diff options
| author | Cy Schubert <cy@FreeBSD.org> | 2024-01-18 08:22:20 +0000 |
|---|---|---|
| committer | Gordon Tetlow <gordon@FreeBSD.org> | 2024-03-28 03:15:14 +0000 |
| commit | c48fe39ad13906f9425ec36bf42c2725e8e31979 (patch) | |
| tree | 0b6c747f12329e69be664c662f4b9c96e888efd7 | |
| parent | aaf2c7fdb81a1dd9de9fc77c9313f4e60e68fa76 (diff) | |
kerberos5: Mitigate the possibility of using an old libcrypto
By using the full library name (libcrypto.so.30) we avoid the exposure
of using an old, possibly vulnerable, library.
Reported by: jrtc27
Fixes: 476d63e091c2
Approved by: so
Security: FreeBSD-EN-24:08.kerberos
(cherry picked from commit 0990136ed1753ac7837206f9c5f4b83ccff6c405)
(cherry picked from commit 17e941a0c88cac2d8cd28d6614448adbd65d4b72)
| -rw-r--r-- | kerberos5/lib/libroken/fbsd_ossl_provider_load.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/kerberos5/lib/libroken/fbsd_ossl_provider_load.c b/kerberos5/lib/libroken/fbsd_ossl_provider_load.c index 497b32124f96..2328041bc166 100644 --- a/kerberos5/lib/libroken/fbsd_ossl_provider_load.c +++ b/kerberos5/lib/libroken/fbsd_ossl_provider_load.c @@ -5,6 +5,7 @@ #include <openssl/provider.h> #if defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3) +#define CRYPTO_LIBRARY "/lib/libcrypto.so.30" static void fbsd_ossl_provider_unload(void); static void print_dlerror(char *); static OSSL_PROVIDER *legacy; @@ -46,7 +47,7 @@ fbsd_ossl_provider_load(void) { #if defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3) if (crypto_lib_handle == NULL) { - if (!(crypto_lib_handle = dlopen("/usr/lib/libcrypto.so", + if (!(crypto_lib_handle = dlopen(CRYPTO_LIBRARY, RTLD_LAZY|RTLD_GLOBAL))) { print_dlerror("Unable to load libcrypto.so"); return (EINVAL); |