diff mbox series

[scarthgap,PATCHv2] openssl: fix CVE-2025-69419

Message ID 20260220044322.8015-1-hprajapati@mvista.com
State Under Review
Delegated to: Yoann Congal
Headers show
Series [scarthgap,PATCHv2] openssl: fix CVE-2025-69419 | expand

Commit Message

Hitendra Prajapati Feb. 20, 2026, 4:43 a.m. UTC 
Backport patch from NVD report: https://nvd.nist.gov/vuln/detail/CVE-2025-69419

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
---
 .../openssl/openssl/CVE-2025-69419.patch      | 61 +++++++++++++++++++
 .../openssl/openssl_3.2.6.bb                  |  1 +
 2 files changed, 62 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch

Comments

Yoann Congal Feb. 20, 2026, 9:31 a.m. UTC | #1 
On Fri Feb 20, 2026 at 5:43 AM CET, Hitendra Prajapati via lists.openembedded.org wrote:
> Backport patch from NVD report: https://nvd.nist.gov/vuln/detail/CVE-2025-69419
>
> Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> ---
>  .../openssl/openssl/CVE-2025-69419.patch      | 61 +++++++++++++++++++
>  .../openssl/openssl_3.2.6.bb                  |  1 +
>  2 files changed, 62 insertions(+)
>  create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch

Hello,

Thanks for the updated commit message, it looks better now.

I still need a whinlatter equivalent to take this. Can you send it?

Thanks!

>
> diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch
> new file mode 100644
> index 0000000000..dcfdba82ac
> --- /dev/null
> +++ b/meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch
> @@ -0,0 +1,61 @@
> +From 41be0f216404f14457bbf3b9cc488dba60b49296 Mon Sep 17 00:00:00 2001
> +From: Norbert Pocs <norbertp@openssl.org>
> +Date: Thu, 11 Dec 2025 12:49:00 +0100
> +Subject: [PATCH] Check return code of UTF8_putc
> +
> +Signed-off-by: Norbert Pocs <norbertp@openssl.org>
> +
> +Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
> +Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
> +(Merged from https://github.com/openssl/openssl/pull/29376)
> +
> +CVE: CVE-2025-69419
> +Upstream-Status: Backport [https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296]
> +Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> +---
> + crypto/asn1/a_strex.c   |  6 ++++--
> + crypto/pkcs12/p12_utl.c | 11 +++++++++--
> + 2 files changed, 13 insertions(+), 4 deletions(-)
> +
> +diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c
> +index f64e352..7d76700 100644
> +--- a/crypto/asn1/a_strex.c
> ++++ b/crypto/asn1/a_strex.c
> +@@ -204,8 +204,10 @@ static int do_buf(unsigned char *buf, int buflen,
> +             orflags = CHARTYPE_LAST_ESC_2253;
> +         if (type & BUF_TYPE_CONVUTF8) {
> +             unsigned char utfbuf[6];
> +-            int utflen;
> +-            utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
> ++            int utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
> ++
> ++            if (utflen < 0)
> ++                return -1; /* error happened with UTF8 */
> +             for (i = 0; i < utflen; i++) {
> +                 /*
> +                  * We don't need to worry about setting orflags correctly
> +diff --git a/crypto/pkcs12/p12_utl.c b/crypto/pkcs12/p12_utl.c
> +index a96623f..b109dab 100644
> +--- a/crypto/pkcs12/p12_utl.c
> ++++ b/crypto/pkcs12/p12_utl.c
> +@@ -206,8 +206,15 @@ char *OPENSSL_uni2utf8(const unsigned char *uni, int unilen)
> +     /* re-run the loop emitting UTF-8 string */
> +     for (asclen = 0, i = 0; i < unilen; ) {
> +         j = bmp_to_utf8(asctmp+asclen, uni+i, unilen-i);
> +-        if (j == 4) i += 4;
> +-        else        i += 2;
> ++	/* when UTF8_putc fails */
> ++        if (j < 0) {
> ++            OPENSSL_free(asctmp);
> ++            return NULL;
> ++        }
> ++        if (j == 4)
> ++	    i += 4;
> ++        else
> ++	    i += 2;
> +         asclen += j;
> +     }
> + 
> +-- 
> +2.50.1
> +
> diff --git a/meta/recipes-connectivity/openssl/openssl_3.2.6.bb b/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
> index 4fd13d52fe..88fa0285cd 100644
> --- a/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
> +++ b/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
> @@ -17,6 +17,7 @@ SRC_URI = "https://github.com/openssl/openssl/releases/download/openssl-${PV}/op
>             file://CVE-2025-15467-02.patch \
>             file://CVE-2025-15467-03.patch \
>             file://CVE-2025-15468.patch \
> +           file://CVE-2025-69419.patch \
>             "
>  
>  SRC_URI:append:class-nativesdk = " \
Marko, Peter Feb. 20, 2026, 9:34 a.m. UTC | #2 
> -----Original Message-----
> From: openembedded-core@lists.openembedded.org <openembedded-
> core@lists.openembedded.org> On Behalf Of Yoann Congal via
> lists.openembedded.org
> Sent: Friday, February 20, 2026 10:32
> To: hprajapati@mvista.com; openembedded-core@lists.openembedded.org
> Subject: Re: [OE-core] [scarthgap][PATCHv2] openssl: fix CVE-2025-69419
> 
> On Fri Feb 20, 2026 at 5:43 AM CET, Hitendra Prajapati via
> lists.openembedded.org wrote:
> > Backport patch from NVD report: https://nvd.nist.gov/vuln/detail/CVE-2025-
> 69419
> >
> > Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
> > ---
> >  .../openssl/openssl/CVE-2025-69419.patch      | 61 +++++++++++++++++++
> >  .../openssl/openssl_3.2.6.bb                  |  1 +
> >  2 files changed, 62 insertions(+)
> >  create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2025-
> 69419.patch
> 
> Hello,
> 
> Thanks for the updated commit message, it looks better now.
> 
> I still need a whinlatter equivalent to take this. Can you send it?

