diff --git a/opensc-cardos-CVE-2008-2235.patch b/opensc-cardos-CVE-2008-2235.patch index 30973c7..d8c5175 100644 --- a/opensc-cardos-CVE-2008-2235.patch +++ b/opensc-cardos-CVE-2008-2235.patch @@ -48,7 +48,7 @@ diff -udrNPp --exclude=.svn opensc.orig/src/tools/pkcs15-tool.c opensc/src/tools "Uses reader number ", "Specify PIN", "Specify New PIN (when changing or unblocking)", -@@ -1175,6 +1180,182 @@ static int learn_card(void) +@@ -1175,6 +1180,176 @@ static int learn_card(void) return 0; } @@ -70,12 +70,6 @@ diff -udrNPp --exclude=.svn opensc.orig/src/tools/pkcs15-tool.c opensc/src/tools + goto end; + } + -+ if (strcmp("OpenSC Card",p15card->label) != 0) { -+ printf("not initialized by opensc, card is fine."); -+ rc = 0; -+ goto end; -+ } -+ + /* first select file on 5015 and get fci */ + sc_format_apdu(in_card, &apdu, SC_APDU_CASE_4_SHORT, 0xa4, 0x08, 0x00); + apdu.lc = sizeof(cmd1); diff --git a/opensc.changes b/opensc.changes index c812c2d..e4b52c4 100644 --- a/opensc.changes +++ b/opensc.changes @@ -1,3 +1,9 @@ +------------------------------------------------------------------- +Mon Sep 1 14:06:17 CEST 2008 - sbrabec@suse.cz + +- Check validity of SSL certificates for all Siemens CardOS M4 + cards (SCA and SCB are affected as well, bnc#413496#c6). + ------------------------------------------------------------------- Thu Jul 31 12:45:11 CEST 2008 - sbrabec@suse.cz diff --git a/opensc.spec b/opensc.spec index f90fe65..af1bc79 100644 --- a/opensc.spec +++ b/opensc.spec @@ -2,9 +2,16 @@ # spec file for package opensc (Version 0.11.4) # # Copyright (c) 2008 SUSE LINUX Products GmbH, Nuernberg, Germany. -# This file and all modifications and additions to the pristine -# package are under the same license as the package itself. # +# All modifications and additions to the file contributed by third parties +# remain the property of their copyright owners, unless otherwise agreed +# upon. The license for this file, and modifications and additions to the +# file, is the same license as for the pristine package itself (unless the +# license for the pristine package is not an Open Source License, in which +# case the license is the MIT License). An "Open Source License" is a +# license that conforms to the Open Source Definition (Version 1.9) +# published by the Open Source Initiative. + # Please submit bugfixes or comments via http://bugs.opensuse.org/ # @@ -23,7 +30,7 @@ BuildRequires: openct-devel %endif Url: http://www.opensc-project.org/opensc/ Version: 0.11.4 -Release: 58 +Release: 79 Group: Productivity/Security Summary: OpenSC Smart Card Library License: LGPL v2.1 or later @@ -149,6 +156,9 @@ rm -rf $RPM_BUILD_ROOT %{_libdir}/pkgconfig/*.pc %changelog +* Mon Sep 01 2008 sbrabec@suse.cz +- Check validity of SSL certificates for all Siemens CardOS M4 + cards (SCA and SCB are affected as well, bnc#413496#c6). * Thu Jul 31 2008 sbrabec@suse.cz - Fixed initialization access rights for Siemens CardOS M4, added a security check to pkcs15-tool (bnc#413496, CVE-2008-2235)