Kleopatra: Crashes or hangs on circular certificate chains
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• ikloecker
	Nov 18 2021, 2:35 PM

Description

There are several problems caused by circular certificate chains:

Kleopatra crashes on startup if there are X.509 certificates with a circular certificate chain in the key store.
Kleopatra hangs when trying to view the trust chain details of a certificate that's part of a circular chain.

rLIBKLEO Libkleo
	rLIBKLEOacf819889fdb Remove unused overloads of findIssuers()
	rLIBKLEO3edd6ea09957 Move definition of doClear() out of class definition
	rLIBKLEOf2e83a76a626 Add helper to check if container contains element matching a predicate
	rLIBKLEO741d8a53297c Prevent infinite loop when building issuer chain
	rLIBKLEO617c64a859f3 Clear the list of certificates with masked issuer when keys are cleared
	rLIBKLEO91ecfb859e80 Use a single return instead of multiple returns
	rLIBKLEO51f2bd618677 Prevent cycles in graph of certificate issuers
	rLIBKLEObdffed6eb0d7 Add possibility to mask the issuer of keys

Mentioned In: T6807: Kleo shows 3 certs in a chain while there are only two
T6602: Kleopatra: Crashes on deleting circular certificate chains
Mentioned Here: rGc9343bec83e2: sm: Detect circular chains in --list-chain.

Rating as High because this can be used for a DoS attack on individual users.

First issue is fixed.

Second issue is also fixed.

I didn't spot any other usages of Key::chainID() in libkleo (or kleopatra) that could cause problems. The usage in KeyListView looks safe.

• ikloecker changed the task status from Open to Testing.Nov 22 2021, 10:51 AM

• ikloecker moved this task from Restricted Project Column to Restricted Project Column on the Restricted Project board.

works, tested with the provided example certs