Accepting request 1229756 from security

Automatic submission by obs-autosubmit

OBS-URL: https://build.opensuse.org/request/show/1229756
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/cryptsetup?expand=0&rev=130

cryptsetup-2.7.4.tar.sign

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCAAdFiEEKikYJD/eRmSNBob52bBXe9k+mPwFAmao2IIACgkQ2bBXe9k+
-mPyvyg/9HKVAfgZaUkdY5whMSrYBD4QIzxq0yZSKUObGQEkVpKLQOIknDwFsOor/
-U2E+bMmmvGw6zrJpPWebqHM2+WLxxSzfNhYXR2RIQ2BrtGEp61RvcVgqOgx5Ikz6
-m8RHVFxS7lT4UbYMI5xXokJL2ctiDW4LvsBKYIrP/wGbwde+W50dtnBZnb5p4Krc
-H4kSSRebQIhZTKnioGek+UNIA+gAG/bwqG17MaBJYDS2yVHsUk2BslrNUesFFj7W
-apuiy95yD00Dt1FES8MZL5eEnfcRe4qSo/4PSIrtE7rR3uBjrIX4mTJMtPpM4COB
-x8Uhr9rqANxcRxm21JopS7kS5S7quRUqdYWzgHhCwD9uXdhVzaRHc82Xyg5giUeb
-UkYVYQCXUWCG3rORT4Z6JYTiUMspdZywFPYR5lzhsNzazqnjMhymKBDvDRD07pGq
-LVEYUiQIx3WJgTdYZ0vhkRorooIe4D7i4rcBEUtqDTtMOZpROVE/9HE/noXCITlz
-/8Ve4k8xeTiUItQKNS79amc4u7kUOUAnvfojEUFCY6jsXBLCVDsJYTgs4mK7/PrF
-i1/XnLi7a5bkvK3dj0XN8zToG4Meq4A6yv+S1V2c+tBmxH51AbgtfZeiam976PiH
-O8JcSart3/xOfQ2UfvF2kNc7EbAUTKQpZjEr3u2UepMWM5HdFJk=
-=BZfz
------END PGP SIGNATURE-----

cryptsetup-2.7.4.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:dce29903a58f7b774fe61191e7e6de955de0f40d9e27b0028ffcf3438c0e9480
-size 11695292

cryptsetup-2.7.5.tar.sign

@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCAAdFiEEKikYJD/eRmSNBob52bBXe9k+mPwFAmbW3FUACgkQ2bBXe9k+
+mPwFbA//ZmEE58/+S4mDszoVeBtJAZDpSd0UBm+R6JTqNjwGSQw2KQbRW+qXLWIj
+EUKd/xtW8iSDh+cqKFO12RN7BTHMHePt+qB8aw3L1WWbj2rQfLbEv+dQMg36Rweu
+AZMR69PDhD8JX2xVV2nD/rrQFHoNfKT9od83QHmaK/knwOvd7ZHJ2sOyMmZvCNE8
+N8/454ERiT8W9hnHxWjsGtkzr81ucGpjbZDYlINaeD728QR64HDHnAkReAHegJt8
+uAejzAz+BGNkSkUFeRLP+3zOYUKBW6Ex/OIBQ4m+rrAR/b3TVNwGPUUAbelHZJWN
++jf+aPzo4Vv1v+Hl92CEbq29czpHyaLRrRNdhs57no7XdUkivJ+gdhr51xjaV9Zq
+HnANYLVT+O/PPfFaALg1Qp5hfmhVCaVPLK05ug2qj9jVF0jIahvQsEzq1YfLiZNT
+8UtAnV8ULA83GZlh1MDsuEp5815CKjs5dzpUpobStsVIZ6lkHabEFRfxr2Ae+7lw
+veqmpNLN1K5+yXA1L8e9BtoxRxeczIS3ImPlYvojpCFgkamwXPqCoI4wVOCbG/Pu
+5L1uDk1TAHEgmf4Iy31bPKLDQcv16aLV5S/w4fCWtybbBasax7qNqKTBAIZQp7o2
+C1hkxCcRxaNyMwEoof9myMjv9fn/0xidJ14GlgXpeANbq9jtXQo=
+=S6/S
+-----END PGP SIGNATURE-----

