Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug Report]: Patch for CVE-2021-3711 in reused component openssl #4

Open
ltcdCai opened this issue Jul 20, 2024 · 0 comments
Open

Comments

@ltcdCai
Copy link

ltcdCai commented Jul 20, 2024

Contact Details
[email protected]

What happened?
我通过使用V1SCAN(一个扫描存在于复用代码中1-Day漏洞的工具),发现您的项目中Openharmonyv1.0/third_party/openssl/test文件夹下的sm2_internal_test.c文件可能存在漏洞, 具体参考链接如下:

CVE-2021-3711 in sm2_internal_test.c:
相关触发逻辑类似GHSA-5ww6-px42-wc85
NVD说明链接:
https://nvd.nist.gov/vuln/detail/CVE-2021-3711

Replace the line 188 if (!TEST_true(sm2_plaintext_size(key, digest, ctext_len, &ptext_len)) with the following line:
if (!TEST_true(sm2_plaintext_size(ctext, ctext_len, &ptext_len))

考虑到其可能存在的潜在风险,我愿意配合您以负责任的方式及时核实、解决和报告发现的漏洞。 如果您需要任何进一步的信息或帮助,请随时与我联系。如果需要,我也可以提交PR帮助您修复。 谢谢您,期待尽快收到您的回复!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant