[PR #1351] [MERGED] Fix ssl-related crashes when closing connections [SECURITY VULNERABILITY CVE-2021-42074] #1789

New issue

Closed

opened 2026-05-05 08:01:59 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 08:01:59 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/debauchee/barrier/pull/1351
Author: @p12tic
Created: 11/1/2021
Status: ✅ Merged
Merged: 11/1/2021
Merged by: @p12tic

Base: master ← Head: fix-ssl-crash-closing-connections

📝 Commits (2)

8b937a4 lib/net: Fix race conditions when closing SSL connections
f0efe04 lib/net: Fix incorrect sharing of data between different SSL sessions

📊 Changes

4 files changed (+88 additions, -45 deletions)

View changed files

➕ doc/newsfragments/fix-crash-on-ssl-hello.bugfix (+4 -0)
➕ doc/newsfragments/ssl-corrupted-data.bugfix (+2 -0)
📝 src/lib/net/SecureSocket.cpp (+53 -38)
📝 src/lib/net/SecureSocket.h (+29 -7)

📄 Description

This PR fixes a number of race conditions in the SSL connection handling code. These may lead to crashes of the server and data corruption.

This PR fixes the following security vulnerability:

CVE-2021-42074 SIGSEGV on quick open/close sequence while sending Hello message.

The issue has been reported by Matthias Gerstner mgerstner@suse.de @mgerstner. Matthias also provided insights into how best to fix the issues, precise reproduction steps and any used tools and made the maintainer's life as pleasant as possible. Thank you!

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/debauchee/barrier/pull/1351 **Author:** [@p12tic](https://github.com/p12tic) **Created:** 11/1/2021 **Status:** ✅ Merged **Merged:** 11/1/2021 **Merged by:** [@p12tic](https://github.com/p12tic) **Base:** `master` ← **Head:** `fix-ssl-crash-closing-connections` --- ### 📝 Commits (2) - [`8b937a4`](https://github.com/debauchee/barrier/commit/8b937a4abd5425b6588c3e096f6daf16343674c4) lib/net: Fix race conditions when closing SSL connections - [`f0efe04`](https://github.com/debauchee/barrier/commit/f0efe043bbed01294c684c8d5c69cbfc77a3b050) lib/net: Fix incorrect sharing of data between different SSL sessions ### 📊 Changes **4 files changed** (+88 additions, -45 deletions) <details> <summary>View changed files</summary> ➕ `doc/newsfragments/fix-crash-on-ssl-hello.bugfix` (+4 -0) ➕ `doc/newsfragments/ssl-corrupted-data.bugfix` (+2 -0) 📝 `src/lib/net/SecureSocket.cpp` (+53 -38) 📝 `src/lib/net/SecureSocket.h` (+29 -7) </details> ### 📄 Description This PR fixes a number of race conditions in the SSL connection handling code. These may lead to crashes of the server and data corruption. This PR fixes the following security vulnerability: - CVE-2021-42074 SIGSEGV on quick open/close sequence while sending Hello message. The issue has been reported by Matthias Gerstner mgerstner@suse.de @mgerstner. Matthias also provided insights into how best to fix the issues, precise reproduction steps and any used tools and made the maintainer's life as pleasant as possible. Thank you! --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>