On Tue, 7 Mar 2017 23:34:38 +0000, Sevan Janiyan <ventur...@geeklan.co.uk> wrote:
> Hello, > security/py-crypto in ports is vulnerable to CVE-2013-7459, the > attached patches apply the changes from the following commit to > v2.6.1. > https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4 > > > Sevan Thanks for the ping, I looked at their website a while ago and read > In versions prior to v2.6.1, Crypto.Random was insecure when using > fork() in some cases. See the advisory for CVE-2013-1445 for more > information. It is recommended that users upgrade to PyCrypto v2.6.1 > or later. so I thought we were fine. That was another vuln, and the website is as maintained as the code. Here's a diff that works fine both on current and stable (just a off by one on -stable regarding the REVISION) Comments? OK? Cheers, Daniel Index: Makefile =================================================================== RCS file: /cvs/ports/security/py-crypto/Makefile,v retrieving revision 1.39 diff -u -p -r1.39 Makefile --- Makefile 3 Jan 2017 19:26:14 -0000 1.39 +++ Makefile 8 Mar 2017 00:38:30 -0000 @@ -3,7 +3,7 @@ COMMENT = cryptographic tools for Python MODPY_EGG_VERSION = 2.6.1 -REVISION = 3 +REVISION = 4 DISTNAME = pycrypto-${MODPY_EGG_VERSION} PKGNAME = py-crypto-${MODPY_EGG_VERSION} CATEGORIES = security devel Index: patches/patch-lib_Crypto_SelfTest_Cipher_common_py =================================================================== RCS file: patches/patch-lib_Crypto_SelfTest_Cipher_common_py diff -N patches/patch-lib_Crypto_SelfTest_Cipher_common_py --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-lib_Crypto_SelfTest_Cipher_common_py 8 Mar 2017 00:38:30 -0000 @@ -0,0 +1,48 @@ +$OpenBSD$ + +Based on +https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4 + +--- lib/Crypto/SelfTest/Cipher/common.py.orig Mon Oct 14 17:38:10 2013 ++++ lib/Crypto/SelfTest/Cipher/common.py Tue Mar 7 19:30:39 2017 +@@ -239,18 +239,32 @@ class RoundtripTest(unittest.TestCase): + return """%s .decrypt() output of .encrypt() should not be garbled""" % (self.module_name,) + + def runTest(self): +- for mode in (self.module.MODE_ECB, self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB, self.module.MODE_OPENPGP): ++ ## ECB mode ++ mode = self.module.MODE_ECB ++ encryption_cipher = self.module.new(a2b_hex(self.key), mode) ++ ciphertext = encryption_cipher.encrypt(self.plaintext) ++ decryption_cipher = self.module.new(a2b_hex(self.key), mode) ++ decrypted_plaintext = decryption_cipher.decrypt(ciphertext) ++ self.assertEqual(self.plaintext, decrypted_plaintext) ++ ++ ## OPENPGP mode ++ mode = self.module.MODE_OPENPGP ++ encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) ++ eiv_ciphertext = encryption_cipher.encrypt(self.plaintext) ++ eiv = eiv_ciphertext[:self.module.block_size+2] ++ ciphertext = eiv_ciphertext[self.module.block_size+2:] ++ decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv) ++ decrypted_plaintext = decryption_cipher.decrypt(ciphertext) ++ self.assertEqual(self.plaintext, decrypted_plaintext) ++ ++ ## All other non-AEAD modes (but CTR) ++ for mode in (self.module.MODE_CBC, self.module.MODE_CFB, self.module.MODE_OFB): + encryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) + ciphertext = encryption_cipher.encrypt(self.plaintext) +- +- if mode != self.module.MODE_OPENPGP: +- decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) +- else: +- eiv = ciphertext[:self.module.block_size+2] +- ciphertext = ciphertext[self.module.block_size+2:] +- decryption_cipher = self.module.new(a2b_hex(self.key), mode, eiv) ++ decryption_cipher = self.module.new(a2b_hex(self.key), mode, self.iv) + decrypted_plaintext = decryption_cipher.decrypt(ciphertext) + self.assertEqual(self.plaintext, decrypted_plaintext) ++ + + class PGPTest(unittest.TestCase): + def __init__(self, module, params): Index: patches/patch-src_block_template_c =================================================================== RCS file: patches/patch-src_block_template_c diff -N patches/patch-src_block_template_c --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ patches/patch-src_block_template_c 8 Mar 2017 00:38:30 -0000 @@ -0,0 +1,25 @@ +$OpenBSD$ + +Based on +https://github.com/dlitz/pycrypto/commit/8dbe0dc3eea5c689d4f76b37b93fe216cf1f00d4 + +--- src/block_template.c.orig Mon Oct 14 17:38:10 2013 ++++ src/block_template.c Tue Mar 7 18:56:27 2017 +@@ -170,6 +170,17 @@ ALGnew(PyObject *self, PyObject *args, PyObject *kwdic + "Key cannot be the null string"); + return NULL; + } ++ if (IVlen != 0 && mode == MODE_ECB) ++ { ++ PyErr_Format(PyExc_ValueError, "ECB mode does not use IV"); ++ return NULL; ++ } ++ if (IVlen != 0 && mode == MODE_CTR) ++ { ++ PyErr_Format(PyExc_ValueError, ++ "CTR mode needs counter parameter, not IV"); ++ return NULL; ++ } + if (IVlen != BLOCK_SIZE && mode != MODE_ECB && mode != MODE_CTR) + { + PyErr_Format(PyExc_ValueError,
