Skip to content

Commit 1d15b46

Browse files
MiguelCompanyMiguelCompany
committed
Fix CVE-2025-24807
Adds verification of CA certificates when loading them, thus disabling the usage of expired CA certificates. It also enables the usage of an intermediate CA for signing governance and permissions documents. * Added expired CA files for regression tests. * Added chained CA files for regression tests. * Added regression tests. * Verify CA certificates in `FileProvider::load_ca`. * Allow chained permissions CA. Signed-off-by: Miguel Company <[email protected]>
1 parent 859ebab commit 1d15b46

10 files changed

+712
-6
lines changed

‎src/cpp/security/accesscontrol/Permissions.cpp

+2-2
Original file line numberDiff line numberDiff line change
@@ -380,9 +380,9 @@ static BIO* load_and_verify_document(
380380
}
381381
}
382382

383-
if (1 != sk_X509_num(stack))
383+
if (0 == sk_X509_num(stack))
384384
{
385-
exception = _SecurityException_("Certificate store should have exactly one certificate");
385+
exception = _SecurityException_("Certificate store should have at least one certificate");
386386

387387
sk_X509_free(stack);
388388
stack = nullptr;

‎src/cpp/security/artifact_providers/FileProvider.cpp

+33-2
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ X509_STORE* FileProvider::load_ca(
5353
if (BIO_read_filename(in, ca.substr(7).c_str()) > 0)
5454
{
5555
STACK_OF(X509_INFO) * inf = PEM_X509_INFO_read_bio(in, NULL, NULL, NULL);
56+
X509* ca_cert = nullptr;
5657

5758
if (inf != nullptr)
5859
{
@@ -65,6 +66,11 @@ X509_STORE* FileProvider::load_ca(
6566

6667
if (itmp->x509)
6768
{
69+
if (nullptr == ca_cert)
70+
{
71+
ca_cert = itmp->x509;
72+
}
73+
6874
// Retrieve subject name for future use.
6975
if (ca_sn.empty())
7076
{
@@ -102,9 +108,34 @@ X509_STORE* FileProvider::load_ca(
102108

103109
if (count > 0)
104110
{
105-
BIO_free(in);
111+
// Verify CA certificate.
112+
unsigned long flags = 0;
113+
flags |= X509_V_FLAG_CHECK_SS_SIGNATURE | X509_V_FLAG_POLICY_CHECK;
114+
flags |= X509_V_FLAG_X509_STRICT;
115+
X509_STORE_CTX* ctx = X509_STORE_CTX_new();
116+
if (nullptr != ctx)
117+
{
118+
X509_STORE_CTX_init(ctx, store, ca_cert, NULL);
119+
X509_STORE_CTX_set_flags(ctx, flags);
120+
if (X509_verify_cert(ctx) == 1)
121+
{
122+
X509_STORE_CTX_free(ctx);
123+
BIO_free(in);
124+
return store;
125+
}
126+
127+
int error_code = X509_STORE_CTX_get_error(ctx);
128+
const char* error_msg = X509_verify_cert_error_string(error_code);
106129

107-
return store;
130+
exception = _SecurityException_(
131+
"Error '" + std::to_string(error_code) + "' verifying CA certificate for " +
132+
ca_sn + ": " + error_msg);
133+
X509_STORE_CTX_free(ctx);
134+
}
135+
else
136+
{
137+
exception = _SecurityException_("Error creating X509 store context");
138+
}
108139
}
109140
}
110141
else

