Skip to content

[AutoPR- Security] Patch libreswan for CVE-2026-14957 [HIGH] #18709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Azure Linux Security Servicing Account (azurelinux-security) wants to merge 1 commit into
base: fasttrack/3.0
Choose a base branch
from
+70 −1
Draft

[AutoPR- Security] Patch libreswan for CVE-2026-14957 [HIGH] #18709

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 65 additions & 0 deletions SPECS/libreswan/CVE-2026-14957.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
From b3564ae0257672d89ee5a4f6d1b9048710bf91d5 Mon Sep 17 00:00:00 2001
From: AllSpark <allspark@microsoft.com>
Date: Fri, 4 Sep 2026 06:51:37 +0000
Subject: [PATCH] Backport FIPS cert public key null check and DN hash guard

Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: AI Backport of https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.patch
---
lib/libswan/x509dn.c | 1 +
programs/pluto/nss_cert_verify.c | 25 ++++++++++++++++---------
2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/lib/libswan/x509dn.c b/lib/libswan/x509dn.c
index b07e38b..626e6e4 100644
--- a/lib/libswan/x509dn.c
+++ b/lib/libswan/x509dn.c
@@ -378,6 +378,7 @@ static err_t format_dn(struct jambuf *buf, asn1_t dn,
* #BER.
*/
(nss_compatible &&
+ value_content.len > 0 &&
((const char*)value_content.ptr)[0] == '#')) {
/* BER */
jam(buf, "#");
diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c
index 3e16566..81a6493 100644
--- a/programs/pluto/nss_cert_verify.c
+++ b/programs/pluto/nss_cert_verify.c
@@ -392,17 +392,24 @@ static void add_decoded_cert(CERTCertDBHandle *handle,
*/
if (libreswan_fipsmode()) {
SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert);
- passert(pk != NULL);
- unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
- if (pk->keyType == rsaKey && key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
- llog(RC_LOG, logger,
- "FIPS: rejecting peer cert with key size %u under %u: %s",
- key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
- cert->subjectName);
- SECKEY_DestroyPublicKey(pk);
- CERT_DestroyCertificate(cert);
+ if (pk == NULL) {
+ llog_nss_error(RC_LOG, logger,
+ "extracting certificate public key using CERT_ExtractPublicKey() failed");
return;
}
+
+ if (pk->keyType == rsaKey) {
+ unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
+ if (key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
+ llog(RC_LOG, logger,
+ "FIPS: rejecting peer cert with key size %u under %u: %s",
+ key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
+ cert->subjectName);
+ SECKEY_DestroyPublicKey(pk);
+ CERT_DestroyCertificate(cert);
+ return;
+ }
+ }
SECKEY_DestroyPublicKey(pk);
}

--
2.45.4

6 changes: 5 additions & 1 deletion SPECS/libreswan/libreswan.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
Summary: Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
Name: libreswan
Version: 4.15
Release: 2%{?dist}
Release: 3%{?dist}
License: GPLv2+
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand All @@ -40,6 +40,7 @@ Source5: https://download.libreswan.org/cavs/ikev2.fax.bz2
Patch0: CVE-2026-12413.patch
Patch1: CVE-2026-50721.patch
Patch2: CVE-2026-50722.patch
Patch3: CVE-2026-14957.patch

BuildRequires: audit-libs-devel
BuildRequires: bison
Expand Down Expand Up @@ -197,6 +198,9 @@ certutil -N -d sql:$tmpdir --empty-password
%doc %{_mandir}/*/*

%changelog
* Fri Sep 04 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 4.15-3
- Patch for CVE-2026-14957

* Fri Jul 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 4.15-2
- Patch for CVE-2026-50722, CVE-2026-50721, CVE-2026-12413

Expand Down
Loading