Skip to content

Commit 5f452bb

Browse files
jogmet8m
jogme
authored and
t8m
committed
Match the local q DHX parameter against the peer's q
As FFC/DH peer public key validation uses the peer's q value instead of checking against the local q, we must also check that these q values match when setting the peer's public key. Fixes CVE-2026-42770 Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Viktor Dukhovni <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> MergeDate: Mon Jun 8 19:56:27 2026 (cherry picked from commit 29b9df160cc5f20ee3907cce0cb271b982846bce)
1 parent 777b363 commit 5f452bb

1 file changed

Lines changed: 4 additions & 1 deletion

File tree

‎providers/implementations/exchange/dh_exch.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -146,12 +146,15 @@ static int dh_init(void *vpdhctx, void *vdh, const OSSL_PARAM params[])
146146
static int dh_match_params(DH *priv, DH *peer)
147147
{
148148
int ret;
149+
int ignore_q = 1;
149150
FFC_PARAMS *dhparams_priv = ossl_dh_get0_params(priv);
150151
FFC_PARAMS *dhparams_peer = ossl_dh_get0_params(peer);
151152

153+
if (dhparams_priv != NULL && dhparams_priv->q != NULL)
154+
ignore_q = 0;
152155
ret = dhparams_priv != NULL
153156
&& dhparams_peer != NULL
154-
&& ossl_ffc_params_cmp(dhparams_priv, dhparams_peer, 1);
157+
&& ossl_ffc_params_cmp(dhparams_priv, dhparams_peer, ignore_q);
155158
if (!ret)
156159
ERR_raise(ERR_LIB_PROV, PROV_R_MISMATCHING_DOMAIN_PARAMETERS);
157160
return ret;

0 commit comments

Comments
 (0)