OESA-2021-1024

Dashboard / Vulnerabilities / OESA-2021-1024

OESA-2021-1024

Summary: p11-kit security update

Details: Provides a way to load and enumerate PKCS#11 modules. Provides a standard configuration setup for installing PKCS#11 modules in such a way that they're discoverable. Also solves problems with coordinating the use of PKCS#11 by different components or libraries living in the same process.\r\n\r\n Security Fix(es):\r\n\r\n An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple integer overflows have been discovered in the array allocations in the p11-kit library and the p11-kit list command, where overflow checks are missing before calling realloc or calloc.(CVE-2020-29361)\r\n\r\n An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS#11 function call, the receiving entity may allow the reading of up to 4 bytes of memory past the heap allocation.(CVE-2020-29362)\r\n\r\n An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value.(CVE-2020-29363)\r\n\r\n

References: https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1024, https://nvd.nist.gov/vuln/detail/CVE-2020-29361, https://nvd.nist.gov/vuln/detail/CVE-2020-29362, https://nvd.nist.gov/vuln/detail/CVE-2020-29363