projects / poppler.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: c469509) | patch
Properly verify adbe.pkcs7.sha1 signatures.
authorJuraj Šarinay <juraj@sarinay.com>
Thu, 6 Mar 2025 01:02:56 +0000 (02:02 +0100)
committerSalvatore Bonaccorso <carnil@debian.org>
Sat, 6 Jun 2026 09:07:43 +0000 (11:07 +0200)
commit636ecc1dcc0e48af7aea1bdabec625fb672d1e3e
tree70d8a9c11fe870d35b0d76f13e9466fedfdbb9b4tree | snapshot
parentc469509f6ee37cc2a942cd68fc7030be2f74a852commit | diff
Properly verify adbe.pkcs7.sha1 signatures.

For signatures with non-empty encapsulated content
(typically adbe.pkcs7.sha1), we only compared hash values and
never actually checked SignatureValue within SignerInfo.
The bug introduced by c7c0207b1cfe49a4353d6cda93dbebef4508138f
made trivial signature forgeries possible. Fix this by calling
NSS_CMSSignerInfo_Verify() after the hash values compare equal.

Origin: upstream 25.04.0

Gbp-Pq: Name CVE-2025-43903.patch
poppler/NSSCryptoSignBackend.cc diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.