Adding debian version 1:7.0.4-4+deb11u8.debian/1%7.0.4-4+deb11u8

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 63 insertions, 0 deletions

diff --git a/debian/patches/b0404f80577de9ff69e58390c6f6ef949fdb0139.patch b/debian/patches/b0404f80577de9ff69e58390c6f6ef949fdb0139.patch
new file mode 100644
index 000000000..15af13680
--- /dev/null
+++ b/debian/patches/b0404f80577de9ff69e58390c6f6ef949fdb0139.patch
@@ -0,0 +1,63 @@
+From b0404f80577de9ff69e58390c6f6ef949fdb0139 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolanm@redhat.com>
+Date: Mon, 20 Dec 2021 17:05:44 +0000
+Subject: [PATCH] only use X509Data
+
+Change-Id: I52e6588f5fac04bb26d77c1f3af470db73e41f72
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127193
+Tested-by: Jenkins
+Reviewed-by: Miklos Vajna <vmiklos@collabora.com>
+(cherry picked from commit be446d81e07b5499152efeca6ca23034e51ea5ff)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/127178
+Reviewed-by: Adolfo Jayme Barrientos <fitojb@ubuntu.com>
+---
+ xmlsecurity/inc/xmlsec-wrapper.h                              | 4 ++++
+ .../source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx        | 4 ++++
+ xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx        | 4 ++++
+ 3 files changed, 12 insertions(+)
+
+diff --git a/xmlsecurity/inc/xmlsec-wrapper.h b/xmlsecurity/inc/xmlsec-wrapper.h
+index e4048de94bf2a..cc149379c36be 100644
+--- a/xmlsecurity/inc/xmlsec-wrapper.h
++++ b/xmlsecurity/inc/xmlsec-wrapper.h
+@@ -43,6 +43,10 @@
+ #include <xmlsec/nss/app.h>
+ #include <xmlsec/nss/crypto.h>
+ #include <xmlsec/nss/pkikeys.h>
++#include <xmlsec/nss/x509.h>
++#endif
++#ifdef XMLSEC_CRYPTO_MSCRYPTO
++#include <xmlsec/mscng/x509.h>
+ #endif
+ 
+ #endif
+diff --git a/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx b/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
+index d9b8b1eace680..824139464fbb8 100644
+--- a/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
++++ b/xmlsecurity/source/xmlsec/mscrypt/xmlsignature_mscryptimpl.cxx
+@@ -233,6 +233,10 @@ SAL_CALL XMLSignature_MSCryptImpl::validate(
+     // We do certificate verification ourselves.
+     pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;
+ 
++    // limit possible key data to valid X509 certificates only, no KeyValues
++    if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecMSCngKeyDataX509GetKlass()) < 0)
++        throw RuntimeException("failed to limit allowed key data");
++
+     //Verify signature
+     //The documentation says that the signature is only valid if the return value is 0 (that is, not < 0)
+     //AND pDsigCtx->status == xmlSecDSigStatusSucceeded. That is, we must not make any assumptions, if
+diff --git a/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx b/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
+index b41d754f74072..fde4b747e9322 100644
+--- a/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
++++ b/xmlsecurity/source/xmlsec/nss/xmlsignature_nssimpl.cxx
+@@ -247,6 +247,10 @@ SAL_CALL XMLSignature_NssImpl::validate(
+         // We do certificate verification ourselves.
+         pDsigCtx->keyInfoReadCtx.flags |= XMLSEC_KEYINFO_FLAGS_X509DATA_DONT_VERIFY_CERTS;
+ 
++        // limit possible key data to valid X509 certificates only, no KeyValues
++        if (xmlSecPtrListAdd(&(pDsigCtx->keyInfoReadCtx.enabledKeyData), BAD_CAST xmlSecNssKeyDataX509GetKlass()) < 0)
++            throw RuntimeException("failed to limit allowed key data");
++
+         //Verify signature
+         int rs = xmlSecDSigCtxVerify( pDsigCtx.get() , pNode );
+