diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2021-06-19 00:42:28 +0200 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2021-07-20 09:36:06 +0200 |
| commit | 5ea3145850ebff1dc2b13d17440300a01ca38161 (patch) | |
| tree | 80fd0d0fcb9fcb370e980158a7c1cce4fd7b4c1d /lib/vtls/gtls.c | |
| parent | fd9b40bf8dfd43edcbc0d254d613d95a11061c05 (diff) | |
| download | curl-5ea3145850ebff1dc2b13d17440300a01ca38161.tar.gz | |
vtls: fix connection reuse checks for issuer cert and case sensitivity
CVE-2021-22924
Reported-by: Harry Sintonen
Bug: https://curl.se/docs/CVE-2021-22924.html
Diffstat (limited to 'lib/vtls/gtls.c')
| -rw-r--r-- | lib/vtls/gtls.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c index 78f3ad7b1..1b145d8eb 100644 --- a/lib/vtls/gtls.c +++ b/lib/vtls/gtls.c @@ -856,7 +856,7 @@ gtls_connect_step3(struct Curl_easy *data, if(!chainp) { if(SSL_CONN_CONFIG(verifypeer) || SSL_CONN_CONFIG(verifyhost) || - SSL_SET_OPTION(issuercert)) { + SSL_CONN_CONFIG(issuercert)) { #ifdef HAVE_GNUTLS_SRP if(SSL_SET_OPTION(authtype) == CURL_TLSAUTH_SRP && SSL_SET_OPTION(username) != NULL @@ -1040,21 +1040,21 @@ gtls_connect_step3(struct Curl_easy *data, gnutls_x509_crt_t format */ gnutls_x509_crt_import(x509_cert, chainp, GNUTLS_X509_FMT_DER); - if(SSL_SET_OPTION(issuercert)) { + if(SSL_CONN_CONFIG(issuercert)) { gnutls_x509_crt_init(&x509_issuer); - issuerp = load_file(SSL_SET_OPTION(issuercert)); + issuerp = load_file(SSL_CONN_CONFIG(issuercert)); gnutls_x509_crt_import(x509_issuer, &issuerp, GNUTLS_X509_FMT_PEM); rc = gnutls_x509_crt_check_issuer(x509_cert, x509_issuer); gnutls_x509_crt_deinit(x509_issuer); unload_file(issuerp); if(rc <= 0) { failf(data, "server certificate issuer check failed (IssuerCert: %s)", - SSL_SET_OPTION(issuercert)?SSL_SET_OPTION(issuercert):"none"); + SSL_CONN_CONFIG(issuercert)?SSL_CONN_CONFIG(issuercert):"none"); gnutls_x509_crt_deinit(x509_cert); return CURLE_SSL_ISSUER_ERROR; } infof(data, " server certificate issuer check OK (Issuer Cert: %s)", - SSL_SET_OPTION(issuercert)?SSL_SET_OPTION(issuercert):"none"); + SSL_CONN_CONFIG(issuercert)?SSL_CONN_CONFIG(issuercert):"none"); } size = sizeof(certname); |