projects / poppler.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 9fe9f84) | patch
Properly verify adbe.pkcs7.sha1 signatures.
authorJuraj Šarinay <juraj@sarinay.com>
Thu, 6 Mar 2025 01:02:56 +0000 (02:02 +0100)
committerJohn Scott <jscott@posteo.net>
Thu, 2 Jul 2026 16:52:33 +0000 (16:52 +0000)
commitb4249ee163ea6805b1cb82db471af03e40d9f5d5
tree3ae06578450dab2654dc769ddeba359e7d2fc1cetree | snapshot
parent9fe9f84ad920b51fc6fc59e7bf83cb8cc6344368commit | diff
Properly verify adbe.pkcs7.sha1 signatures.

For signatures with non-empty encapsulated content
(typically adbe.pkcs7.sha1), we only compared hash values and
never actually checked SignatureValue within SignerInfo.
The bug introduced by c7c0207b1cfe49a4353d6cda93dbebef4508138f
made trivial signature forgeries possible. Fix this by calling
NSS_CMSSignerInfo_Verify() after the hash values compare equal.

Origin: upstream 25.04.0

Gbp-Pq: Name CVE-2025-43903.patch
poppler/NSSCryptoSignBackend.cc diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.