‎test/certs/chainedcacert.pem

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIICXzCCAgWgAwIBAgICEAAwCgYIKoZIzj0EAwIwgaAxCzAJBgNVBAYTAkVTMQsw
3+
CQYDVQQIDAJNQTEUMBIGA1UEBwwLVHJlcyBDYW50b3MxETAPBgNVBAoMCGVQcm9z
4+
aW1hMREwDwYDVQQLDAhlUHJvc2ltYTEeMBwGA1UEAwwVZVByb3NpbWEgVGVzdCBS
5+
b290IENBMSgwJgYJKoZIhvcNAQkBFhl0ZXN0X3Jvb3RfY2FAZXByb3NpbWEuY29t
6+
MB4XDTI1MDExNTEwMTExNVoXDTM1MDExMzEwMTExNVowaDELMAkGA1UEBhMCRVMx
7+
CzAJBgNVBAgMAk1BMREwDwYDVQQKDAhlUHJvc2ltYTERMA8GA1UECwwIZVByb3Np
8+
bWExJjAkBgNVBAMMHWVQcm9zaW1hIFRlc3QgSW50ZXJtZWRpYXRlIENBMFkwEwYH
9+
KoZIzj0CAQYIKoZIzj0DAQcDQgAE8bIZuec3pCV3hEHXEFn82NKnjSKEB3lkRSOu
10+
+bTXBMZ5fwe6oQTv9hDNfT+XTKSnom0Embbg//S7bb+fb5JlA6NmMGQwHQYDVR0O
11+
BBYEFOvgxNzYB2Rxz4HDRCkUderCDcpHMB8GA1UdIwQYMBaAFKaSeSIbLAgxD7zm
12+
QNxLEY4kICzTMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0PAQH/BAQDAgGGMAoG
13+
CCqGSM49BAMCA0gAMEUCIC9diVLvZMCC6hKoPJzn9fZ0KEHzFk1C91FNjUmwpkVZ
14+
AiEAqAqmu2WdMFUMsNmsSQIzt2HYnqrVn7N2lvlprkUjMjM=
15+
-----END CERTIFICATE-----
16+
-----BEGIN CERTIFICATE-----
17+
MIICpzCCAk2gAwIBAgIUJQFIA2lEJY+/PTqIux/axqQ1F2UwCgYIKoZIzj0EAwIw
18+
gaAxCzAJBgNVBAYTAkVTMQswCQYDVQQIDAJNQTEUMBIGA1UEBwwLVHJlcyBDYW50
19+
b3MxETAPBgNVBAoMCGVQcm9zaW1hMREwDwYDVQQLDAhlUHJvc2ltYTEeMBwGA1UE
20+
AwwVZVByb3NpbWEgVGVzdCBSb290IENBMSgwJgYJKoZIhvcNAQkBFhl0ZXN0X3Jv
21+
b3RfY2FAZXByb3NpbWEuY29tMB4XDTI1MDExNTA5MjMzNFoXDTQ1MDExMDA5MjMz
22+
NFowgaAxCzAJBgNVBAYTAkVTMQswCQYDVQQIDAJNQTEUMBIGA1UEBwwLVHJlcyBD
23+
YW50b3MxETAPBgNVBAoMCGVQcm9zaW1hMREwDwYDVQQLDAhlUHJvc2ltYTEeMBwG
24+
A1UEAwwVZVByb3NpbWEgVGVzdCBSb290IENBMSgwJgYJKoZIhvcNAQkBFhl0ZXN0
25+
X3Jvb3RfY2FAZXByb3NpbWEuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
26+
2lYCGPFtW774ZgMgNOKQ6qdocJyiIFfiEwS58tF1uBdkxPsh1kfGFB7fHFOtwNPh
27+
CnSOPGgo1EVqBp3cEipD06NjMGEwHQYDVR0OBBYEFKaSeSIbLAgxD7zmQNxLEY4k
28+
ICzTMB8GA1UdIwQYMBaAFKaSeSIbLAgxD7zmQNxLEY4kICzTMA8GA1UdEwEB/wQF
29+
MAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIE9qvbOVyQwo
30+
nGOObUbUE+/OGG22/axZI6q7C3ttnTxqAiEAymMnYLr1evO4E0TaEhbSC0LNDP/j
31+
OR+xBiuCUbXq1is=
32+
-----END CERTIFICATE-----

