Package: cjose / 0.6.1+dfsg1-1+deb11u1

Metadata

Package Version Patches format
cjose 0.6.1+dfsg1-1+deb11u1 3.0 (quilt)

Patch series

view the series file
Patch File delta Description
remove platform dir.patch | (download)

Makefile.am | 2 1 + 1 - 0 !
configure.ac | 1 0 + 1 - 0 !
2 files changed, 1 insertion(+), 2 deletions(-)

 remove platform directory and references to it
 The directory contains tools for upstream release engineering,
 including a binary-only version of Qemu.
fix concatkdf failures on big endian architectures.patch | (download)

src/concatkdf.c | 10 2 + 8 - 0 !
test/check_concatkdf.c | 11 3 + 8 - 0 !
2 files changed, 5 insertions(+), 16 deletions(-)

 [patch] fix concatkdf failures on big endian architectures

Several of the elements used to compute the digest in ECDH-ES key
agreement computation are represented in binary form as a 32-bit
integer length followed by that number of octets. The 32-bit length
integer is represented in big endian format (the 8 most significant
bits are in the first octet.).

The conversion to a 4 byte big endian integer was being computed
in a manner that only worked on little endian architectures. The
function htonl() returns a 32-bit integer whose octet sequence given
the address of the integer is big endian. There is no need for any
further manipulation.

The existing code used bit shifting on a 32-bit value. In C bit
shifting is endian agnostic for multi-octet values, a right shift
moves most significant bits toward least significant bits. The result
of a bit shift of a multi-octet value on either big or little
archictures will always be the same provided you "view" it as the same
data type (e.g. 32-bit integer). But indexing the octets of that
CVE 2023 37464.patch | (download)

src/jwe.c | 6 6 + 0 - 0 !
test/check_jwe.c | 58 58 + 0 - 0 !
2 files changed, 64 insertions(+)

 use fixed authentication tag length of 16 octets in aes gcm
 decryption

Signed-off-by: Hans Zandbelt <hans.zandbelt@openidc.com>