From cb1833afd9b6309563211b1c0a7c291f52ca98d5 Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Tue, 21 Apr 2026 19:26:10 +0200 Subject: [PATCH] lib/auth/rsa_psk: fix binary PSK identity lookup A server looking up PSK username with a NUL-character in it was wrongfully matching username truncated at a NUL-character. Fix the check to compare up to the full username length. CVE: CVE-2026-42010 Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/cb1833afd9b6309563211b1c0a7c291f52ca98d5] Reported-by: Joshua Rogers of AISLE Research Team Fixes: #1850 Fixes: CVE-2026-42010 Fixes: GNUTLS-SA-2026-04-29-4 CVSS: 7.1 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N Signed-off-by: Alexander Sosedkin Signed-off-by: Peter Marko Signed-off-by: Jakub Szczudlo --- lib/auth/rsa_psk.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/auth/rsa_psk.c b/lib/auth/rsa_psk.c index cc92b4aa96..27caf18769 100644 --- a/lib/auth/rsa_psk.c +++ b/lib/auth/rsa_psk.c @@ -321,8 +321,7 @@ static int _gnutls_proc_rsa_psk_client_kx(gnutls_session_t session, * filled in if the key is not found. */ ret = _gnutls_psk_pwd_find_entry(session, info->username, - strlen(info->username), &pwd_psk, - NULL); + info->username_len, &pwd_psk, NULL); if (ret < 0) return gnutls_assert_val(ret); -- GitLab