Whinlatter has "openssl: upgrade 3.5.4 -> 3.5.5"

Peter
Yoann Congal Feb. 20, 2026, 9:40 a.m. UTC | #3 
On Fri Feb 20, 2026 at 10:34 AM CET, Peter Marko wrote:
>
>
>> -----Original Message-----
>> From: openembedded-core@lists.openembedded.org <openembedded-
>> core@lists.openembedded.org> On Behalf Of Yoann Congal via
>> lists.openembedded.org
>> Sent: Friday, February 20, 2026 10:32
>> To: hprajapati@mvista.com; openembedded-core@lists.openembedded.org
>> Subject: Re: [OE-core] [scarthgap][PATCHv2] openssl: fix CVE-2025-69419
>> 
>> On Fri Feb 20, 2026 at 5:43 AM CET, Hitendra Prajapati via
>> lists.openembedded.org wrote:
>> > Backport patch from NVD report: https://nvd.nist.gov/vuln/detail/CVE-2025-
>> 69419
>> >
>> > Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
>> > ---
>> >  .../openssl/openssl/CVE-2025-69419.patch      | 61 +++++++++++++++++++
>> >  .../openssl/openssl_3.2.6.bb                  |  1 +
>> >  2 files changed, 62 insertions(+)
>> >  create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2025-
>> 69419.patch
>> 
>> Hello,
>> 
>> Thanks for the updated commit message, it looks better now.
>> 
>> I still need a whinlatter equivalent to take this. Can you send it?
>
> Whinlatter has "openssl: upgrade 3.5.4 -> 3.5.5"

Oh right, thanks Peter :)

> Peter
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch b/meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch
new file mode 100644
index 0000000000..dcfdba82ac
--- /dev/null
+++ b/meta/recipes-connectivity/openssl/openssl/CVE-2025-69419.patch
@@ -0,0 +1,61 @@ 
+From 41be0f216404f14457bbf3b9cc488dba60b49296 Mon Sep 17 00:00:00 2001
+From: Norbert Pocs <norbertp@openssl.org>
+Date: Thu, 11 Dec 2025 12:49:00 +0100
+Subject: [PATCH] Check return code of UTF8_putc
+
+Signed-off-by: Norbert Pocs <norbertp@openssl.org>
+
+Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
+Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/29376)
+
+CVE: CVE-2025-69419
+Upstream-Status: Backport [https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ crypto/asn1/a_strex.c   |  6 ++++--
+ crypto/pkcs12/p12_utl.c | 11 +++++++++--
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/crypto/asn1/a_strex.c b/crypto/asn1/a_strex.c
+index f64e352..7d76700 100644
+--- a/crypto/asn1/a_strex.c
++++ b/crypto/asn1/a_strex.c
+@@ -204,8 +204,10 @@ static int do_buf(unsigned char *buf, int buflen,
+             orflags = CHARTYPE_LAST_ESC_2253;
+         if (type & BUF_TYPE_CONVUTF8) {
+             unsigned char utfbuf[6];
+-            int utflen;
+-            utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
++            int utflen = UTF8_putc(utfbuf, sizeof(utfbuf), c);
++
++            if (utflen < 0)
++                return -1; /* error happened with UTF8 */
+             for (i = 0; i < utflen; i++) {
+                 /*
+                  * We don't need to worry about setting orflags correctly
+diff --git a/crypto/pkcs12/p12_utl.c b/crypto/pkcs12/p12_utl.c
+index a96623f..b109dab 100644
+--- a/crypto/pkcs12/p12_utl.c
++++ b/crypto/pkcs12/p12_utl.c
+@@ -206,8 +206,15 @@ char *OPENSSL_uni2utf8(const unsigned char *uni, int unilen)
+     /* re-run the loop emitting UTF-8 string */
+     for (asclen = 0, i = 0; i < unilen; ) {
+         j = bmp_to_utf8(asctmp+asclen, uni+i, unilen-i);
+-        if (j == 4) i += 4;
+-        else        i += 2;
++	/* when UTF8_putc fails */
++        if (j < 0) {
++            OPENSSL_free(asctmp);
++            return NULL;
++        }
++        if (j == 4)
++	    i += 4;
++        else
++	    i += 2;
+         asclen += j;
+     }
+ 
+-- 
+2.50.1
+
diff --git a/meta/recipes-connectivity/openssl/openssl_3.2.6.bb b/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
index 4fd13d52fe..88fa0285cd 100644
--- a/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
+++ b/meta/recipes-connectivity/openssl/openssl_3.2.6.bb
@@ -17,6 +17,7 @@  SRC_URI = "https://github.com/openssl/openssl/releases/download/openssl-${PV}/op
            file://CVE-2025-15467-02.patch \
            file://CVE-2025-15467-03.patch \
            file://CVE-2025-15468.patch \
+           file://CVE-2025-69419.patch \
            "
 
 SRC_URI:append:class-nativesdk = " \