‎test/certs/expired_ca_cert.pem

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIICZzCCAg2gAwIBAgIUZGCfUDVyxQhCHFIbIM42sFnAwKswCgYIKoZIzj0EAwIw
3+
gZoxCzAJBgNVBAYTAkVTMQswCQYDVQQIDAJNQTEUMBIGA1UEBwwLVHJlcyBDYW50
4+
b3MxETAPBgNVBAoMCGVQcm9zaW1hMREwDwYDVQQLDAhlUHJvc2ltYTEeMBwGA1UE
5+
AwwVZVByb3NpbWEgTWFpbiBUZXN0IENBMSIwIAYJKoZIhvcNAQkBFhNtYWluY2FA
6+
ZXByb3NpbWEuY29tMB4XDTI1MDExMDE2MDAwMFoXDTI1MDExMTE2MDAwMFowgZox
7+
CzAJBgNVBAYTAkVTMQswCQYDVQQIDAJNQTEUMBIGA1UEBwwLVHJlcyBDYW50b3Mx
8+
ETAPBgNVBAoMCGVQcm9zaW1hMREwDwYDVQQLDAhlUHJvc2ltYTEeMBwGA1UEAwwV
9+
ZVByb3NpbWEgTWFpbiBUZXN0IENBMSIwIAYJKoZIhvcNAQkBFhNtYWluY2FAZXBy
10+
b3NpbWEuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3roiCZVhjBQTsP3z
11+
4gth7UNQlrAnGwI0M1FvwmFZMPaGoaWt+4JCyPqL//OH9CgDz5THK0kUyrEesPwA
12+
L4k3C6MvMC0wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUPEHc5miSwb+mZtS6HgT6
13+
im4YoDswCgYIKoZIzj0EAwIDSAAwRQIhAM42l2crii8qFHznr8x1Z9h6KmLAYb+Z
14+
6waTU2feHUgwAiAsMS+BzAhMVCXNp5d3nP949CeIlxSpOLFUtRZ6US35mw==
15+
-----END CERTIFICATE-----

‎test/certs/expired_ca_key.pem

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgX6/M7Gc6IM0qIVee
3+
zsCwTDHZTN1vcJkhWPw0YiqvFiihRANCAATeuiIJlWGMFBOw/fPiC2HtQ1CWsCcb
4+
AjQzUW/CYVkw9oahpa37gkLI+ov/84f0KAPPlMcrSRTKsR6w/AAviTcL
5+
-----END PRIVATE KEY-----

