Bug#513539: wvstreams: Does not properly check return type of X509_REQ_verify()

[Kurt Roeckx <kurt@roeckx.be>]

Package: wvstreams
Severity: serious
Tags: security

Hi,

I was looking at return codes for applications making use of
openssl functions and found this in crypto/wvx509.cc:
    int verify_result = X509_REQ_verify(certreq, pk);
    if (verify_result == 0)
    {
        debug(WvLog::Warning, "Self signed request failed");
        X509_REQ_free(certreq);
        EVP_PKEY_free(pk);
        return WvString::null;
    }
    else
    {
        debug("Self Signed Certificate Request verifies OK!\n");
    }

X509_REQ_verify() is a function that returns the value of
ASN1_item_verify() which can return -1 in case the message
digest type is not known or there is an out of memory condition.

I have no idea what how this is used exactly or what the
consequences of this are.

If the attacker can not specify the certificate that is being
used there probably isn't any serious problem.


Kurt