From: Bob Beck Date: Wed, 7 Jan 2026 18:29:48 +0000 (-0700) Subject: Verify ASN1 object's types before attempting to access them X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ea8fc4c345fbd749048809c9f7c881ea656b0b94;p=thirdparty%2Fopenssl.git Verify ASN1 object's types before attempting to access them as a particular type Issue was reported in ossl_ess_get_signing_cert but is also present in ossl_ess_get_signing_cert_v2. Fixes: https://github.com/openssl/srt/issues/61 Fixes CVE-2025-69420 Reviewed-by: Norbert Pocs Reviewed-by: Saša Nedvědický Reviewed-by: Tomas Mraz MergeDate: Mon Jan 26 19:53:36 2026 --- diff --git a/crypto/ts/ts_rsp_verify.c b/crypto/ts/ts_rsp_verify.c index 3876e30f47b..40dab687d1c 100644 --- a/crypto/ts/ts_rsp_verify.c +++ b/crypto/ts/ts_rsp_verify.c @@ -209,7 +209,7 @@ static ESS_SIGNING_CERT *ossl_ess_get_signing_cert(const PKCS7_SIGNER_INFO *si) const unsigned char *p; attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificate); - if (attr == NULL) + if (attr == NULL || attr->type != V_ASN1_SEQUENCE) return NULL; p = attr->value.sequence->data; return d2i_ESS_SIGNING_CERT(NULL, &p, attr->value.sequence->length); @@ -221,7 +221,7 @@ static ESS_SIGNING_CERT_V2 *ossl_ess_get_signing_cert_v2(const PKCS7_SIGNER_INFO const unsigned char *p; attr = PKCS7_get_signed_attribute(si, NID_id_smime_aa_signingCertificateV2); - if (attr == NULL) + if (attr == NULL || attr->type != V_ASN1_SEQUENCE) return NULL; p = attr->value.sequence->data; return d2i_ESS_SIGNING_CERT_V2(NULL, &p, attr->value.sequence->length);