.0 (src):    libksba-1.3.5-150000.4.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.