Bug 57508 - slapd with crudeoauth / OAUTHBEARER SASL module segfaults if JWKS is too large
Summary: slapd with crudeoauth / OAUTHBEARER SASL module segfaults if JWKS is too large
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: LDAP
Version: UCS 5.0
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.2-1-errata
Assignee: Florian Best
QA Contact: Arvid Requate
URL:
Keywords:
Depends on: 49006
Blocks:
  Show dependency tree / graph
 
Reported: 2024-08-07 17:08 CEST by Arvid Requate
Modified: 2025-05-07 13:53 CEST (History)
6 users (show)

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 7: Crash: Bug causes crash or data loss
Who will be affected by this bug?: 1: Will affect a very few installed domains
How will those affected feel about the bug?: 3: A User would likely not purchase the product
User Pain: 0.120
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): External feedback
Customer ID:
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2024-08-07 17:08:02 CEST 
We received external feedback about our crudeoauth SASL module from one person:

> In oauthbearer.h:55 size of the token is defined statically, the token we
> got from Azure containing multiple keys had about 12k characters, exceeding
> that static size and overflowing the buffer.

And that resulted in a segfault of slapd.
Comment 1 Florian Best univentionstaff 2025-05-05 12:13:49 CEST 
It's not about a access token but about the JWKS from the OIDC Provider.
The whole JWKS file is now read into memory, dynamically allocating the required size.

crudeoauth.yaml
81008310f396 | chore(univention-management-console): update advisory

crudeoauth (1.0.0-3)
60e2a9a400d5 | fix(crudeoauth): fix reading whole JWKS
Comment 2 Arvid Requate univentionstaff 2025-05-05 22:26:38 CEST 
Nice, thanks:

3bf4eb1b641 | docs(crudeoauth): add manpages

Successful build
Package: crudeoauth
Version: 1.0.0-4
Branch: 5.2-0
Scope: errata5.2-1
Comment 3 Iván.Delgado univentionstaff 2025-05-07 13:53:40 CEST 
<https://errata.software-univention.de/#/?erratum=5.2x78>