From fa0e3f39132d6136252afdd544030b68918676ef Mon Sep 17 00:00:00 2001 From: tanjiro Kamado Date: Mon, 5 Oct 2026 13:11:51 +0530 Subject: [PATCH] reject csr with bad signature in cupsSignCredentialsRequest X509_REQ_verify returns 0 when the signature does not match and a negative value only for other errors, so checking for < 0 let a request with an invalid signature through to be signed. --- CHANGES.md | 2 ++ cups/tls-openssl.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGES.md b/CHANGES.md index 439b86afe..c4691fdf9 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -19,6 +19,8 @@ v3.0.4 - YYYY-MM-DD - Fixed a potential buffer overflow in `cupsDNSSDAssembleFullName` on Windows (Issue #170) - Fixed a potential string overrun when loading .strings files (Issue #171) +- Fixed `cupsSignCredentialsRequest` to reject requests with a bad signature + when using OpenSSL. - Fixed an issue with `cupsGetCredentialsTrust` for credentials that are signed by an unknown CA. - Fixed PAM support in `ippeveprinter`. diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c index babf25df9..184685e99 100644 --- a/cups/tls-openssl.c +++ b/cups/tls-openssl.c @@ -1130,7 +1130,7 @@ cupsSignCredentialsRequest( return (false); } - if (X509_REQ_verify(crq, X509_REQ_get_pubkey(crq)) < 0) + if (X509_REQ_verify(crq, X509_REQ_get_pubkey(crq)) <= 0) { _cupsSetError(IPP_STATUS_ERROR_INTERNAL, _("Unable to verify X.509 certificate request."), true); goto done;