|
 |
35e961 |
From 77f30ada1156ca1e1357776fea8e9dc113f6898d Mon Sep 17 00:00:00 2001
|
|
|
35e961 |
From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
|
|
|
35e961 |
Date: Thu, 3 Mar 2022 14:22:37 +0000
|
|
|
35e961 |
Subject: [PATCH 1/4] CVE-2022-26305 compare authors using Thumbprint
|
|
|
35e961 |
|
|
|
35e961 |
Change-Id: I338f58eb07cbf0a3d13a7dafdaddac09252a8546
|
|
|
35e961 |
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130929
|
|
|
35e961 |
Tested-by: Jenkins
|
|
|
35e961 |
Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
|
|
|
35e961 |
(cherry picked from commit 65442205b5b274ad309308162f150f8d41648f72)
|
|
|
35e961 |
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/130866
|
|
|
35e961 |
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
|
|
|
35e961 |
(cherry picked from commit a7aaa78acea4c1d51283c2fce54ff9f5339026f8)
|
|
|
35e961 |
---
|
|
|
35e961 |
.../component/documentdigitalsignatures.cxx | 23 +++++++++++++++----
|
|
|
35e961 |
1 file changed, 19 insertions(+), 4 deletions(-)
|
|
|
35e961 |
|
|
|
35e961 |
diff --git a/xmlsecurity/source/component/documentdigitalsignatures.cxx b/xmlsecurity/source/component/documentdigitalsignatures.cxx
|
|
|
35e961 |
index b9066ea92cac..5a21c8421bec 100644
|
|
|
35e961 |
--- a/xmlsecurity/source/component/documentdigitalsignatures.cxx
|
|
|
35e961 |
+++ b/xmlsecurity/source/component/documentdigitalsignatures.cxx
|
|
|
35e961 |
@@ -19,9 +19,10 @@
|
|
|
35e961 |
|
|
|
35e961 |
#include <resourcemanager.hxx>
|
|
|
35e961 |
|
|
|
35e961 |
-#include <digitalsignaturesdialog.hxx>
|
|
|
35e961 |
+#include <certificate.hxx>
|
|
|
35e961 |
#include <certificatechooser.hxx>
|
|
|
35e961 |
#include <certificateviewer.hxx>
|
|
|
35e961 |
+#include <digitalsignaturesdialog.hxx>
|
|
|
35e961 |
#include <macrosecurity.hxx>
|
|
|
35e961 |
#include <biginteger.hxx>
|
|
|
35e961 |
#include <strings.hrc>
|
|
|
35e961 |
@@ -666,9 +667,23 @@ sal_Bool DocumentDigitalSignatures::isAuthorTrusted(
|
|
|
35e961 |
Sequence< SvtSecurityOptions::Certificate > aTrustedAuthors = SvtSecurityOptions().GetTrustedAuthors();
|
|
|
35e961 |
|
|
|
35e961 |
return std::any_of(aTrustedAuthors.begin(), aTrustedAuthors.end(),
|
|
|
35e961 |
- [&xAuthor, &sSerialNum](const SvtSecurityOptions::Certificate& rAuthor) {
|
|
|
35e961 |
- return xmlsecurity::EqualDistinguishedNames(rAuthor[0], xAuthor->getIssuerName())
|
|
|
35e961 |
- && ( rAuthor[1] == sSerialNum );
|
|
|
35e961 |
+ [this, &xAuthor, &sSerialNum](const SvtSecurityOptions::Certificate& rAuthor) {
|
|
|
35e961 |
+ if (!xmlsecurity::EqualDistinguishedNames(rAuthor[0], xAuthor->getIssuerName()))
|
|
|
35e961 |
+ return false;
|
|
|
35e961 |
+ if (rAuthor[1] != sSerialNum)
|
|
|
35e961 |
+ return false;
|
|
|
35e961 |
+
|
|
|
35e961 |
+ DocumentSignatureManager aSignatureManager(mxCtx, {});
|
|
|
35e961 |
+ if (!aSignatureManager.init())
|
|
|
35e961 |
+ return false;
|
|
|
35e961 |
+ uno::Reference<css::security::XCertificate> xCert = aSignatureManager.getSecurityEnvironment()->createCertificateFromAscii(rAuthor[2]);
|
|
|
35e961 |
+
|
|
|
35e961 |
+ auto pAuthor = dynamic_cast<xmlsecurity::Certificate*>(xAuthor.get());
|
|
|
35e961 |
+ auto pCert = dynamic_cast<xmlsecurity::Certificate*>(xCert.get());
|
|
|
35e961 |
+ if (pAuthor && pCert)
|
|
|
35e961 |
+ return pCert->getSHA256Thumbprint() == pAuthor->getSHA256Thumbprint();
|
|
|
35e961 |
+
|
|
|
35e961 |
+ return xCert->getSHA1Thumbprint() == xAuthor->getSHA1Thumbprint();
|
|
|
35e961 |
});
|
|
|
35e961 |
}
|
|
|
35e961 |
|
|
|
35e961 |
--
|
|
|
35e961 |
2.37.1
|
|
|
35e961 |
|