‎test/certs/governance_signed_by_chained_ca.smime

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
MIME-Version: 1.0
2+
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----D68F40C4737C759E420C091F6D85ECB8"
3+
4+
This is an S/MIME signed message
5+
6+
------D68F40C4737C759E420C091F6D85ECB8
7+
Content-Type: text/plain
8+
9+
<?xml version="1.0" encoding="utf-8"?>
10+
<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
11+
xsi:noNamespaceSchemaLocation="omg_shared_ca_domain_governance.xsd">
12+
<domain_access_rules>
13+
<domain_rule>
14+
<domains>
15+
<id_range>
16+
<min>0</min>
17+
<max>230</max>
18+
</id_range>
19+
</domains>
20+
<allow_unauthenticated_participants>false</allow_unauthenticated_participants>
21+
<enable_join_access_control>true</enable_join_access_control>
22+
<discovery_protection_kind>ENCRYPT</discovery_protection_kind>
23+
<liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
24+
<rtps_protection_kind>ENCRYPT</rtps_protection_kind>
25+
<topic_access_rules>
26+
<topic_rule>
27+
<topic_expression>HelloWorldTopic_*</topic_expression>
28+
<enable_discovery_protection>true</enable_discovery_protection>
29+
<enable_liveliness_protection>true</enable_liveliness_protection>
30+
<enable_read_access_control>true</enable_read_access_control>
31+
<enable_write_access_control>true</enable_write_access_control>
32+
<metadata_protection_kind>ENCRYPT</metadata_protection_kind>
33+
<data_protection_kind>ENCRYPT</data_protection_kind>
34+
</topic_rule>
35+
</topic_access_rules>
36+
</domain_rule>
37+
</domain_access_rules>
38+
</dds>
39+
40+
41+
------D68F40C4737C759E420C091F6D85ECB8
42+
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
43+
Content-Transfer-Encoding: base64
44+
Content-Disposition: attachment; filename="smime.p7s"
45+
46+
MIIEmgYJKoZIhvcNAQcCoIIEizCCBIcCAQExDzANBglghkgBZQMEAgEFADALBgkq
47+
hkiG9w0BBwGgggJjMIICXzCCAgWgAwIBAgICEAAwCgYIKoZIzj0EAwIwgaAxCzAJ
48+
BgNVBAYTAkVTMQswCQYDVQQIDAJNQTEUMBIGA1UEBwwLVHJlcyBDYW50b3MxETAP
49+
BgNVBAoMCGVQcm9zaW1hMREwDwYDVQQLDAhlUHJvc2ltYTEeMBwGA1UEAwwVZVBy
50+
b3NpbWEgVGVzdCBSb290IENBMSgwJgYJKoZIhvcNAQkBFhl0ZXN0X3Jvb3RfY2FA
51+
ZXByb3NpbWEuY29tMB4XDTI1MDExNTEwMTExNVoXDTM1MDExMzEwMTExNVowaDEL
52+
MAkGA1UEBhMCRVMxCzAJBgNVBAgMAk1BMREwDwYDVQQKDAhlUHJvc2ltYTERMA8G
53+
A1UECwwIZVByb3NpbWExJjAkBgNVBAMMHWVQcm9zaW1hIFRlc3QgSW50ZXJtZWRp
54+
YXRlIENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8bIZuec3pCV3hEHXEFn8
55+
2NKnjSKEB3lkRSOu+bTXBMZ5fwe6oQTv9hDNfT+XTKSnom0Embbg//S7bb+fb5Jl
56+
A6NmMGQwHQYDVR0OBBYEFOvgxNzYB2Rxz4HDRCkUderCDcpHMB8GA1UdIwQYMBaA
57+
FKaSeSIbLAgxD7zmQNxLEY4kICzTMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYDVR0P
58+
AQH/BAQDAgGGMAoGCCqGSM49BAMCA0gAMEUCIC9diVLvZMCC6hKoPJzn9fZ0KEHz
59+
Fk1C91FNjUmwpkVZAiEAqAqmu2WdMFUMsNmsSQIzt2HYnqrVn7N2lvlprkUjMjMx
60+
ggH7MIIB9wIBATCBpzCBoDELMAkGA1UEBhMCRVMxCzAJBgNVBAgMAk1BMRQwEgYD
61+
VQQHDAtUcmVzIENhbnRvczERMA8GA1UECgwIZVByb3NpbWExETAPBgNVBAsMCGVQ
62+
cm9zaW1hMR4wHAYDVQQDDBVlUHJvc2ltYSBUZXN0IFJvb3QgQ0ExKDAmBgkqhkiG
63+
9w0BCQEWGXRlc3Rfcm9vdF9jYUBlcHJvc2ltYS5jb20CAhAAMA0GCWCGSAFlAwQC
64+
AQUAoIHkMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8X
65+
DTI1MDExNTEwMzMzMFowLwYJKoZIhvcNAQkEMSIEIEX4h64CzxuL+TR7vnsit4e0
66+
bEtA1800Dwo4I4sCOjfmMHkGCSqGSIb3DQEJDzFsMGowCwYJYIZIAWUDBAEqMAsG
67+
CWCGSAFlAwQBFjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwIC
68+
AgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMAoGCCqG
69+
SM49BAMCBEYwRAIgHrwDKsTipUhve5U+fRAhOGC1LcljM7it+bEVZ4aXEtMCIDcU
70+
hO+nIoZds6f32lg79mSRHO5y+FlMLmNwt7C3Hc9A
71+
72+
------D68F40C4737C759E420C091F6D85ECB8--
73+