cryptsetup-fips140-3.patch

@@ -0,0 +1,22 @@
+Index: cryptsetup-2.7.0/lib/utils_benchmark.c
+===================================================================
+--- cryptsetup-2.7.0.orig/lib/utils_benchmark.c
++++ cryptsetup-2.7.0/lib/utils_benchmark.c
+@@ -196,7 +196,7 @@ int crypt_benchmark_pbkdf_internal(struc
+ 		pbkdf->parallel_threads = 0; /* N/A in PBKDF2 */
+ 		pbkdf->max_memory_kb = 0; /* N/A in PBKDF2 */
+ 
+-		r = crypt_benchmark_pbkdf(cd, pbkdf, "foobarfo", 8, "01234567890abcdef", 16,
++		r = crypt_benchmark_pbkdf(cd, pbkdf, "foobarfofoobarfofoobarfo", 24, "01234567890abcdef", 16,
+ 					volume_key_size, &benchmark_callback, &u);
+ 		pbkdf->time_ms = ms_tmp;
+ 		if (r < 0) {
+@@ -216,7 +216,7 @@ int crypt_benchmark_pbkdf_internal(struc
+ 			return 0;
+ 		}
+ 
+-		r = crypt_benchmark_pbkdf(cd, pbkdf, "foobarfo", 8,
++		r = crypt_benchmark_pbkdf(cd, pbkdf, "foobarfofoobarfofoobarfo", 24,
+ 			"0123456789abcdef0123456789abcdef", 32,
+ 			volume_key_size, &benchmark_callback, &u);
+ 		if (r < 0)

cryptsetup.changes

@@ -1,3 +1,25 @@
+-------------------------------------------------------------------
+Fri Sep 13 07:36:26 UTC 2024 - Pedro Monreal <pmonreal@suse.com>
+
+- Update to 2.7.5:
+  * Fix possible online reencryption data corruption (only in 2.7.x).
+    In some situations (initializing a suspended device-mapper device),
+    cryptsetup disabled direct-io device access. This caused unsafe
+    online reencryption operations that could lead to data corruption.
+    The code now adds strict checks (and aborts the operation) and
+    changes direct-io detection code to prevent data corruption.
+  * Fix a clang compilation error in SSH token plugin.
+    As clang linker treats missing symbols as errors, the linker phase
+    for the SSH token failed as the optional cryptsetup_token_buffer_free
+    was not defined.
+  * Fix crypto backend initialization in crypt_format_luks2_opal API call.
+
+-------------------------------------------------------------------
+Fri Aug 30 15:07:28 UTC 2024 - Marcus Meissner <meissner@suse.com>
+
+- cryptsetup-fips140-3.patch: extend the password for PBKDF2 benchmarking
+  to be more than 20 chars to meet FIPS 140-3 requirements (bsc#1229975)
+
 -------------------------------------------------------------------
 Wed Jul 31 06:27:18 UTC 2024 - Martin Schreiner <martin.schreiner@suse.com>
 

cryptsetup.spec

@@ -18,7 +18,7 @@
 
 %define so_ver 12
 Name:           cryptsetup
-Version:        2.7.4
+Version:        2.7.5
 Release:        0
 Summary:        Setup program for dm-crypt Based Encrypted Block Devices
 License:        CC-BY-SA-4.0 AND LGPL-2.0-or-later WITH cryptsetup-OpenSSL-exception
@@ -31,6 +31,7 @@ Source2:        baselibs.conf
 Source3:        cryptsetup.keyring
 # FAQ.md is CC-BY-SA-4.0
 Source4:        https://creativecommons.org/licenses/by-sa/4.0/legalcode.txt#/cc-by-sa-4.0.txt
+Patch0:         cryptsetup-fips140-3.patch
 # 2.6.38 has the required if_alg.h
 BuildRequires:  linux-glibc-devel >= 2.6.38
 BuildRequires:  fdupes