diff mbox series

[meta-oe,scarthgap,3/4] nss: patch CVE-2024-11706

Message ID 20261105232314.3699451-3-peter.marko@siemens.com
State New
Headers show
Series [meta-oe,scarthgap,1/4] nss: patch CVE-2024-11704 | expand

Commit Message

Peter Marko Nov. 5, 2026, 11:23 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Pick patch referencing [1].

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1923767

Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 .../nss/nss/CVE-2024-11706.patch              | 35 +++++++++++++++++++
 meta-oe/recipes-support/nss/nss_3.98.bb       |  1 +
 2 files changed, 36 insertions(+)
 create mode 100644 meta-oe/recipes-support/nss/nss/CVE-2024-11706.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/nss/nss/CVE-2024-11706.patch b/meta-oe/recipes-support/nss/nss/CVE-2024-11706.patch
new file mode 100644
index 00000000000..6ec92052adf
--- /dev/null
+++ b/meta-oe/recipes-support/nss/nss/CVE-2024-11706.patch
@@ -0,0 +1,35 @@ 
+From aa9e1c7cd91cc1d4c205bc73bfc40855ec0af2f9 Mon Sep 17 00:00:00 2001
+From: John Schanck <jschanck@mozilla.com>
+Date: Mon, 21 Oct 2024 21:22:36 +0000
+Subject: [PATCH] Bug 1923767 - pk12util: improve error handling in
+ p12U_ReadPKCS12File. r=nss-reviewers,nkulatova
+
+Differential Revision: https://phabricator.services.mozilla.com/D225165
+
+--HG--
+extra : moz-landing-system : lando
+
+CVE: CVE-2024-11706
+Upstream-Status: Backport [https://github.com/mozilla/nss/commit/aa9e1c7cd91cc1d4c205bc73bfc40855ec0af2f9]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ nss/cmd/pk12util/pk12util.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/nss/cmd/pk12util/pk12util.c b/nss/cmd/pk12util/pk12util.c
+index f84002ca0..2baab969f 100644
+--- a/nss/cmd/pk12util/pk12util.c
++++ b/nss/cmd/pk12util/pk12util.c
+@@ -449,10 +449,10 @@ p12U_ReadPKCS12File(SECItem *uniPwp, char *in_file, PK11SlotInfo *slot,
+ 
+     /* revert the option setting */
+     if (forceUnicode != pk12uForceUnicode) {
+-        rv = NSS_OptionSet(__NSS_PKCS12_DECODE_FORCE_UNICODE, pk12uForceUnicode);
+-        if (rv != SECSuccess) {
++        if (SECSuccess != NSS_OptionSet(__NSS_PKCS12_DECODE_FORCE_UNICODE, pk12uForceUnicode)) {
+             SECU_PrintError(progName, "PKCS12 decoding failed to set option");
+             pk12uErrno = PK12UERR_DECODEVERIFY;
++            rv = SECFailure;
+         }
+     }
+     /* rv has been set at this point */
diff --git a/meta-oe/recipes-support/nss/nss_3.98.bb b/meta-oe/recipes-support/nss/nss_3.98.bb
index 8be7072ee50..9bebd1c6c4d 100644
--- a/meta-oe/recipes-support/nss/nss_3.98.bb
+++ b/meta-oe/recipes-support/nss/nss_3.98.bb
@@ -39,6 +39,7 @@  SRC_URI = "http://ftp.mozilla.org/pub/security/nss/releases/${VERSION_DIR}/src/$
            file://0009-Bug-2084101-Remove-eMudhra-emSign-Root-CA-G3-from-NS.patch \
            file://CVE-2024-11704.patch \
            file://CVE-2024-11705.patch \
+           file://CVE-2024-11706.patch \
            "
 SRC_URI[sha256sum] = "f549cc33d35c0601674bfacf7c6ad683c187595eb4125b423238d3e9aa4209ce"