‎test/certs/governance_signed_by_expired_ca.smime

+74
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
MIME-Version: 1.0
2+
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="sha-256"; boundary="----3FDCF0E7A3C0A71DB007000D42CFC9B1"
3+
4+
This is an S/MIME signed message
5+
6+
------3FDCF0E7A3C0A71DB007000D42CFC9B1
7+
Content-Type: text/plain
8+
9+
<?xml version="1.0" encoding="utf-8"?>
10+
<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
11+
xsi:noNamespaceSchemaLocation="omg_shared_ca_domain_governance.xsd">
12+
<domain_access_rules>
13+
<domain_rule>
14+
<domains>
15+
<id_range>
16+
<min>0</min>
17+
<max>230</max>
18+
</id_range>
19+
</domains>
20+
<allow_unauthenticated_participants>false</allow_unauthenticated_participants>
21+
<enable_join_access_control>true</enable_join_access_control>
22+
<discovery_protection_kind>ENCRYPT</discovery_protection_kind>
23+
<liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
24+
<rtps_protection_kind>ENCRYPT</rtps_protection_kind>
25+
<topic_access_rules>
26+
<topic_rule>
27+
<topic_expression>HelloWorldTopic_*</topic_expression>
28+
<enable_discovery_protection>true</enable_discovery_protection>
29+
<enable_liveliness_protection>true</enable_liveliness_protection>
30+
<enable_read_access_control>true</enable_read_access_control>
31+
<enable_write_access_control>true</enable_write_access_control>
32+
<metadata_protection_kind>ENCRYPT</metadata_protection_kind>
33+
<data_protection_kind>ENCRYPT</data_protection_kind>
34+
</topic_rule>
35+
</topic_access_rules>
36+
</domain_rule>
37+
</domain_access_rules>
38+
</dds>
39+
40+
41+
------3FDCF0E7A3C0A71DB007000D42CFC9B1
42+
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
43+
Content-Transfer-Encoding: base64
44+
Content-Disposition: attachment; filename="smime.p7s"
45+
46+
MIIErwYJKoZIhvcNAQcCoIIEoDCCBJwCAQExDzANBglghkgBZQMEAgEFADALBgkq
47+
hkiG9w0BBwGgggJrMIICZzCCAg2gAwIBAgIUZGCfUDVyxQhCHFIbIM42sFnAwKsw
48+
CgYIKoZIzj0EAwIwgZoxCzAJBgNVBAYTAkVTMQswCQYDVQQIDAJNQTEUMBIGA1UE
49+
BwwLVHJlcyBDYW50b3MxETAPBgNVBAoMCGVQcm9zaW1hMREwDwYDVQQLDAhlUHJv
50+
c2ltYTEeMBwGA1UEAwwVZVByb3NpbWEgTWFpbiBUZXN0IENBMSIwIAYJKoZIhvcN
51+
AQkBFhNtYWluY2FAZXByb3NpbWEuY29tMB4XDTI1MDExMDE2MDAwMFoXDTI1MDEx
52+
MTE2MDAwMFowgZoxCzAJBgNVBAYTAkVTMQswCQYDVQQIDAJNQTEUMBIGA1UEBwwL
53+
VHJlcyBDYW50b3MxETAPBgNVBAoMCGVQcm9zaW1hMREwDwYDVQQLDAhlUHJvc2lt
54+
YTEeMBwGA1UEAwwVZVByb3NpbWEgTWFpbiBUZXN0IENBMSIwIAYJKoZIhvcNAQkB
55+
FhNtYWluY2FAZXByb3NpbWEuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
56+
3roiCZVhjBQTsP3z4gth7UNQlrAnGwI0M1FvwmFZMPaGoaWt+4JCyPqL//OH9CgD
57+
z5THK0kUyrEesPwAL4k3C6MvMC0wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUPEHc
58+
5miSwb+mZtS6HgT6im4YoDswCgYIKoZIzj0EAwIDSAAwRQIhAM42l2crii8qFHzn
59+
r8x1Z9h6KmLAYb+Z6waTU2feHUgwAiAsMS+BzAhMVCXNp5d3nP949CeIlxSpOLFU
60+
tRZ6US35mzGCAggwggIEAgEBMIGzMIGaMQswCQYDVQQGEwJFUzELMAkGA1UECAwC
61+
TUExFDASBgNVBAcMC1RyZXMgQ2FudG9zMREwDwYDVQQKDAhlUHJvc2ltYTERMA8G
62+
A1UECwwIZVByb3NpbWExHjAcBgNVBAMMFWVQcm9zaW1hIE1haW4gVGVzdCBDQTEi
63+
MCAGCSqGSIb3DQEJARYTbWFpbmNhQGVwcm9zaW1hLmNvbQIUZGCfUDVyxQhCHFIb
64+
IM42sFnAwKswDQYJYIZIAWUDBAIBBQCggeQwGAYJKoZIhvcNAQkDMQsGCSqGSIb3
65+
DQEHATAcBgkqhkiG9w0BCQUxDxcNMjUwMTE0MTE0MTE5WjAvBgkqhkiG9w0BCQQx
66+
IgQgRfiHrgLPG4v5NHu+eyK3h7RsS0DXzTQPCjgjiwI6N+YweQYJKoZIhvcNAQkP
67+
MWwwajALBglghkgBZQMEASowCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBAjAKBggq
68+
hkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcw
69+
DQYIKoZIhvcNAwICASgwCgYIKoZIzj0EAwIERzBFAiB5QjEPWjxi8yGjKnWFk/ZO
70+
fjkUAZHV8hGN9wgSgRTNcQIhAPPkRLwgGL4rCznv5rVCtLn8YIjEOmnW3VAlb2pT
71+
/qcE
72+
73+
------3FDCF0E7A3C0A71DB007000D42CFC9B1--
74+

0 commit comments

Comments
 (0)